Legal
Privacy policy
Last updated 16 April 2026
What we collect
To process an order we collect: your name, email, shipping address, billing address, and phone number (optional). Payment card details are handled directly by Stripe and never touch our servers. We also store a server-signed cart cookie so your in-progress cart survives across page loads.
Why we collect it
To fulfil your order, to communicate about delivery and returns, to meet tax and accounting obligations, and — with explicit consent — to send you a monthly newsletter.
How long we keep it
Order records: 7 years (tax and accounting). Customer accounts: until you close them plus a 30-day grace period. Abandoned cart data: 30 days. Server logs: 90 days.
Your rights
You may request a copy of the data we hold, correction of inaccurate data, deletion, or a machine-readable export. Email [email protected] and we will respond within 30 days.
Third parties
We share data only with vendors who are necessary to operate the store: Stripe (payments), Supabase (database), Vercel (storefront hosting), Fly.io (backend hosting). Each has a Data Processing Agreement in place. We do not sell personal data.
Cookies
Essential cookies (session, cart, CSRF) are set without consent because the site cannot function without them. Analytics and marketing cookies are never set before you grant consent.