Skip to content
Contact

Privacy

Privacy & Cookie Policy

This policy explains how 438CARDS LTD ("we", "us", "our") collects, uses and protects your personal data when you use our website and shop, and how we use cookies. We are the data controller for the personal data described here. If you have any questions, please contact us.

What we collect

  • Order details: your name, email, delivery address and phone number when you place an order.
  • Marketing preferences: whether you have joined our mailing list, or opted out of marketing emails.
  • Enquiries: your name, email and message when you use our contact form (delivered to us by our form provider, Formspree).
  • Payment: card payments are processed securely by Stripe. We never see or store your full card details.
  • Usage: privacy-friendly, cookieless analytics (aggregate page views and performance) to understand how the site is used. No advertising or cross-site tracking.
  • Push notifications (optional): if you enable alerts, we store the anonymous push subscription token your browser or device creates — not your name, email or phone number — so we can notify you about drops, restocks and live breaks.

Cookies & similar technologies

We keep cookies to a minimum. They fall into three groups:

  • Strictly necessary (always on): these make the site work — remembering your basket, processing a secure payment with Stripe at checkout, and keeping the site secure. These don't require consent.
  • Analytics (cookieless): we use Vercel Analytics and Speed Insights, which measure aggregate usage without setting cookies or identifying you.
  • Optional — social & video content (consent required): some pages can show Instagram posts (Meta) and a YouTube live player (Google). These set their own cookies and are only loaded if you accept via our cookie banner. You can change your choice at any time using the "Cookie settings" link in the footer. Until you accept, this content stays blocked and a placeholder is shown instead.

Our main Instagram feed is displayed using post images we fetch and cache ourselves, so viewing it does not set cookies or share your data with Meta.

Marketing emails

If you join our mailing list (for example via the sign-up form on our homepage), we email you about new drops, offers and breaks with your consent. When you buy from us, we may also send you occasional emails about our own similar products and offers under the UK "soft opt-in" rules — you can opt out with the tick box in the basket before you pay, and opting out never affects your order. Every marketing email we send includes an unsubscribe link that takes effect immediately, and once you opt out we won't add you back, even if you order again.

Push notifications

If you install our app and choose to turn on notifications, your browser or device creates an anonymous subscription that lets us send you alerts about new drops, restocks and live breaks. We store only this subscription token — never your name, email or phone number — and the alerts are delivered through your browser or device's push service (for example Apple or Google). We only send notifications if you opt in, and you can turn them off at any time in the app or your device settings; we remove inactive subscriptions automatically.

Why we use it (lawful bases)

  • To perform our contract with you — processing and delivering your orders and providing support.
  • To meet legal obligations — keeping accounting and tax records.
  • Our legitimate interests — keeping the site secure, understanding usage through cookieless analytics, replying to your enquiries, and sending occasional marketing about our own similar products to customers who haven't opted out (the ePrivacy "soft opt-in").
  • Your consent — our mailing list if you sign up directly, loading optional Instagram and YouTube content (withdraw any time via "Cookie settings"), and push notifications if you enable them (withdraw any time by turning alerts off).

Who we share it with

Only the services needed to run the shop:

  • Stripe — payment processing.
  • Our delivery courier (e.g. Evri / DPD) — delivery of your order.
  • Shippo — generates the shipping label for your order.
  • Resend — sends our emails (order confirmations and, if you haven't opted out, marketing).
  • Formspree — delivers contact-form messages to us.
  • Vercel and Supabase — our hosting and database providers, who store data securely on our behalf.
  • Meta (Instagram) and Google (YouTube) — only if you choose to load their content via our cookie banner.
  • Browser & device push services (e.g. Apple, Google, Mozilla) — deliver push notifications to your device, only if you enable them.

We do not sell your personal data.

International transfers

Some of these providers process data outside the UK (for example in the US). Where they do, the transfer is covered by appropriate safeguards — such as the UK International Data Transfer Agreement, Standard Contractual Clauses, or an adequacy decision.

How long we keep it

We keep order and transaction records for around 6 years to meet UK accounting and tax requirements. Contact-form enquiries are kept only as long as needed to deal with them and are then deleted. Mailing-list details are kept until you unsubscribe (we then keep a suppression record so we don't email you again).

Your rights

You have the right to access, correct, delete or restrict our use of your personal data, to object to processing (including marketing — just unsubscribe or ask), to data portability, and to withdraw consent for optional cookies at any time. Just contact us and we'll help. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

438CARDS LTD, registered in England & Wales, company no. 17238605. Last updated 2026.