Privacy

Like A King Inc. is the data controller for genatsvale.shop. Under the GDPR that means we decide why and how your data is used, and we are the party you hold accountable for it.

Three categories, and nothing beyond them.

When you order

Name, email, delivery and billing address, phone number, and what you bought. Collected because a parcel cannot be addressed without it. Lawful basis: performance of a contract.

When you pay

Card details go directly to Stripe and never reach our servers. We receive a payment reference, the last four digits, and whether it succeeded. Lawful basis: contract, and our legitimate interest in preventing fraud.

When you visit

Your IP address and basic request metadata appear in server logs, kept briefly for security and debugging. Lawful basis: legitimate interest in operating a site that is not being attacked.

There is no account to create, no newsletter signup that runs by default, and no tracking pixel from an advertising network. The contact form collects only a name, a reply address and what you wrote; it is kept with support correspondence and deleted on the schedule in section 6. The bag is stored in your own browser, not on our servers — see the cookies page.

If you use the chat window, what you type is sent to Anthropic to generate a reply, along with a description of the catalogue. Conversations are not linked to your order, not stored on our servers, and disappear when you close the tab.

Because it leaves our infrastructure, do not type anything into it you would not put in an email — card numbers least of all. It has no access to order data and cannot look up your order.

Named individually, because “trusted partners” is not a disclosure. Each acts as a processor on our instructions.

Stripe, Inc.

Payments, tax calculation, fraud prevention. Receives: Name, email, billing and delivery address, phone, card details. Their policy ↗

Printful, Inc.

Printing and shipping. Receives: Name, delivery address, phone, order contents. Their policy ↗

Printify, Inc.

Printing and shipping. Receives: Name, delivery address, phone, order contents. Their policy ↗

Vercel Inc.

Website hosting and delivery. Receives: IP address and request metadata, in server logs. Their policy ↗

Anthropic PBC

Powers the concierge chat, when you use it. Receives: The text you type into the chat window. Their policy ↗

Nobody else. Your data is not sold, rented, or shared for anyone else’s marketing — which also means we do not “sell” or “share” personal information as California defines those words.

Orders are printed in the United States and the European Union, so a delivery address crosses a border by necessity. Transfers out of the UK and EEA rely on the European Commission’s Standard Contractual Clauses in our agreements with the processors above.

Order records

Seven years. Tax and accounting law requires it; this is not a choice we can waive on request.

Contact messages

Three years from the last exchange, then deleted.

Server logs

Thirty days, then rotated out.

Chat conversations

Not retained by us at all.

Wherever you live, you can ask us for these. We answer within 30 days and we do not charge for it. Ask through the contact form, giving the address you ordered with so we can match the request to your data.

Access

A copy of everything we hold about you.

Correction

Fix anything wrong — usually a mistyped address.

Deletion

Erase it, except order records we are legally required to keep for the period above.

Portability

Your data in a machine-readable file.

Objection

Object to processing based on legitimate interest, including any marketing email.

Complaint

Complain to your data protection authority. In the EU that is your national DPA; in the UK, the ICO. You do not have to come to us first, though we would rather you did.

We only email you about your order unless you explicitly ask for more. If we ever add a mailing list it will be opt-in, unticked by default, with an unsubscribe link in every message that works on the first click.

The site is served over HTTPS. Card data never touches our servers. Administrative access is behind a password and a signed session, and no customer data is stored in the browser beyond your own bag.

No store can promise a breach will never happen. What we will do is tell you: if a breach affects your data, you will hear it from us and we will notify the relevant authority within 72 hours, as the GDPR requires.

This store is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has given us data, tell us and it will be deleted.

If this policy changes materially, the effective date at the top changes with it. Changes are not applied retroactively to data already collected under an earlier version without telling you.