Privacy policy

Who is responsible

The business trading as Big Squid Print is responsible for personal information used to run this shop. Its legal name, geographical address and privacy contact email must be confirmed before this policy is published. Our contact page will carry those details.

This notice covers visitors, people requesting quotes, account holders, customers and delivery recipients. If artwork contains other people’s personal information, provide only what is needed for the job and make sure you are entitled to share it.

Information we handle

• Contact and delivery details: name, email, optional company and phone number, postal address and any saved addresses.
• Account information: email sign-in identity, order and quote history, and account preferences you provide.
• Print information: specifications, quantities, artwork files and filenames, technical check results, notes, quotes and correspondence.
• Transaction information: prices, tax, payment status, payment-provider references, refunds, production status and tracking details. Card details are entered with Stripe; the shop does not store your full card number or security code.
• Technical information processed by the website and its providers, such as IP addresses, browser information, request/error logs and sign-in activity for operation and security.

Information comes from you, the person placing an order for you, and providers that report payment, production and delivery progress. Required fields are needed to respond or fulfil the order; optional fields are marked. Without the necessary details we may be unable to provide that service.

Why we use it

• Quotes, accounts and orders: to take steps you request before a contract and perform our contract with you, including artwork checking, payment, production, delivery and support.
• Business contacts and recipients: our legitimate interests in communicating with a business customer and delivering the print it ordered, where the individual is not personally a party to the contract.
• Security and disputes: our legitimate interests in protecting the service, preventing misuse, investigating errors and establishing or defending claims. We consider the impact on your rights.
• Tax and other legal obligations: to keep records and respond to lawful requirements.

Order and sign-in messages are service communications. This version of the shop has no newsletter sign-up, advertising pixels or behavioural analytics. We will update this notice and obtain consent where required before adding optional marketing or tracking.

Technical artwork checks and pricing calculations run automatically. Artwork checks concern file requirements, not the legal or creative content of your design. You can ask for help or a manual quote if an automated check prevents you from proceeding. We do not use these checks to make decisions with legal or similarly significant effects about you.

Who receives information

We share the information needed for the relevant task with payment providers (Stripe), account/database and file-storage providers (Supabase), website hosting and security providers, email delivery services, print production partners and delivery carriers. For example, a printer needs your artwork and specification; a carrier needs delivery details. Email delivery uses Resend when enabled. Advisers and authorities may receive information where necessary for legal, accounting or claims purposes.

Some providers act on our instructions and others, such as payment providers for their own regulatory duties, may act as independent controllers. We do not sell personal information.

Before publication: confirm the live hosting and email arrangements, provider locations and international transfers. If information is transferred outside the UK, the final notice must identify the relevant destination arrangements and protection (such as UK adequacy regulations or approved contractual safeguards), and explain how to request a copy. We have not assumed that all data stays in the UK.

How long information is kept

Retention depends on why information is needed: fulfilling an order and resolving issues; keeping legally required tax records; maintaining an account and requested reorder facility; or establishing and defending a claim. A legal hold may require particular records to be kept longer. Data no longer needed should be deleted or anonymised, with backup copies expiring through their backup cycle.

Before publication: the owner must approve specific periods for order/tax records, quotes that do not become orders, artwork (including abandoned uploads), inactive accounts, security logs and backups, and put the corresponding deletion process in place. Automatic artwork deletion is not currently implemented. This draft does not promise a deletion deadline the service cannot meet.

Cookies and browser storage

The shop uses storage needed for functions you request. The basket is saved on your device under dp.cart.v1, including product choices and artwork references; it remains until cleared or replaced. A reorder message uses dp.reorder-notice.v1 for the browser tab’s session or until dismissed. Supabase authentication cookies keep you signed in and support session renewal; they are cleared on sign-out or expire according to the session configuration.

Stripe’s hosted checkout may use its own payment and fraud-prevention cookies. Its notices apply on that service. You can clear site data or manage cookies in your browser, but doing so can empty your basket or sign you out. There is no optional analytics or advertising storage in the current shop implementation.

The final deployment’s cookie lifetimes and any hosting additions must be checked before launch. Optional storage requiring consent must remain off until that consent is given.

Keeping information safe

Artwork is stored privately and shared through time-limited links. Owner administration requires authorised access. Treat your account sign-in, quote and order links as private: anyone with a valid private link may be able to view the information it grants access to. No online service can guarantee absolute security; contact us promptly if you believe a link or account has been misused.

Do not include unnecessary sensitive information in artwork or notes. If a job requires sensitive personal data or personal data processing on your organisation’s behalf, contact us before uploading so the appropriate arrangements can be agreed.

Your rights and questions

Depending on the circumstances, you can ask for access, correction, erasure, restriction or a portable copy of your personal information. You can object to processing based on legitimate interests and to direct marketing. Where we rely on consent, you can withdraw it without affecting earlier lawful processing. Some information may need to be retained to meet a legal duty or deal with a claim.

Contact the privacy contact shown above to make a request. We may need proportionate information to verify your identity. We normally respond within one month, with extensions or pauses only where the law permits and with an explanation.

You can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or by calling 0303 123 1113. You do not have to contact us first, although we welcome the chance to resolve your concern.

We will update the date on this notice when it changes and draw material changes to your attention where appropriate.