Privacy policy

Who is responsible

Political Idioms is the trading name used by the data controller for this store. For returns, written complaints and legal correspondence, write to Political Idioms, 86–90 Paul Street, London EC2A 4NE. Contact [email protected] about anything on this page.

What we collect and why

Data	Why	Lawful basis
Name, email, delivery and billing address, phone	To take and deliver your order	Performance of a contract
Order contents and history	To produce, ship and support your order, and for accounting	Contract and legal obligation
Account email and password hash	To let you sign in and see your orders	Contract
Contact form messages	To answer you	Legitimate interests
IP address and request counts	To rate limit abuse and keep the site up	Legitimate interests
Approximate country from your IP address	To preselect a delivery destination and show an indicative USD price, both of which you can change	Legitimate interests
Page views, device type and approximate location	To understand site performance and usage through cookie-free Cloudflare Web Analytics	Legitimate interests
Pages viewed, basket and checkout steps reached, whether you selected a product option such as a size, how long each page was open, how far down each page you scrolled, referring site or campaign, device and browser, approximate country and page loading times	To measure our own site performance and see where shoppers give up, using our own measurement rather than an advertising network. Grouped under a random identifier that lasts only for your current browser session and is never linked to your name, email or order	Legitimate interests

Payments

Card payments are handled entirely by Stripe. We never receive or store your card number. Stripe processes data as an independent controller under its own privacy policy.

Cookies

We set one cookie, pi_auth, and only if you sign in. It is strictly necessary to keep you signed in, so it does not require consent. Cloudflare Web Analytics measures basic page usage without placing an analytics cookie or building an advertising profile. If you choose Google Sign-In, Google processes that sign-in request under its own privacy terms.

Our own site measurement also places no cookie. It uses a random identifier held in your browser’s session storage, which your browser discards when you close it, so it cannot follow you between visits, between browsers or across other websites. We record the country your IP address suggests but do not store the IP address itself against these measurements.

Your basket is stored in your browser’s local storage, not on our servers, and never leaves your device until you check out. Your chosen delivery country is stored the same way, and a country guessed from your IP address is kept only for the current browser session. Neither is shared with anyone and both are cleared when you clear site data.

Who we share with

• Stripe — payment processing
• Cloudflare and Netlify — website security, traffic measurement, hosting, functions and content delivery
• Neon — database hosting
• Fastmail — sending transactional and support email
• Google — optional Google Sign-In
• Our production and delivery partners — the name and address needed to make and deliver your order

We never sell your data or share it for marketing.

How long we keep it

• Completed order records: six years for accounting and legal obligations, after which personal fields are removed
• Incomplete and cancelled checkout records: ninety days
• Account data: until you delete your account
• Contact messages: two years
• Rate limiting records: thirty days
• Email delivery logs and Stripe webhook receipts: ninety days
• Admin audit logs: two years, with IP addresses removed after thirty days
• Site measurement records: thirteen months

Deleting your account anonymises it. Order records are retained because we are legally required to keep them.

Your rights

Under UK GDPR you can ask for a copy of your data, ask us to correct or delete it, object to processing, or ask us to restrict it. Email [email protected] and we will respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk.

Security

The site is served over HTTPS with a strict content security policy. Passwords are hashed with bcrypt and never stored in plain text. Access to the database and admin tools is restricted and logged.