Privacy
Short, because there is not much to say.
The short version
We collect what is needed to sell you something and send it to you. We do not track you, do not profile you, do not buy or sell lists, and have never sent a marketing email. If that changes you will be asked first.
What is held, and why
| What | Why | On what basis | How long |
|---|---|---|---|
| Your name, email, and postal address | To take an order, send the parcel, and answer you about it. | Needed to perform the contract you entered into. | Kept for seven years, because tax records have to be. |
| What you bought and what you paid | It is the order, and it is the accounting record behind it. | Contract, and a legal obligation to keep business records. | Seven years. |
| Your phone number, if you gave one | Couriers ask for one, and some deliveries cannot go without it. | Contract. | With the order. |
| What you wrote in an enquiry or a commission brief | To quote the work and then to make it. | Contract, or your consent before there is one. | Until the job is done, then with the order record. |
| Your trade account details, if you have one | To price your orders, invoice them, and know who is authorised. | Contract. | While the account is open, then seven years. |
Who else sees it
As few people as possible, and only where the job cannot be done otherwise:
- Stripe take the payment. They see your card details; we do not. They also see your name and email, because a receipt has to go somewhere.
- Australia Post and other carriers get the name, address and phone number on the parcel. There is no way to send a parcel without telling somebody where it is going.
- Cloudflare host the website and see the ordinary technical detail of a web request, including the country you are connecting from. That country is what decides which currency prices are shown in and whether you are asked about cookies.
- An accountant, at the point where the books are done.
Nobody else. No advertising networks, no analytics companies, no data brokers.
Where it is kept
On Cloudflare's infrastructure, which is distributed across the world including inside and outside the EEA. Where information about somebody in the EEA or the UK leaves that area, it is covered by the standard contractual clauses Cloudflare and Stripe both operate under.
Your rights
Wherever you live, you can ask what is held about you, ask for it to be corrected, or ask for it to be deleted. If you are in the EU or the UK you can also ask for a copy in a portable form, object to processing, or ask for it to be restricted while a dispute is sorted out.
There is one limit and it is worth being straight about: tax records cannot be deleted on request. If you have bought something, the invoice has to be kept for seven years. Everything else can go.
Email and ask. There is no form and there is no charge, and you should hear back inside a few days rather than the month the law allows.
Complaining
If you are not satisfied, in Australia the Office of the Australian Information Commissioner takes complaints; in the UK it is the Information Commissioner's Office; in the EU it is the data protection authority for the country you live in. Please try us first — it is one person and it is usually a misunderstanding.
What the website stores in your browser
Listed in full under what we store. It is four things, all of them local to your device, none of them tracking.