Legal
Privacy & cookies
What we collect when you buy from us, why we need it, who else sees it, how long we keep it, and how to make us stop.
Drafted 23 August 2026 · version 0.1 (draft) · not yet in force — this version takes effect on 24 August 2026.
In one paragraph
To send you a keepsake kit we need your name, email address and delivery address. Stripe takes the payment and holds the order record — we never see your full card number. Our shipping supplier gets your name and address so the parcel can be posted. We do not sell your data to anybody. Advertising cookies only run if you press “Accept” on the cookie banner, and you can change your mind.
1. Who is responsible for your data
Heirpaws is the “data controller” for the personal information described here — meaning we decide why and how it is used. Under the UK GDPR and the Data Protection Act 2018 that makes us legally responsible for it.
- Trading name
- Heirpaws
- Legal status
- a sole trader
- Company number
- not a limited company; trading as a sole trader
- Trading address
- 17 Alameda Place, London, E3 2ZN, United Kingdom
- VAT number
- not VAT registered
- Based in
- London, United Kingdom
UK law requires an online shop to show its real identity and a geographic address before someone buys — this is not optional, and Stripe will ask for the same details during account review. If you trade as a sole trader you still have to give a real address that letters can be sent to; if you would rather not publish your home address, the usual answer is a registered-office or mail-forwarding service.
Two things to check with the Information Commissioner's Office (ico.org.uk) before this page goes live:
1. Most UK businesses that process personal data must pay the annual data protection fee to the ICO (commonly £40–£60 for a small business). Selling directly and holding customer addresses almost certainly puts you in scope. [PLACEHOLDER: ICO registration number, once you have one]
2. A business of your size is very unlikely to need a Data Protection Officer, but if you ever start doing large-scale profiling, check again.
2. What we collect and why
We only collect what we actually need. Here is the whole list.
| What | Why we need it | Our legal basis |
|---|---|---|
| Your name, email address and delivery address | To take your order, send your kit, and email you about it | Performance of our contract with you |
| What you ordered, the amount paid, and the payment status | To fulfil the order and to keep proper business records | Contract, and legal obligation (tax records) |
| The last four digits and type of your payment card, held by Stripe | To identify the payment and process refunds. We never receive your full card number. | Contract |
| Emails you send us and our replies | To answer your question and keep a record of what was agreed | Contract, and our legitimate interest in running the shop properly |
| Your email address, if you join the newsletter | To send you occasional shop news | Your consent — withdraw it at any time |
| Technical data: IP address, browser type, pages visited, time of visit | Kept in our host's server logs to keep the site running and secure | Our legitimate interest in site security and reliability |
| Advertising and measurement data (Meta Pixel) | To see whether our Facebook and Instagram ads work | Your consent only — nothing loads until you press “Accept” |
We do not ask for, and do not want, any special category data — nothing about your health, beliefs, politics or anything similar. Please do not send us any.
Giving us your name and address is not a legal requirement, but without them we cannot send you a kit.
3. Payments — how Stripe fits in
Payments are handled by Stripe. When you pay, you are on Stripe's own secure checkout page. Your card details go to Stripe, not to us.
Stripe acts partly on our instructions and partly as its own data controller — it has legal duties of its own around fraud and money laundering. Stripe uses fraud-detection tools that score a payment automatically; if a payment is refused for that reason, email us and a human will look at it.
Stripe's own privacy policy is at stripe.com/privacy.
There is no separate customer database. Your order record lives in our Stripe account, and the shop owner views it through a password-protected page that is not public and is not indexed by search engines.
4. Who else sees your information
We never sell your data, and we never share it for someone else's marketing. We do share the minimum needed with the following:
| Who | What they get | Where they are |
|---|---|---|
| Stripe (payments) | Name, email, delivery address, order and payment details | Ireland / USA |
| [PLACEHOLDER: the name of the supplier or fulfilment partner who posts the kits] | Your name, delivery address and what you ordered, so the parcel can be sent | China |
| Vercel (website hosting) | Technical data in server logs, including your IP address | USA / global network |
| Google (Gmail) | Anything in the emails between us — this is our inbox | USA / EU |
| Google Fonts | Your IP address, because the page's typefaces are loaded from Google's servers when you open it | USA |
| Meta Platforms Ireland | Advertising measurement data — only if you accept cookies | Ireland / USA |
| FormSubmit [PLACEHOLDER: confirm this is still the newsletter form provider] | The email address you type into the newsletter box, passed on to our inbox | United Kingdom |
| Our accountant, and HMRC | Sales records as required for tax | United Kingdom |
We may also disclose information if the law requires it, or to establish or defend legal claims.
The supplier row is the important one. Because your kits are posted from China, a real person's name and home address leaves the UK on every order. You need to (a) name that supplier here, and (b) have something in writing with them about protecting customer data — UK GDPR calls this an Article 28 processor agreement, and the ICO publishes a plain-English guide to it. Do not leave this blank.
5. Sending data outside the UK
Some of the companies above are outside the UK, so your information travels abroad. Where it goes to a country the UK Government has decided offers adequate protection — the EU and the EEA, for example — no extra step is needed.
The United States and China are not covered by a general UK adequacy decision. For those transfers we rely on the UK's International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, which are contracts committing the recipient to protect your data. You can ask us for details of the safeguards used for any specific transfer.
[PLACEHOLDER: once the supplier is named, confirm what transfer agreement is in place with them]
6. How long we keep things
- Order and payment records — six years after the end of the tax year they fall in. HMRC requires this, so we cannot delete them earlier even if you ask.
- Emails — kept while they may still be needed for your order or a complaint, then deleted. 24 months
- Newsletter sign-up — until you unsubscribe.
- Server logs — kept only briefly by our host, for security and diagnostics.
- Advertising cookies — see the cookie table below for how long each one lasts.
7. Cookies and tracking
A cookie is a small file a website stores in your browser. We keep this to a minimum.
Necessary — always on
These make the site and the checkout work. They do not track you across other websites, and the law does not require consent for them.
| Name | Set by | What it does | How long |
|---|---|---|---|
hp-consent | Heirpaws | Remembers whether you accepted or declined advertising cookies. Stored in your browser's local storage, not a cookie as such. | Until you clear your browser data |
Stripe checkout cookies (e.g. __stripe_mid, __stripe_sid) | Stripe | Processes your payment and detects fraudulent card use | Session to 1 year |
Advertising — only if you accept
| Name | Set by | What it does | How long |
|---|---|---|---|
_fbp, _fbc | Meta (Facebook) | Tells us whether someone who saw a Heirpaws ad went on to visit the site or buy | Up to about 3 months |
Changing your mind
When you first arrive you are asked to Accept or Decline. Nothing in the advertising table loads before you choose, and nothing loads at all if you decline.
To reverse a choice you already made, clear this site's data in your browser (in most browsers: padlock icon in the address bar → site settings → clear data, or Settings → Privacy → clear browsing data). The banner will then appear again on your next visit.
“Clear your browser data” is an honest description of how the site works today, but it is clunky, and UK/EU rules expect withdrawing consent to be as easy as giving it. Worth adding a small “Cookie settings” link in the footer that re-opens the banner. Until that exists, leave this paragraph as it is — do not promise a link that is not there.
8. The Meta (Facebook) Pixel
Heirpaws advertises on Facebook and Instagram. The Meta Pixel is a small piece of code that reports back whether an ad led to a visit or a sale, so we are not spending money blindly.
- It does not run at all unless you press “Accept” on the cookie banner.
- It sends Meta your IP address, information about your browser, and which pages you looked at. It does not send your name or address.
- Meta may combine that with data from your own Facebook or Instagram account. Meta's controls for this are at facebook.com/adpreferences, and its privacy policy is at facebook.com/privacy/policy.
- Heirpaws and Meta are joint controllers for the collection and transmission of this data.
- You can withdraw consent at any time, as described above, and doing so does not affect anything collected before you did.
Some of our advertising sends people straight to our Etsy shop instead of this site. If that happens, what Etsy does with your data is governed by Etsy's own privacy policy, not this one.
9. Newsletter emails
If you put your email address in the newsletter box, we will send you occasional news about the shop. We ask first, we do not pass your address to anyone else for their marketing, and every email has an unsubscribe option. You can also just reply and ask us to stop, or email heirpaws.shop@gmail.com.
Separately, we will always email you about an order you have placed — confirmation, dispatch, a problem. Those are not marketing and you cannot unsubscribe from them, because we need to be able to tell you about your own order.
10. Your rights
Under UK and EU data protection law you can ask us to:
- Show you the personal data we hold about you, and give you a copy.
- Correct anything that is wrong or incomplete.
- Delete it — though we must keep order and tax records for six years, so we may not be able to delete everything straight away.
- Restrict or object to how we use it, including objecting to any use based on our legitimate interests.
- Move it — receive it in a portable format, or have it sent to another provider.
- Withdraw consent you have given, for the newsletter or for advertising cookies, at any time.
Email heirpaws.shop@gmail.com and say what you want. It is free, and we will reply within one month. We may need to check who you are first — usually just by confirming the email address the order was placed with.
11. How we protect your information
The site is served over HTTPS. Payments never touch our own systems — they go straight to Stripe. The page where the shop owner views orders and addresses sits behind a password, uses a signed session cookie, and is blocked from search engines. Card numbers are never stored by us, and full addresses are never written into our system logs.
No system is perfect. If a breach ever put your rights at risk we would tell the ICO within 72 hours and, where the law requires it, tell you too.
12. Children
This shop is meant for adults. We do not knowingly collect data from children under 16. If you believe a child has given us personal information, email us and we will delete it.
13. Changes to this notice
If we change how we use your data we will update this page and change the date at the top. If the change is significant we will tell customers by email.
14. How to contact us or complain
For anything about your data, email heirpaws.shop@gmail.com or write to us at the trading address above.
If you are unhappy with how we have handled it, please tell us first — we would like the chance to put it right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator:
- Website
- ico.org.uk/make-a-complaint
- Helpline
- 0303 123 1113
- Post
- Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
If you live in the EU, you can complain to the data protection authority in your own country instead.
This is a draft prepared for review. It is not legal advice, and it has not been checked by a qualified adviser.