NeuroThreadz (London, UK) is the “data controller” for the personal data you give us. That means we decide how and why it’s used. You can contact us about anything in this policy at hello@neurothreadz.xyz.

Depending on how you use the site, we may collect:

• Order details — your name, email, delivery address and what you bought.
• Custom request details — your brief, the garment and placement you chose, and any reference images you upload.
• Contact messages — your name, email, message and any order number you reference.
• Payment confirmation — handled by Stripe. We receive confirmation of payment and a reference, not your full card number.
• Technical data — basic, largely anonymous information your browser sends (such as device and general location) used to keep the site running and secure.

• To fulfil your order or quote your custom request — because it’s necessary to perform our contract with you.
• To answer contact enquiries — on the basis of our legitimate interest in helping customers.
• To meet tax and accounting obligations — because we’re legally required to keep certain records.
• To protect and improve the site — on the basis of our legitimate interest in a secure, working service.

We don’t sell your data. We share it only with the service providers we need to run the shop, each acting as our processor under contract:

• Stripe — to take payment securely.
• Supabase — to store order, request and contact records.
• Resend — to send order and status emails.
• Vercel — to host and serve the website.

We may also disclose data where we’re legally required to.

We keep order and transaction records for as long as needed to fulfil your order and to meet legal/accounting obligations (generally up to six years for financial records). Contact messages and unsuccessful custom requests are kept only as long as needed to deal with them, then deleted.

Some of our providers may process data outside the UK. Where they do, we rely on safeguards recognised under UK data protection law (such as adequacy decisions or standard contractual clauses) to keep your data protected.

Under UK GDPR you have the right to:

• ask for a copy of the data we hold about you;
• ask us to correct anything that’s wrong;
• ask us to delete your data, where there’s no legal reason to keep it;
• object to, or ask us to restrict, certain processing; and
• ask us to transfer your data to another provider where technically possible.

To exercise any of these, email hello@neurothreadz.xyz. If you’re unhappy with how we’ve handled your data you can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

We keep cookies to the minimum needed to run the site and process payments securely. We don’t use advertising or cross-site tracking cookies. If that changes, we’ll add a cookie banner letting you choose before any non-essential cookies are set.

We use reputable providers and sensible technical measures to protect your data. No online service can be guaranteed 100% secure, but we take the safety of your information seriously and act promptly if anything goes wrong.

We may update this policy as the business grows; the date at the top shows the latest version. Questions? Email hello@neurothreadz.xyz.