Privacy notice

Who is the controller?

Charlie Coles, trading as Crafty Bintt. Sole trader registered in the United Kingdom. Contact: hello@craftybintt.co.uk. Our trading address is available on request.

What data we collect, and why

If you order without an account

• Email address — to send order confirmations and tracking
• Recipient name and shipping address — to dispatch your order
• Card details — handled by Stripe; we receive only the last four digits and card brand
• A cart cookie (cb_cart_key) so your basket survives page refreshes

If you create an account

• Email address and password (stored hashed, never plain text)
• Optional: your name, marketing preference, saved addresses
• Order history, tied to your user record

If you sign in with Google

• We ask Google for your email address and your name, and nothing else. We never see your Google password.
• We store a Google account identifier so we recognise you next time. It is meaningless outside this site.
• Google will know you signed in here. Their handling of that is covered by Google's own privacy policy.
• A short-lived cookie (cb_oauth_redirect) remembers which page you were on, and is deleted the moment you come back.

What we do not collect

• No analytics or tracking pixels
• No third-party advertising
• No social-network share buttons that load before consent

Lawful bases

• Contract — to fulfil your order and provide the account services you asked for
• Legal obligation — to keep records HMRC requires us to keep
• Legitimate interests — to detect fraud and to keep the site secure
• Consent — for marketing email, which you can opt in or out of any time in your account

Who we share data with

We work with these processors:

• Stripe Payments UK Ltd — handles your card payment
• Neon Inc. — hosts our database (London, UK)
• Google Cloud EMEA Ltd — hosts the application on Cloud Run in europe-west2 (London, UK)
• Cloudflare Inc. — DNS, CDN, image hosting
• Resend — sends transactional emails
• Royal Mail / DPD — carriers for parcels you order
• Google Ireland Ltd — verifies your identity, but only if you choose to sign in with Google

We do not sell your data and we do not share it for advertising.

Where data is held

Your data sits inside the UK and the European Economic Area (Belgium and Ireland) wherever possible. Some processors operate globally with appropriate transfer safeguards (Standard Contractual Clauses or UK adequacy decisions).

How long we keep data

• Order records — six years, to meet HMRC retention rules
• Account data — until you ask us to delete your account
• Cart cookies — 30 days from your last activity
• Email logs (Resend) — 7 days on the free tier

Your rights

Under UK GDPR you can ask us to:

• Show you a copy of the data we hold about you
• Correct anything that's wrong
• Delete your account and any data we no longer need to keep for legal reasons
• Restrict or object to specific processing
• Take your data elsewhere in a portable format

To exercise any of these, email us at hello@craftybintt.co.uk. We will respond within one month.

Complaints

You can complain to the UK Information Commissioner's Office at ico.org.uk if you believe we have mishandled your data — but we'd appreciate the chance to put things right first.