Legal
Privacy policy
We collect as little as we can get away with, and we do not sell any of it. Last updated 11 August 2026.
Who is responsible
[COMPANY NAME], trading as Political Idioms, is the data controller. Registered office [REGISTERED ADDRESS]. Contact [email protected] about anything on this page.
What we collect and why
| Data | Why | Lawful basis |
|---|---|---|
| Name, email, delivery and billing address, phone | To take and deliver your order | Performance of a contract |
| Order contents and history | To produce, ship and support your order, and for accounting | Contract and legal obligation |
| Account email and password hash | To let you sign in and see your orders | Contract |
| Contact form messages | To answer you | Legitimate interests |
| IP address and request counts | To rate limit abuse and keep the site up | Legitimate interests |
Payments
Card payments are handled entirely by Stripe. We never receive or store your card number. Stripe processes data as an independent controller under its own privacy policy.
Cookies
We set one cookie, pi_auth, and only if you sign in. It is strictly
necessary to keep you signed in, so it does not require consent. We do not run
advertising or analytics cookies, and there is no tracking pixel on this site.
Your basket is stored in your browser’s local storage, not on our servers, and never leaves your device until you check out.
Who we share with
- Stripe — payment processing
- Netlify — website hosting and content delivery
- Neon — database hosting within the UK or EEA
- Our production and delivery partners — the name and address needed to make and deliver your order
We never sell your data or share it for marketing.
How long we keep it
- Order records: six years, as required for tax purposes
- Account data: until you delete your account
- Contact messages: two years
- Rate limiting records: thirty days
Deleting your account anonymises it. Order records are retained because we are legally required to keep them.
Your rights
Under UK GDPR you can ask for a copy of your data, ask us to correct or delete it, object to processing, or ask us to restrict it. Email [email protected] and we will respond within one month.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk.
Security
The site is served over HTTPS with a strict content security policy. Passwords are hashed with bcrypt and never stored in plain text. Access to the database and admin tools is restricted and logged.