Privacy and account data

How we use it

We use this information to process and deliver your orders, review bank-transfer payments, secure your account and our forms, respond to support requests, and keep the customer-visible order status aligned with our internal handling. We do not sell your personal information.

Service providers who process your data

We share the minimum data needed with the following processors. They act on our instructions and are not permitted to use your data for their own purposes.

• Cloudflare, Inc. — Hosting, database (D1), file storage (R2), bot protection (Turnstile), and network security. Processes site traffic and stored data on our behalf.
• Postmark (with SendGrid as a fallback) — Delivers transactional email such as order confirmations, shipping updates, and password-reset links. Receives the recipient email address and the message content.
• Discord — Receives internal new-order alerts to our team. These contain order metadata only — order reference, total, and item names — not your name, email, or address.
• Plausible Analytics — Privacy-friendly, cookieless website analytics. It does not use tracking cookies or collect information that identifies you.

How long we keep it

• Account and order records are kept while your account or order is active and for as long as we need them to meet tax, accounting, and dispute obligations.
• Notification records (emails and alerts we send) are kept for up to 180 days, then deleted.
• Website analytics events are kept for up to 90 days.
• Inbound support and supplier emails are kept for up to 180 days.
• Removed (deleted) orders are permanently purged 90 days after deletion.
• Security audit entries are retained, but identifying detail (IP address, device string, and data snapshots) is removed after 365 days.
• Error and diagnostic logs are kept for 90 days.
• Sign-in sessions expire after 14 days; password-reset links expire after 30 minutes or first use.

How we protect it

• Passwords are stored only as salted PBKDF2-SHA256 hashes — never in plain text.
• Session and guest order-access tokens are random and stored only as hashes.
• All traffic is served over HTTPS with HSTS enabled.
• Sensitive forms use CSRF protection, a bot check (Turnstile), and rate limiting.
• Role-based access controls limit which staff can see order and account data.

Your choices and requests

You can ask for a copy of your personal data, ask us to correct it, or ask us to delete it. Send the request through the secure contact form from the email address linked to your account or order, and describe what you need. We aim to respond within 30 days. Some records — such as completed order and payment records — may be retained where the law requires it; where an order must be kept, we minimise the identifying details we hold.