1. What we collect
Order data: name, email address, shipping address, order contents and payment status. We do not receive or store full card numbers; the payment provider sends us a status and a transaction reference.
Account data: email address, a hashed password, and the orders linked to the account. Accounts are optional — you can check out as a guest.
Technical data: IP address, user agent and pages requested, kept in server logs for security and abuse prevention. Advertising and analytics cookies are set only after you accept them.
2. Why we use it
To print and ship your order, to answer support requests, to keep the site working and secure, and — where you have consented — to measure traffic and show advertising.
We do not sell personal data. We do not share it with advertisers in a form that identifies you.
3. Who we share it with
Print and fulfilment partners, who receive the shipping details needed to produce and deliver the order. Payment providers, who process the transaction. Email delivery providers, who send order and account messages. Hosting and infrastructure providers.
Each of these is bound by a data processing agreement and may use the data only to provide the service to us.
4. How long we keep it
Order records are kept for seven years where tax and accounting rules require it. Account records are kept until you delete the account. Server logs are kept for 30 days. Advertising and analytics identifiers are kept for up to 14 months.
5. Your rights
You can request access to your data, correction of it, deletion of it, a portable copy, or restriction of processing. You can withdraw advertising consent at any time from the cookie banner or the privacy settings link in the footer.
Where you are in the EEA or the UK, you also have the right to lodge a complaint with your local supervisory authority. Where you are in California, you have the right to know, delete and opt out of sale or sharing; we do not sell data, and we honour opt-out preference signals.
6. Contact
Privacy questions: [email protected]. Data requests are answered within 30 days.