Privacy Policy

1. Who's responsible for your data

Macey Solutions Limited (trading as Low & Behold Co.), company number 14031096, registered at 82a James Carter Road, Mildenhall, Suffolk, United Kingdom, IP28 7DE, is the "data controller" for the personal data described here. If you have any question about how we handle your data, email woof@lowandbehold.co.uk.

2. What we collect

We collect different data depending on how you interact with us:

• When you place an order: your name, email address, delivery address, and phone number (if you give one) — collected via Stripe's secure checkout, plus your order details (what you bought, the price, and the order date).
• Payment information: handled entirely by Stripe. We never see or store your full card number, expiry date, or CVC — Stripe passes us confirmation that payment succeeded, not your card details.
• If you apply to our ambassador programme: your name, email address, social media handle, audience details, and whatever message you choose to include on the application form.
• Technical data: standard web server logs (like IP address and browser type) generated automatically by visiting the site, kept briefly for security and troubleshooting purposes.
• Analytics data: aggregate, cookieless traffic data (pages viewed, rough location, device type) via Vercel Analytics for every visitor, plus — only if you accept cookies in our banner — Google Analytics data showing which product pages you viewed and, in aggregate, which products get bought. See our Cookie Policy for the full detail on what's used and how to control it.

3. What we use it for, and why we're allowed to

• To fulfil your order — sharing your name, delivery address, and email with Printify so they can print and ship your item, and processing payment through Stripe. (Necessary to perform our contract with you.)
• To deal with customer service, returns, and refunds — for example, matching your emailed photos of a damaged item to your order. (Necessary to perform our contract with you, or our legitimate interest in resolving issues fairly.)
• To consider ambassador applications — reviewing the information you submit to decide whether to invite you into the programme. (Our legitimate interest in running the programme, and/or your consent by submitting the form.)
• To keep accounting and tax records — we're legally required to keep records of sales transactions. (Legal obligation.)
• To keep the site secure and working properly — using technical logs to spot and prevent abuse. (Legitimate interest.)
• To understand which products and pages are working — using Vercel Analytics (cookieless, aggregate) for everyone, and Google Analytics and the Pinterest Tag (only for visitors who accept cookies) to see which products get viewed versus bought and how our Pinterest content performs. (Legitimate interest in improving the shop; consent for the Google Analytics cookies specifically.)

Marketing emails. If you join our mailing list (for example for 10% off your first order), we'll email you your discount code and a short welcome series over the following week, then occasional news and offers. We do this with your consent, given when you sign up, and every email has an unsubscribe link; you can also ask us to remove you at any time. If you tick the box on our basket page asking for a reminder, we'll send you one email if you leave something behind, and use your email for nothing else. You can withdraw consent at any time without affecting the lawfulness of what we did before.

4. Who we share it with

We share personal data with a small number of companies who help us run the business, and with no one else:

• Stripe, Inc. — processes your payment. Stripe is a payment processor in its own right and handles your card data under its own security standards and privacy policy (see stripe.com/privacy).
• Printify, Inc. — receives your name, delivery address, email, and order details so it can print and ship your order through its network of print providers.
• Vercel Inc. — hosts the site and provides cookieless aggregate traffic analytics; sees the same data any web host sees (like your IP address) as part of serving you the page.
• Resend (Resend, Inc.) — sends our emails on our behalf, so it receives your email address and the content of the emails we send you.
• Google LLC — provides Google Analytics, and only receives your browsing/purchase-viewing activity on our site if you've accepted cookies in our banner.
• Pinterest, Inc. — provides the Pinterest Tag, and only receives information about the pages you view on our site if you've accepted cookies in our banner.
• Our accountant or bookkeeper, where necessary to prepare our accounts and tax filings.
• Law enforcement or regulators, but only where we're legally required to disclose data to them.

We never sell your personal data to anyone.

5. Data sent outside the UK

Stripe, Printify, Vercel, Resend, Google, and Pinterest all operate internationally, which means your data may be processed outside the UK — including in the United States. Where that happens, we rely on legally recognised safeguards (such as Standard Contractual Clauses, the UK International Data Transfer Addendum, or the recipient's own certified compliance mechanisms) to make sure your data stays protected to a UK standard wherever it's handled.

6. How long we keep it

• Order and transaction records: kept for 6 years, in line with UK tax and accounting record-keeping rules.
• Ambassador applications: kept for as long as we're considering your application, and for the duration of any ongoing relationship if you're accepted; deleted if your application isn't taken further and there's no ongoing reason to keep it.
• Mailing list: kept until you unsubscribe; we then keep only a record that you opted out so we don't email you again.
• Technical/server logs: kept briefly for security purposes, then routinely cleared.

7. Your rights

Under UK GDPR, you have the right to:

• ask us what personal data we hold about you, and get a copy of it;
• ask us to correct anything that's inaccurate or incomplete;
• ask us to delete your data, where there's no good reason for us to keep it;
• ask us to restrict or object to how we use your data in certain circumstances;
• ask for your data in a portable format; and
• withdraw consent at any time, where we're relying on consent (this won't affect anything we did before you withdrew it).

To exercise any of these, just email woof@lowandbehold.co.uk. If you're not happy with how we've handled your data, you also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office, at ico.org.uk.

8. Children

Our site and products aren't directed at children, and we don't knowingly collect personal data from anyone under 18.

9. Keeping your data secure

We use reasonable technical and organisational measures to protect the personal data we hold — but no method of transmission or storage is ever 100% secure, and we can't guarantee absolute security.

10. Changes to this policy

We may update this policy from time to time, for example if we start using a new supplier or tool. The "last updated" date at the top of this page always reflects the current version.