Privacy policy

Information you give us: your name, email address, delivery address, phone number (optional), personalisation wording, uploaded logos, gift messages, reviews, messages you send us, and your account password (stored only as a secure hash).

Payment information is collected and processed by our payment provider (Stripe). We receive only the card type, last four digits and a payment reference — never your full card number.

Information collected automatically: basic device and browser details, pages you visit and how you got here, collected through cookies and similar technologies as described in our cookie policy.

From third parties: if you bought from our Etsy shop, we receive your order details from Etsy so we can fulfil it and keep an order history for you.

• To fulfil your order — make, personalise, pack and deliver your pieces, take payment, send order and delivery updates. Basis: performance of a contract.
• To run your account — sign-in, saved addresses, wishlist and order history. Basis: performance of a contract.
• To answer your messages and handle returns or complaints. Basis: contract and legitimate interests.
• To send marketing emails about new designs and offers, only if you opt in. You can unsubscribe at any time from any email or in your account settings. Basis: consent.
• To improve the Site — understanding which pages and pieces people find useful, fixing bugs, preventing fraud. Basis: legitimate interests, and consent for analytics cookies.
• To meet legal obligations — tax, accounting and consumer-law records. Basis: legal obligation.

We never sell your information. We share it only with the service providers we need to run the shop, each under a contract that restricts what they can do with it:

• Payment processing — Stripe
• Delivery — Royal Mail (name, address and phone for delivery updates)
• Email — Resend (transactional and marketing emails)
• Hosting and database — Vercel and MongoDB Atlas
• Analytics — only if you accept analytics cookies
• Professional advisers and authorities where the law requires it

Some of our providers process data outside the UK (for example in the EU or United States). Where they do, we rely on the UK International Data Transfer Agreement, UK adequacy regulations or equivalent safeguards so your information stays protected to UK standards.

• Order records, invoices and correspondence about them — 6 years after the order, as HMRC requires.
• Account information — while your account is open, then deleted within 30 days of you closing it (order records are kept as above).
• Personalisation files and uploaded logos — 12 months after the order, in case you reorder, then deleted.
• Marketing consent — until you unsubscribe, plus a suppression record so we don't email you again.
• Enquiries without an order — 12 months.

The Site is served over HTTPS, passwords are stored as one-way hashes, access to customer data is limited to the people who need it, and our providers hold recognised security certifications. No system is perfectly secure; if we ever discover a breach that puts you at risk we will tell you and the ICO without undue delay.

You have the right to:

• Access the personal information we hold about you.
• Correct anything that is wrong or incomplete.
• Delete your information where we no longer need it (some order records must be kept by law).
• Restrict or object to certain processing, including direct marketing at any time.
• Portability — receive your information in a machine-readable format.
• Withdraw consent where consent is the basis, without affecting earlier processing.

To use any of these, email hello@mossolivestudio.com. We respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113 — but we'd love the chance to put things right first.

The Site is not intended for under-16s and we don't knowingly collect their information. If you think a child has given us personal data, contact us and we will delete it.

We don't make decisions about you using automated processing that has legal or similarly significant effects. Fraud screening by our payment provider may flag unusual orders for a human to check.

We will post any changes here and update the date at the top. For significant changes we'll email account holders.

Moss & Olive Studio Ltd, Stoke-on-Trent, England. Email hello@mossolivestudio.com.