Privacy policy

Information we collect

When you place an order, contact us or subscribe, we may collect your name, email address, telephone number, delivery and billing address, order details and the messages you send us. We also receive basic technical and session information such as IP address, device/browser details and security logs needed to keep the website reliable and secure. Your shopping bag is kept in your browser's local storage on your device.

If you create a customer account, we store your name, verified email address, account sign-in method and order links. Passwords are stored only as secure one-way hashes, never as readable text. Google provides your name, email address and basic profile image only when you choose Google sign-in.

Payment card details are handled by Stripe. Toofufu.Studio does not store your full card number.

How we use your information

We use your information to take payment, make and deliver your order, answer questions, manage returns, prevent fraud, maintain business records and comply with our legal obligations.

We also use verified account information to sign you in, protect your account and connect orders placed as a guest when the same email address was used at checkout.

If you join the newsletter, we use your email address to send studio and product updates. You can unsubscribe at any time.

Our lawful bases

We use information needed to take payment, fulfil and support an order because it is necessary to perform our contract with you. We keep records where necessary to comply with legal obligations. We use consent for optional newsletter messages, which you can withdraw at any time. We rely on our legitimate interests where necessary to keep the service secure, prevent fraud and improve reliability, while balancing those interests against your rights.

Who we share it with

We share only what is necessary with trusted service providers, including Stripe for payments, Cloudflare for website hosting and security, Royal Mail for delivery, and Resend for transactional email when that service is enabled. These providers process information to perform their services for us.

If you use an account, Google may provide sign-in services and our transactional email provider sends verification and password reset codes. We do not use account verification emails for marketing unless you separately join the newsletter.

Some providers may process information outside the UK. Where this is a restricted international transfer, we require an applicable legal transfer mechanism and safeguards. You may contact us for more information about the safeguards relevant to your data.

Keeping and protecting information

We keep personal information only for as long as it is needed for orders, customer service, tax, accounting and legal purposes. We use reasonable technical and organisational safeguards, although no online service can promise absolute security.

Account sessions and verification codes expire automatically. Order records may need to be retained after an account is closed where required for tax, accounting, fraud prevention or legal obligations.

Your rights

Depending on where you live, you may ask to access, correct, delete or restrict the use of your personal information, receive a portable copy where applicable, or object to processing based on legitimate interests or direct marketing. You may also withdraw consent where we rely on it. If you are not satisfied with our response, you have the right to complain to the UK Information Commissioner's Office at ico.org.uk.

Contact

The data controller is Joey Fu, trading as Toofufu Studio. Business address: 115 Wood Lane, White City, London, W12 7ED, United Kingdom.

For privacy questions or requests, email 2fufu.studio@gmail.com. We may need to confirm your identity before completing a request.