Privacy policy

Who we are

The data controller is TODO: your full name or registered trading name, trading as Art of Nature, TODO: your geographic address, UK. You can reach us at hello@theartofnature.co.uk.

ICO registration: TODO: ICO registration number (ZA...).

What we collect

Account details: your first name, email address and a password (stored securely by our authentication provider; we cannot read it).

Order details: what you bought, your name, delivery address and email, and the payment status. Card payments are handled by Stripe: we never see or store your card number.

Messages you send through the contact form, and your email address if you join the newsletter.

Technical data: to stop spam and abuse we keep a short-lived, one-way scrambled (hashed) form of your IP address. We do not store the readable address.

Why we use it, and our legal basis

To take, make and deliver your order, and to handle returns (contract).

To reply to your messages (legitimate interests, or steps before a contract).

To send news about new batches, only if you opted in and confirmed by email (consent). You can withdraw consent at any time, using the link in every email or in your account.

To keep accounting records the law requires, and to keep the site secure and prevent fraud (legal obligation and legitimate interests).

Who we share it with

Only the services we need to run the shop, each under a data protection agreement: Stripe (payments), Supabase (database and accounts), Resend (sending emails), Vercel (hosting), and the postal carrier, which receives your name and address to deliver your parcel.

Some of these providers process data outside the UK. When they do, the transfer is protected by the UK's approved safeguards (for example the UK Extension to the EU Standard Contractual Clauses or an adequacy decision). We never sell your data.

How long we keep it

Order records for 6 years after the order, for tax purposes. Your account until you delete it. Newsletter details until you unsubscribe (afterwards we keep only your email address on a do-not-email list, so that we never contact you again). Contact messages for up to 2 years. Security logs for up to 90 days.

Your rights

You can ask to see your data, correct it, delete it, restrict or object to how we use it, or receive a copy you can move elsewhere. Most of this you can do yourself in your account under Privacy, or by emailing hello@theartofnature.co.uk. We reply within one month.

If you are not happy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

Cookies

We only use the cookies and browser storage the site needs to work. See the cookies page for details. There is no advertising or analytics tracking.

Children

The shop is for adults. We do not knowingly collect data from children.

Changes

If we change this policy in a way that matters, we will update the date above and, where needed, tell you.