Privacy & cookies

Who we are

Moss & Muse is the trading name of GR Art & Design Ltd, a company registered in Scotland (SC785452), registered office 1/1 21 March Street, Glasgow, G41 2PX. We're the "data controller" for what you share with us. Questions about any of this: enquiries@themossandmuse.co.uk.

What we keep, and why

• Your order: name, delivery address, email, phone number if you give one, what you bought and what you paid. We need it to send your parcel, to email your confirmation and tracking, and to help with returns or problems. Tax rules also require us to keep order records for six years; after that we remove the details that identify you and keep only the figures.
• Your account, if you make one (you never have to): your name, email, town and postcode, and a scrambled version of your password that nobody, including us, can read back. You can delete your account from the account page at any time; when you do, your name, address and email are removed from your past orders straight away and only the figures stay.
• The muse letter: your email, when you signed up and when you confirmed. Double opt-in, so nothing arrives unless you sign up and then confirm. Every muse letter has a one-click unsubscribe.
• "Tell me when it's back": your email and the item. Every one of those emails has a link that stops them all; otherwise it's deleted 30 days after we've told you it's back, or after a year if it never comes back.
• "No more offers": if you press the link that says no to the thank-you code, we keep your email on a short list so we remember not to send you one again. That list is the one thing we keep even if you ask us to delete everything else, because it is how we remember your no.
• Messages through the contact form arrive as an email in our inbox and are kept there like any other email; the shop itself doesn't store them.
• If you arrive from an advert or a link, we note which one against your basket, so we can see which adverts are worth paying for. It records where the visit came from, not who you are.

Who else handles your details

- Stripe or PayPal take your payment on their own systems. We see that you paid and how much; we never see your card. - Royal Mail (Click & Drop) gets your name and address to deliver the parcel, and your email or phone number if the service needs it for delivery updates. - Our hosting company, netcup (Germany), provides the server the shop runs on. Our emails to you are sent from that same server. An encrypted backup of the shop is kept at a second location so a disaster doesn't lose your order. - Nobody else. We never sell or rent your details, full stop.

Cookies

We use a handful of small cookies, all of them to make the shop work, none of them to track you:

• one that remembers your basket (up to 30 days);
• one that keeps you logged in, if you have an account;
• two short ones for a discount code you've entered (a day) and for on-page messages like "added to your bag" (moments).

None of these is shared with anyone or used for advertising, which is why there's no cookie banner. Stripe and PayPal set their own cookies on their pages when you pay.

Counting visits

We count visits with Umami, a privacy-friendly tool that runs on our own server. It uses no cookies, keeps no IP addresses and can't recognise you from one day to the next. It tells us things like "the stickers page was busy on Sunday". If you'd rather not be counted at all, email us and we'll tell you how to switch it off for your browser.

Your rights

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it, and we'll do it within a month. Email enquiries@themossandmuse.co.uk. The one thing we can't delete early is the record of a sale itself (what, when, how much), because tax law requires it; we can remove your name and address from it. For anything held by Stripe, PayPal or Royal Mail, they have their own privacy pages and you can contact them directly.

Unhappy with how we've handled your data? Tell us first and we'll try to put it right; you can also complain to the Information Commissioner's Office at ico.org.uk.