Privacy.
Art de la Ltd is the controller. To reach us, write to [email protected]. There is no separate contact page.
Controller
Art de la Ltd (company number 17357378), registered in England and Wales. Not VAT-registered. Write to [email protected].
What we keep, and why
- — Your email and shipping address when you order. Contract — we have to ship.
- — Order lines, personalisation text, and payment references. Contract + legal obligation (tax, refunds). We never see your card; Stripe does.
- — If you sign in: a session cookie, and the orders that match your email. Legitimate interests + contract — so the account can show what you bought.
- — Newsletter address, if you ask for it. Consent. You can leave any time.
- — Pieces you save on your device. That stays on the device unless you sign in.
Who else sees it
Nothing is sold for advertising. Processors, all functional:
- — Stripe — payment. We never see your card.
- — Resend — sign-in links and order mail.
- — Cloudflare — hosts the site. Anonymous analytics, no fingerprinting.
How long
Orders: six years (UK accounting). Sign-in sessions: 30 days, or until you sign out. Magic-link tokens: 15 minutes. Newsletter: until you unsubscribe. Proof files for a personalised order: until the piece has shipped plus 12 months.
Cookies
Strictly off by default. We use one cookie to remember your consent choice. If you accept: one cookie for pieces you are weighing, and one HttpOnly auth cookie if you sign in (never readable by JavaScript). A separate cookie remembers how many works you show in a row, and the sort, on this phone. Signed in, that same choice is kept on the account.
Your rights
UK GDPR applies. You can see, correct, delete, or object. Write to [email protected] with “data request” or “delete me”. We answer within 30 days — usually within a day.
You can complain to the Information Commissioner’s Office (ico.org.uk). We would rather fix it first.
Last updated 2026-09-26