Privacy policy

Information you give us: your name, email address, delivery address, phone number (optional), personalisation wording, uploaded logos, gift messages, reviews, messages you send us, and your account password (stored only as a secure hash).

Payment information for direct-site orders is collected and processed by Stripe. We receive only the card type, last four digits and a payment reference — never your full card number. For Etsy orders, Etsy processes payment under its own privacy policy.

Information collected automatically: basic device and browser details, pages you visit and how you got here, collected through cookies and similar technologies as described in our cookie policy.

From Etsy: if you buy from our Etsy shop or contact us through Etsy Messages, we receive information such as your name, email address, delivery address, order details, personalisation details and messages so we can fulfil the order, provide support and keep the records we need.

• To fulfil your order — make, personalise, pack and deliver your pieces, take payment, send order and delivery updates. Basis: performance of a contract.
• To run your account — sign-in, saved addresses, wishlist and order history. Basis: performance of a contract.
• To manage Etsy orders and messages — fulfil orders placed through Etsy, respond to Etsy Messages, handle returns or complaints and maintain order records. Basis: performance of a contract and legitimate interests.
• To answer your messages and handle returns or complaints. Basis: contract and legitimate interests.
• To send marketing emails about new designs and offers, only if you opt in. You can unsubscribe at any time from any email or in your account settings. Basis: consent.
• To improve the Site — understanding which pages and pieces people find useful, fixing bugs, preventing fraud. Basis: legitimate interests, and consent for analytics cookies.
• To meet legal obligations — tax, accounting and consumer-law records. Basis: legal obligation.

We never sell your information. We share it only where needed to run the shop, fulfil an order, provide support or comply with the law:

• Stripe — payment processing for orders placed directly through this Site
• Etsy — orders and messages placed through our Etsy shop; Etsy is responsible for its own platform processing under its privacy policy
• Delivery providers, such as Royal Mail or another courier — name, address and phone where needed for delivery
• Resend — transactional and marketing emails from the Site
• Vercel and MongoDB Atlas — hosting and database services
• Analytics providers — only if you accept analytics cookies
• Professional advisers and authorities where the law requires it

Some of our providers process data outside the UK (for example in the EU or United States). Where they do, we rely on the UK International Data Transfer Agreement, UK adequacy regulations or equivalent safeguards so your information stays protected to UK standards.

• Order records, invoices and correspondence about them — 6 years after the order, as HMRC requires.
• Account information — while your account is open, then deleted within 30 days of you closing it (order records are kept as above).
• Personalisation files and uploaded logos — 12 months after the order, in case you reorder, then deleted.
• Marketing consent — until you unsubscribe, plus a suppression record so we don't email you again.
• Enquiries without an order — 12 months.

The Site is served over HTTPS, passwords are stored as one-way hashes, and access to customer data is limited to the people who need it. Our service providers apply their own technical and organisational security measures. No system is perfectly secure; if we discover a personal-data breach, we will notify the ICO and affected people where required by law and without undue delay.

You have the right to:

• Access the personal information we hold about you.
• Correct anything that is wrong or incomplete.
• Delete your information where we no longer need it (some order records must be kept by law).
• Restrict or object to certain processing, including direct marketing at any time.
• Portability — receive your information in a machine-readable format.
• Withdraw consent where consent is the basis, without affecting earlier processing.

To use any of these, email hello@mossolivestudio.com. If your request relates to an Etsy order, you can also contact us through Etsy Messages. We respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113 — but we'd love the chance to put things right first.

The Site is not intended for under-16s and we don't knowingly collect their information. If you think a child has given us personal data, contact us and we will delete it.

We don't make decisions about you using automated processing that has legal or similarly significant effects. Fraud screening by our payment provider may flag unusual orders for a human to check.

We will post any changes here and update the date at the top. For significant changes we'll email account holders.

Moss & Olive Studio Ltd, Stoke-on-Trent, England. Email hello@mossolivestudio.com.