1.WHAT INFORMATION DO WE COLLECT?

Personal Information You Disclose

We collect names, email addresses, phone numbers, billing addresses, order details and information you choose to provide when placing an order or contacting us.

Information processed in our internal business workflows may also include customer-support correspondence, order information and business records held in connected services. We limit the information used in each workflow to what is needed for its purpose.

We do not intentionally request special-category personal data. Please do not include it in support messages. If it is supplied unintentionally, we will review it and delete or restrict it unless lawful retention is necessary.

Payment Data

Payment data is processed by Shopify and Shopify Payments. We do not store full card details.

2.HOW DO WE PROCESS YOUR INFORMATION?

We process information to fulfil orders, provide customer support, send service and administrative messages, maintain security and business records, operate connected business workflows, improve our services and comply with legal obligations including UK tax requirements.

Some authorised workflows use connected business services and AI tools to collect, transfer, organise or summarise operational information. These workflows may involve limited customer or order information where needed for the task.

3.WHAT LEGAL BASES DO WE RELY ON?

Depending on the activity, we rely on performance of a contract (including order fulfilment), compliance with legal obligations (including tax and accounting records), our legitimate interests (including service improvement, security and business administration), and consent where required for optional analytics or direct marketing. Where processing relies on consent, you may withdraw it at any time.

4.WHEN AND WITH WHOM DO WE SHARE YOUR INFORMATION?

We use the following service providers for the stated operational purposes:

• Shopify and Shopify Payments — storefront hosting, checkout, order processing and payment processing.
• Microsoft 365, including Outlook and OneDrive — business email, customer support, document storage and business records.
• Notion — product information and limited internal operational and order records.
• OpenAI (ChatGPT) — authorised internal workflows that may process limited order, customer-support or business information to collect, organise or summarise operational records.
• xAI (Grok) — authorised internal workflows using connected business services. Depending on the task, Grok may process customer and order details, customer-support correspondence, business files, operational records or content handled through connected services, including ElevenLabs.
• Windsor.ai — connecting and analysing data from business and marketing platforms. Depending on the connected sources, this may include campaign, website, sales or customer-related data.
• ElevenLabs — AI audio and voice services where used for business workflows. Information processed depends on the task and may include content supplied through connected tools.

We limit information shared with each provider to what is needed for the relevant task. We do not sell personal data. We disclose information only where necessary to provide our services, comply with law, or establish, exercise or defend legal claims.

Some providers may process information outside the United Kingdom. Where UK data-protection law restricts such a transfer, we assess the transfer and use an applicable adequacy regulation or appropriate safeguard.

5.COOKIES AND TRACKING TECHNOLOGIES

We use strictly necessary cookies for site operation. Optional analytics or advertising technologies are used only in accordance with the choices made through our live cookie banner. The current categories, providers and durations are described in our Cookie Policy, and preferences can be changed through the banner or browser controls.

6.AI-BASED PRODUCTS

We use third-party AI tools, including ChatGPT and Grok, to support some internal business and operational workflows and to help prepare some product materials. The tools used depend on the task.

Some authorised workflows may process limited customer or order information through connected business services. Grok may access information in connected services such as Shopify, Outlook, OneDrive, Notion and ElevenLabs when needed for an authorised task. The types of information involved depend on the workflow and are described in Section 4.

AI-assisted product materials do not, by themselves, require us to send customer personal information to an AI provider. If a product feature processes customer information through an AI provider, we will explain that processing before or when the information is collected.

We remain responsible for our processing of personal information and limit the information used in each workflow to what is needed for its purpose.

7.HOW LONG DO WE KEEP YOUR INFORMATION?

Order and transaction records (such as name, email, order ID, amount and invoice) are retained for 6 years where required for UK tax and accounting purposes.

Marketing communications (newsletter sign-ups and promotional emails) are retained while you remain subscribed. After unsubscribe, we remove you from active marketing and may retain the minimum suppression record needed to respect your choice.

Customer-support emails are retained for approximately 2 years and then reviewed for ongoing relevance.

Operational records and information processed through connected services are retained according to the purpose of the record and any applicable legal or accounting requirement. We review information and delete or anonymise it when it is no longer needed for that purpose.

Analytics and behavioural data are retained only for as long as necessary for the purposes described in this notice.

You may request deletion by contacting us (see Section 12). We will assess the request against applicable legal obligations and permitted retention.

8.HOW DO WE KEEP YOUR INFORMATION SAFE?

We use technical and organisational measures designed to protect information in a manner proportionate to the risk. No system is completely secure, so we also limit access and the data used by each workflow.

9.INFORMATION FROM MINORS

We do not knowingly collect data from children under 18.

10.YOUR PRIVACY RIGHTS

Depending on the processing and lawful basis, your rights can include access, rectification, erasure, restriction, objection and data portability, together with the right to withdraw consent where consent is used. Contact us to exercise a right. If you remain dissatisfied, you also have the right to complain to the UK Information Commissioner’s Office (ICO) through its data protection complaints service.

11.UPDATES TO THIS NOTICE

We may update this notice to reflect changes in our services, providers or legal obligations. We will update the date above and, where a change is material, take reasonable steps to bring it to your attention.

12.CONTACT US