Privacy policy

This policy explains what personal information Cookie Cut Co. (“we”, “us”) collects when you use our website, why we collect it, and the rights you have over it. We are the data controller for the information described here.

Information we collect

• Details you give us – your name, email address, delivery and billing address, and phone number when you place an order or create an account.
• Order & payment information – what you bought and your order history. Card payments are processed by Stripe; we never see or store your full card number.
• Custom design uploads – any reference images, files or notes you submit for a custom cutter.
• Account information – your login email and an encrypted (hashed) password.
• Automatically – basic technical data such as your IP address, browser type and cookies (see below) so the site works and stays secure.

How we use it

• To take payment, fulfil and deliver your orders, and produce custom designs.
• To provide customer service and respond to your enquiries.
• To send order and account emails (confirmations, dispatch updates, design approvals).
• To send marketing emails where you have asked us to – you can unsubscribe at any time.
• To keep the site secure, prevent fraud, and meet our legal and accounting obligations.

Our legal bases (UK GDPR)

We rely on performance of a contract to process and deliver your orders, your consent for optional marketing and non-essential cookies, our legitimate interests in running and securing the business, and legal obligation for tax and accounting records.

Who we share it with

We share information only with the providers that help us run the shop – our payment processor (Stripe), delivery couriers, and our email and hosting providers – and only as far as needed to do their job. We may also share information where the law requires it. We never sell your personal data.

Cookies

We use essential cookies to make the site work (for example to remember your basket) and, with your consent, optional cookies to understand how the site is used. You can accept or decline optional cookies from the banner and change your choice at any time using Cookie settings in the footer. We also honour Global Privacy Control and Do Not Track signals for our first-party visitor analytics.

We record storefront search terms and result counts whenever search is used so we can identify missing products and improve product names, tags and descriptions. Search records are normally retained for up to 90 days.

When you accept analytics, we count visits and page views, popular paths and products, referring sites, and coarse country/region/city information supplied by our hosting edge. To estimate new and repeat visitors we create a secret-keyed pseudonymous hash from the IP address and browser information; we do not store the raw IP address or full browser string in the analytics database, and we do not use these analytics to profile or make decisions about individuals. Detailed visitor analytics are normally retained for up to 90 days.

If you accept optional cookies, we use the Meta Pixel and Meta Conversions API to measure advertising performance. We may send Meta details about actions such as searches, saved products, basket additions, checkout and completed purchases. Contact details are normalised and securely hashed before sending; browser identifiers, IP address and user agent are sent in the format Meta requires for matching and measurement. We do not send these events when you decline optional cookies.

How long we keep it

We keep order and account records for as long as your account is active and for as long afterwards as we need to meet legal, tax and accounting requirements. You can ask us to delete your account at any time.

Your rights

Under UK data protection law you have the right to access, correct, delete or restrict the personal data we hold about you, to object to certain processing, to data portability, and to withdraw consent at any time. To exercise any of these, get in touch using the details below. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

Security & international transfers

We use appropriate technical and organisational measures to protect your data, including encryption in transit. Some of our providers may process data outside the UK; where they do, we rely on safeguards that give your data an equivalent level of protection.

Changes to this policy

We may update this policy from time to time. The “last updated” date at the top shows when it last changed.