Privacy Policy

1. Who's responsible for your data

Macey Solutions Limited (trading as Low & Behold Co.), company number 14031096, registered at 82a James Carter Road, Mildenhall, Suffolk, United Kingdom, IP28 7DE, is the "data controller" for the personal data described here. If you have any question about how we handle your data, email hello@lowandbeholdco.com.

2. What we collect

We collect different data depending on how you interact with us:

• When you place an order: your name, email address, delivery address, and phone number (if you give one) — collected via Stripe's secure checkout, plus your order details (what you bought, the price, and the order date).
• Payment information: handled entirely by Stripe. We never see or store your full card number, expiry date, or CVC — Stripe passes us confirmation that payment succeeded, not your card details.
• If you apply to our ambassador programme: your name, email address, social media handle, audience details, and whatever message you choose to include on the application form.
• Technical data: standard web server logs (like IP address and browser type) generated automatically by visiting the site, kept briefly for security and troubleshooting purposes.
• Analytics data: aggregate, cookieless traffic data (pages viewed, rough location, device type) via Vercel Analytics for every visitor, plus — only if you accept cookies in our banner — Google Analytics data showing which product pages you viewed and, in aggregate, which products get bought. See our Cookie Policy for the full detail on what's used and how to control it.

3. What we use it for, and why we're allowed to

• To fulfil your order — sharing your name, delivery address, and email with Printify so they can print and ship your item, and processing payment through Stripe. (Necessary to perform our contract with you.)
• To deal with customer service, returns, and refunds — for example, matching your emailed photos of a damaged item to your order. (Necessary to perform our contract with you, or our legitimate interest in resolving issues fairly.)
• To consider ambassador applications — reviewing the information you submit to decide whether to invite you into the programme. (Our legitimate interest in running the programme, and/or your consent by submitting the form.)
• To keep accounting and tax records — we're legally required to keep records of sales transactions. (Legal obligation.)
• To keep the site secure and working properly — using technical logs to spot and prevent abuse. (Legitimate interest.)
• To understand which products and pages are working — using Vercel Analytics (cookieless, aggregate) for everyone, and Google Analytics (only for visitors who accept cookies) to see which products get viewed versus bought. (Legitimate interest in improving the shop; consent for the Google Analytics cookies specifically.)

We don't currently send marketing emails or newsletters. If that changes, we'll ask for your consent first and give you an easy way to opt out at any time.

4. Who we share it with

We share personal data with a small number of companies who help us run the business, and with no one else:

• Stripe, Inc. — processes your payment. Stripe is a payment processor in its own right and handles your card data under its own security standards and privacy policy (see stripe.com/privacy).
• Printify, Inc. — receives your name, delivery address, email, and order details so it can print and ship your order through its network of print providers.
• Vercel Inc. — hosts the site and provides cookieless aggregate traffic analytics; sees the same data any web host sees (like your IP address) as part of serving you the page.
• Google LLC — provides Google Analytics, and only receives your browsing/purchase-viewing activity on our site if you've accepted cookies in our banner.
• Our accountant or bookkeeper, where necessary to prepare our accounts and tax filings.
• Law enforcement or regulators, but only where we're legally required to disclose data to them.

We never sell your personal data to anyone.

5. Data sent outside the UK

Stripe, Printify, Vercel, and Google all operate internationally, which means your data may be processed outside the UK — including in the United States. Where that happens, we rely on legally recognised safeguards (such as Standard Contractual Clauses, the UK International Data Transfer Addendum, or the recipient's own certified compliance mechanisms) to make sure your data stays protected to a UK standard wherever it's handled.

6. How long we keep it

• Order and transaction records: kept for 6 years, in line with UK tax and accounting record-keeping rules.
• Ambassador applications: kept for as long as we're considering your application, and for the duration of any ongoing relationship if you're accepted; deleted if your application isn't taken further and there's no ongoing reason to keep it.
• Technical/server logs: kept briefly for security purposes, then routinely cleared.

7. Your rights

Under UK GDPR, you have the right to:

• ask us what personal data we hold about you, and get a copy of it;
• ask us to correct anything that's inaccurate or incomplete;
• ask us to delete your data, where there's no good reason for us to keep it;
• ask us to restrict or object to how we use your data in certain circumstances;
• ask for your data in a portable format; and
• withdraw consent at any time, where we're relying on consent (this won't affect anything we did before you withdrew it).

To exercise any of these, just email hello@lowandbeholdco.com. If you're not happy with how we've handled your data, you also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office, at ico.org.uk.

8. Children

Our site and products aren't directed at children, and we don't knowingly collect personal data from anyone under 18.

9. Keeping your data secure

We use reasonable technical and organisational measures to protect the personal data we hold — but no method of transmission or storage is ever 100% secure, and we can't guarantee absolute security.

10. Changes to this policy

We may update this policy from time to time, for example if we start using a new supplier or tool. The "last updated" date at the top of this page always reflects the current version.