Privacy policy

BismillahCollectionz is the data controller for the information described here. You can reach us at BismillahCollectionz@hotmail.com.

• When you order: your name, email address, delivery and billing address, phone number if you give one, and what you bought.
• When you create an account: your name, email address and your marketing preference.
• When you contact us: your name, email address and whatever you write.
• Automatically: your IP address, used only for rate limiting so the shop cannot be flooded with sign-in attempts.

We never see or store your card details. Payment is taken on Stripe's own hosted page. We receive only the card brand and its last four digits, so we can identify the payment on your order.

• To take and fulfil your order — necessary to perform our contract with you.
• To email you about that order — the same basis. These are not marketing and cannot be turned off while an order is in progress.
• To keep records for accounting and tax — a legal obligation.
• To send you news about new arrivals — only with your consent, which you can withdraw at any time.
• To prevent fraud and abuse of the shop — our legitimate interests.

Only with the services that make the shop work, and only what each one needs:

• Supabase — hosts the database. Data is stored in the United Kingdom / EU region (London).
• Stripe — takes payment. They receive your name, email and billing address, and handle your card details directly.
• Resend — sends the order emails. They receive your email address and the content of those emails.
• Royal Mail — delivers your order. They receive your name, delivery address and contact details.
• Vercel — hosts the website itself.

We do not sell your data, and we never will.

• Order records: six years, which is what HMRC requires for tax records.
• Account details: until you ask us to delete your account.
• Contact messages: two years, so we can look back at a conversation.
• Abandoned baskets: 30 days, then they expire on their own.

Under UK GDPR you have the right to:

• Ask what we hold about you, and get a copy.
• Have anything inaccurate corrected.
• Have your data deleted, where we are not required to keep it for tax.
• Object to processing based on our legitimate interests.
• Withdraw marketing consent at any time — every marketing email has an unsubscribe link, and you can change it in your account.

Email us and we will act within one month. If you are not happy with how we have handled it, you can complain to the Information Commissioner's Office.

We set only what the shop needs to work: a session cookie when you sign in, and one that remembers your bag. Both are essential and neither tracks you across other websites.

If we ever add analytics, we will ask you first and this page will say so.

If we change this policy we will update the date at the top. For anything significant we will tell you by email. Questions are welcome.