What we know about you, and why.

What we collect

When you buy something: your name, email address, delivery address, and what you ordered. That is what a parcel and a receipt need.

We never see your card details. Payment happens on Stripe's own checkout page. Your card number goes to Stripe and not to us, and we could not retrieve it if we wanted to. What comes back to us is a confirmation that you paid, the last four digits, and the card brand.

When you email us: your email address and whatever you write.

Visitor measurement

We use Google Analytics to count visits and see which pages people actually read. It sets a cookie and tells us roughly which country you arrived from and which page you landed on. It runs on every page of this shop.

It also follows the shape of a sale: something added to a basket, a checkout started, an order finished. So it is told which work and which size went into the basket and what the order came to. What it is never given is anything that identifies you to us: not your name and not your address. We use it to answer "is anyone finding the shop, and do baskets turn into orders", not to follow a person.

If you are in the European Economic Area, it sets no cookie at all. We tell Google to treat you as not having consented, so you are counted without being stored, and there is no banner to dismiss because there is nothing to agree to.

If you would rather not be counted, any browser setting or extension that blocks Google Analytics works here, and nothing on this site behaves differently when you do. Google's own opt-out is at tools.google.com/dlpage/gaoptout.

If you leave without paying

The basket has an optional email box. Filling it in saves you typing your address again on the payment page, because we pass it to Stripe to fill that field in for you. Leaving it blank is fine and changes nothing about your order.

If you start paying and then leave without finishing, we are told that a basket was left behind and what it was worth. If you gave us an email address we keep it with that record. If you did not, there is nothing on it that says who you are.

Stripe gives us a link that would rebuild that basket, and it stops working after 30 days. We do not send any email about a basket left behind. If that ever changes, an address you typed into the box above is the only one we would have to send it to.

What we do not do

Beyond the measurement above there is no advertising pixel, no session recorder and no remarketing tag. Nobody is building a profile of you here.

We do not sell, rent or share your details with anyone for marketing. We do not add you to a mailing list because you bought something. There is no newsletter to be subscribed to by accident.

Who else handles your order

Three companies, each doing one job:

• Stripe takes the payment and holds the card details we never see.
• Our fulfillment partner receives your name, delivery address and what you ordered, because they print, frame and post it. They receive nothing else.
• Cloudflare serves the pages and, like any web host, processes the request as it happens.

None of them is permitted to use your details for their own marketing.

How long we keep it

Order records for seven years, because tax rules in most of the countries we sell to require it. Email correspondence for two years. Nothing else is kept.

Your rights

Ask us what we hold about you and we will tell you. Ask us to correct it and we will. Ask us to delete it and we will, other than the order records we are legally required to keep for the period above.

If you are in the UK, the EU or Australia, you have these rights in law rather than by our permission, and you can complain to your national data protection authority if you think we have got it wrong.

Contact

[email protected] for anything on this page.