Privacy policy

Your trade account. Business name, your name, work email address, telephone number, billing and delivery addresses, and the company or VAT number where you give it. Your password is stored only as a cryptographic hash — we never see it and cannot recover it. If you sign in with Google we receive your name, email address and Google account identifier, and never your Google password.

Your designs and orders. The specifications you build in the configurator, the projects you save (including unfinished drafts), quantities, prices, turnaround, finish and delivery choices, order history, invoices and payment status.

Payments. Orders are normally paid by bank transfer. We see the amount, the reference and whether it has cleared; we never see your online banking credentials. Where card payment is offered, the card details are handled by Stripe and are not stored on our systems.

Messages between us. Emails and support requests, and records of the account and order emails we send you — including whether they were delivered, opened, and whether links in them were followed. That tracking is part of how we detect emails that fail to arrive properly.

Device and usage information. Pages viewed, approximate location derived from your IP address, browser and operating system, screen size and whether the device has a touch screen. We use the coarse signals to record whether a design was drawn up on a phone, a tablet or a desktop, so we know which devices to build for — not to identify you personally.

Referrals and promotions. If you take part in our referral scheme we hold your referral code, who referred you or who you referred, and any Instagram handle you give us. If you enter a prize draw we see your public Instagram comment and handle, and collect contact details from a winner in order to award the prize.

To perform our contract with you. Opening and running your trade account; pricing, manufacturing, delivering and invoicing your orders; saving your projects so you can pick them up on another device; answering support questions; taking payment.

Our legitimate interests — running a business people can buy from safely:

• keeping the site working, secure and free of fraudulent or abusive sign-ups;
• understanding in aggregate how the site is used, and which devices it is used on, so we can improve it;
• telling existing trade customers about products and offers similar to what they have already bought;
• running the referral scheme and our prize draws;
• keeping records to defend or bring legal claims and to manage our business.

We have weighed these against your interests. You can object to any of them at any time — see section 10.

Legal obligations. Keeping accounting, VAT and tax records and, for prize draws, the winner records the Advertising Standards Authority requires.

Consent, where we ask for it — for example marketing emails to someone who has not bought from us. You can withdraw consent at any time, and doing so does not affect anything done before you withdrew it.

Essential storage. When you sign in, your session token is kept in your browser’s local storage so you stay signed in. Your basket and your checkout choices are stored the same way, so closing a tab does not lose your work. The site cannot function without these and they are not used for advertising.

Analytics. We use Vercel Web Analytics, which counts page views and referrers without cookies and without identifying visitors. We do not use Google Analytics, advertising tags, or any cross-site tracking, and we do not build profiles of the people who visit the site.

We do not sell personal data. We share it only with suppliers who process it on our instructions under a contract, and only as far as they need it:

• our hosting and infrastructure providers, who run the website, the ordering system and its database;
• our email provider, which delivers order, account and marketing emails;
• our payment provider, where a card payment is offered, and our bank;
• our analytics providers, as described in section 5;
• the carriers who deliver your goods, who receive the delivery address and a contact number;
• our accountants, insurers and professional advisers, where they need it.

We keep personal data only as long as we need it, and then delete it or anonymise it:

• Orders, invoices and payment records — 6 years from the end of the accounting year they fall in, because tax law requires it.
• Your account and saved projects — while your account is open. Ask us to close it and we delete or anonymise what we are not required to keep.
• Prize draw records — winner details for 6 years for accounting and audit; entrants’ comments are not copied off Instagram.
• Email delivery records — for as long as we need them to prove an email was sent and diagnose delivery problems.
• Analytics — retained in aggregate, and in Google Analytics under that service’s own retention setting.

Under UK GDPR you can ask us to:

• tell you what we hold and give you a copy of it;
• correct anything inaccurate or incomplete;
• delete it, where we no longer need it and no law requires us to keep it;
• restrict how we use it while a question is resolved;
• send it to you, or to another provider, in a machine-readable form;
• stop using it for direct marketing — an absolute right, which we act on immediately; or
• stop processing based on our legitimate interests, where your circumstances outweigh them.