Privacy Policy

Last updated: [DATE]. Data controller: [TRADING NAME] LTD, [REGISTERED ADDRESS]. Contact: [PRIVACY EMAIL].

What we collect & why

Your early-access email address, if you join the waitlist (to tell you when we launch, and to send you a welcome note) — this is the only thing we collect before the shop opens; account email + password hash (to run your account); order details + delivery address (to fulfil and ship); your hub's Hub-ID (to issue a node-locked licence code); a back-in-stock reminder address, if you ask to be told when an item returns. We do not store card details.

Joining the waitlist also records a "signed up" marker against that day's anonymous visitor identity (see Visitor statistics below) so we can tell how many visits become subscribers. That marker carries no email address.

You can leave the waitlist at any time using the unsubscribe link in any email we send, or by emailing us. Deleting your account also removes you from the waitlist and from any back-in-stock reminders.

Processors we share with

Stripe (payments & tax), our shipping platform (ShipEngine / Shippo) and the delivery carriers (delivery & tracking), our email delivery provider (order and account emails), Cloudflare (content delivery and aggregate edge page-view counts), ip-api.com (transient address-to-location estimates for our visitor statistics), and our hosting provider (running this site). They act as processors under their own terms. Some (notably Stripe and Shippo) are US companies — transfers are covered by the UK extension to the EU–US Data Privacy Framework and/or the ICO's International Data Transfer Agreement. [CONFIRM PROCESSOR LIST WITH FINAL SUPPLIERS.]

Retention

We keep order and tax records as long as the law requires (typically 6 years) and account data until you ask us to delete it. If you delete your account, your order records (which include your email and delivery address) are retained for that legal period under our legal-obligation basis, then erased.

One other thing survives deletion, on purpose: if you have unsubscribed from our emails we keep a record of that address on a suppression list. We have to remember an unsubscribe in order to keep honouring it, which the Privacy and Electronic Communications Regulations require. It is used for nothing else.

Your rights (UK GDPR)

You can request access, correction, deletion, or a copy of your data, and object to processing. Email [PRIVACY EMAIL]. You may complain to the ICO (ico.org.uk).

Cookies

We set only strictly-necessary, first-party cookies — no advertising or tracking cookies, so no consent banner is required:

gl_session — keeps you logged in.
gl_cart — remembers your basket (works without an account).
gl_checkout — links your checkout back to your delivery address and chosen shipping rate.
gl_admin — staff sign-in for the shop's own back office (set only when an operator logs in).

Analytics

We measure site traffic ourselves, on our own server, from the requests your browser already sends: the page you visited, the full address of the referring page, any campaign tags in the link you followed, your browser’s identification string (User-Agent) and language preferences, and a country/city/network estimate derived from your IP address. Your IP address itself is not kept in the analytics records. Each visit is stored against two salted hashes: a visitor hash that changes every day (so we can count people without following anyone from one day to the next), and a stable network hash that lets us recognise repeat visits from the same address without storing the address. This uses no cookies, no client-side script and no third-party tracking scripts, and the records — including the cached location estimates, which are stored against the hash, never the address — are kept for at most 24 months (location cache: 3 months), enforced automatically. Legal basis: our legitimate interest in understanding use of the site. Address-to-location lookups are answered by ip-api.com, acting as our processor, which transiently processes the address to return the estimate. Cloudflare, which delivers this site, additionally keeps an aggregate count of page views for us at its edge under the same daily-rotating-hash scheme (no raw IP stored, coarse fields only), retained about 3 months.

See also: Terms · Privacy · Returns & Refunds · Cancellation form · Contact