Privacy Policy

When you buy a print, your name, email address and delivery address are entered into Stripe’s checkout and held by Stripe. We do not copy them into our own database.

What we store against an order is:

• A reference to the Stripe payment, so we can look up your details when we need them
• The artwork, print size and generated version you ordered
• The delivery country, which we need to price delivery and to meet our own accounting requirements
• The fulfilment reference from our print partner

We do not receive or store your card details. Payment is handled entirely by Stripe.

Your name and address are passed to our print partner so they can produce and deliver your order, and read back from Stripe when we need to contact you about it.

If you join the mailing list we collect only your email address. Joining is optional and separate from buying: ordering a print does not add you to the list, and we do not email you about new work unless you have asked us to.

We set no tracking or advertising cookies of our own, and none for analytics — which is why you are not asked to accept anything. The only cookies on the site come from Stripe and from the service that protects and delivers the site, both described below, and both necessary rather than optional. We also store one thing locally in your browser: the list of artwork versions you have generated, kept under a key beginning “artwork-history”, so your generated versions are still there if you reload or come back later.

That record contains only the random seed values that identify each generated version. It holds no personal data, never leaves your device, and is not sent to us. You can clear it at any time through your browser settings.

Stripe sets its own cookies on pages where you can buy a print. They are used for payment and fraud prevention, and are set whether or not you go on to check out. They are necessary for taking payment safely, so they are not something you can turn off and still buy a print.

The service that protects the site from attacks and serves it quickly also sets a cookie, on every page. It is used to tell real visitors from automated traffic, lasts around half an hour, and is not used to track you or build a profile. It is necessary for the site to stay available, so it is not something that can be turned off.

We use Umami, an analytics tool built with privacy in mind, to understand how the site is used — which work people look at, and roughly where visitors arrive from. It runs on our own server, so this data is not shared with anyone.

It sets no cookies, does not follow you between sites, and does not store your IP address. What it records is general and does not identify you, which is why the site does not ask you to accept anything before it loads.

If you would rather not be counted, any browser setting or extension that blocks analytics will stop it, and nothing on the site depends on it.

• To take payment and fulfil your order — necessary to perform our contract with you
• To send order confirmation and dispatch emails — necessary to perform our contract with you
• To email you about new work, if you joined the mailing list — your consent, which you can withdraw at any time
• To keep records for tax and accounting — a legal obligation
• To understand how the site is used — our legitimate interest in improving it

We share only what is needed, with:

• Stripe, our payment processor — payment and fraud prevention
• Our print partner — printing and delivery, which requires your name and delivery address
• Our email provider — sending your order confirmation and dispatch emails, and holding the mailing list if you have joined it, which requires your email address
• Our security and content delivery provider — every request passes through it before reaching us, so it sees your IP address and which pages you request

We do not sell your data or share it for marketing. Some of these providers are outside the UK and EEA; where that is the case, transfers are covered by standard contractual clauses or an equivalent safeguard.

The print file produced for your order is held by a separate file hosting company. It is stored under the random reference that identifies your generated version, with no name, email or address attached, so the host holds nothing that identifies you. We keep the link between that file and your order, which is how it reaches our print partner.

If you join the mailing list, your email address is held by our email provider rather than in our own systems. Every email includes an unsubscribe link, and unsubscribing removes you immediately. You do not need to contact us, though you can email [email protected] and we will remove you.

The list is used only to tell you about new work. We do not sell or share it, and we do not use it to send anything else.

Our own order records hold no name, email or delivery address — only the references listed above — and are kept for seven years to meet UK tax and accounting requirements. Your name, email and address are held by Stripe under their own retention policy, and by our print partner for as long as they need them to fulfil and support the order. Print files are kept while they may be needed to reproduce a damaged order, then deleted.

Mailing list addresses are kept until you unsubscribe, after which they are removed from the list.

You can ask for a copy of the data we hold about you, ask us to correct it, ask us to delete it where we are not required to keep it, object to processing based on legitimate interests, withdraw your consent to marketing email, or ask for your data in a portable format. Email [email protected] and we will respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk.

We may update this policy. The version on this page is the one that applies, and the date it was last changed is shown at the foot of the page.