Privacy Policy

Who we are

The Bash Mash runs this shop and decides how your information is used, so we're the "controller" of it under UK data protection law. You can contact us at support@thebashmash.com or through the Contact us page.

What we keep

• Orders: your name, email address, delivery address, what you bought and how much you paid, so we can send your order and deal with any problems.
• Payments: these are taken by Stripe on its secure checkout page. We never see or keep your card details.
• Messages: when you use the contact form or email us, your name, email address and message, and our replies.
• Your basket: what's in your basket is kept in your own browser until you check out or empty it.

Website visit stats

We count visits without cookies, to see which pages and products people look at. For each page view we keep the page, the website that sent you, the type of device, your country, and a random code that lasts until you close the tab, so we can count visits rather than page loads. We don't keep your IP address or anything else that identifies you.

Why we use it

• To take, send and look after your order, including returns and refunds (our contract with you).
• To answer your messages (legitimate interests, or because you've asked us to before ordering).
• To keep order and payment records for tax (legal obligation).
• To understand which pages and products are popular, and to keep the shop secure (legitimate interests).

We don't send marketing emails, sell your information, or use it for advertising.

Who else handles it

We only share your information with the providers that run the shop for us, and only what they need:

• Lovable and Cloudflare host the shop, its database and files.
• Stripe takes payments.
• Resend and our email provider send and receive our emails.
• The postal or delivery service we send your order with gets your name and address.
• Charlie's Websites built the shop and looks after it for us, with access to order and message details only when it's needed.
• Google Fonts delivers the shop's fonts, so your browser shares your IP address with Google.

Some of these providers are in the United States. Where your information goes outside the UK, it's protected by UK adequacy rules or contracts approved for that purpose.

We'll also share information if the law requires it.

How long we keep it

• Orders and payment records: 6 years, because tax rules require it.
• Messages: 2 years after the last message.
• Visit stats: as long as they're useful, as they don't identify anyone.

Cookies and your browser

We don't use advertising or tracking cookies, so there's no cookie banner. The shop keeps a few things in your browser so it works:

• your basket (bash-mash-cart);
• the random visit code described above (bm-visit), removed when you close the tab;
• whether you've seen the train animation this visit (bm-train-seen), removed when you close the tab;
• a copy of the shop's text, so pages load quickly.

Paying happens on Stripe's checkout page, which uses its own cookies under Stripe's policy.

Your rights

You can ask to see, correct or delete what we hold about you, ask us to limit or stop using it, object to how we use it, or ask for a copy. Email support@thebashmash.com and we'll reply within one month. Some things, like order records, we have to keep for tax.

If you're unhappy with how we've handled your information, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes

If we change this policy, we'll update the date at the top.