Privacy policy

What we collect

We collect only what an order actually requires:

• Your name, email address, and shipping address.
• Your order history and its contents.
• Your password, stored only as a salted scrypt digest that we cannot read.
• If you subscribe, your email address and the date you subscribed.

What we do not collect

We do not store card numbers. Payment is handled by our payment provider and card details never reach our servers.

We do not run third-party advertising or analytics trackers, and we do not sell, rent, or share your data with data brokers or advertisers.

Who else sees it

Your name and address go to the carrier so the parcel can be delivered, and to customs for international shipments where the law requires it. Your email and order total go to our payment provider to process the payment. Nobody else receives any of it.

How we suggest what to look at next

The suggestions beside a product and in your basket are counted from orders that were actually placed and paid for. We count how often two compounds appear in the same order, and we show a pairing only once at least three separate customers have ordered both. Nothing about an individual order, basket, or customer is published, and a pairing that only one or two people have ordered is never shown.

This uses order records we already hold, and no profile is built about you: the counting is across all orders at once and what you personally ordered is never used to target anything at you.

Our lawful basis

Under the UK GDPR we rely on performance of a contract to process the details needed to take and deliver your order, on legal obligation to keep the records HMRC requires, on our legitimate interest in counting aggregate order patterns to suggest what else to look at, and on consent for newsletter emails. You can withdraw that consent at any time, and you can object to the legitimate-interest processing by emailing us.

How long we keep it

Order and VAT records are kept for six years plus the current year, which is the period HMRC requires. Account details are kept until you ask us to delete them. Newsletter subscriptions are kept until you unsubscribe, which every email links to.

Your rights

Under the UK GDPR and the Data Protection Act 2018 you can ask for a copy of everything we hold about you, ask us to correct it, ask us to delete it, ask us to restrict how we use it, or ask for it in a portable format. Email us and we will respond within one month, free of charge.

Deleting your account does not delete order records we are legally required to retain, but it does disconnect them from your login.

If you think we have handled your data badly, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you told us first so we can put it right.

Where your data is held

Our servers and backups are in the UK or the EEA. Where a supplier processes data outside that area we rely on the UK's adequacy regulations or on the International Data Transfer Addendum.

Cookies

We set one cookie to keep you signed in and one to keep your admin session, both strictly necessary and neither used for tracking. Your basket is held in your browser's local storage, not on our servers.