We're built around one job: turning your photos and designs into physical
things you can hold. We don't store data we don't need, we don't sell
anything to anyone, and we don't track you around the internet. Your data
is yours — we just borrow what we need to make and ship your order.
Who we are
impry.me is operated by impry.me in the United Kingdom. If you have any questions about your data, email contact@impry.me and a real person will get back to you.
The data controller for personal data processed via impry.me is impry.me ("impry.me", "we", "us"), a sole trader established in the United Kingdom. Contact: contact@impry.me.
What we collect
Only what we need to make your order, ship it, and keep our books straight: Identity and contact (name, email, shipping address); Account info (login handled by Clerk, so we never see your password); Order info; Payment info (handled entirely by Stripe — your card number never touches our servers); Your uploads; Basic site analytics (anonymous, aggregate, via Vercel Analytics — no cookies, no tracking of individuals). No marketing trackers, no advertising IDs, no sneaky pixels.
We process the following categories of personal data: Identity data: name. Contact data: email address, postal address. Account data: authentication identifiers managed by Clerk; we do not process or store passwords. Transaction data: order details, item configurations, payment confirmation tokens. Card data is processed directly by Stripe under their PCI-DSS-compliant infrastructure and is never transmitted to or stored by us. Content data: images and design files uploaded for the purpose of fulfilment. Technical data: aggregate, non-cookie-based analytics via Vercel Analytics, comprising page views, referrers, and device class. No persistent identifiers are set.
Why we collect it
Three reasons, all boring: to make and deliver your order (we can't ship you stickers without an address); to meet our legal obligations (HMRC requires us to keep order records for 7 years); to keep things working (basic anonymous analytics to see which pages need fixing). We don't process your data for marketing.
Lawful bases under UK GDPR Article 6: Contract performance (Art. 6(1)(b)): processing necessary to fulfil your order, including production, shipping, and post-purchase support. Legal obligation (Art. 6(1)(c)): retention of transaction records as required by HMRC and other applicable UK tax and consumer law. Legitimate interests (Art. 6(1)(f)): aggregate, non-individual analytics for service improvement and fraud prevention. Balancing test conducted; no significant impact on data subject rights. We do not process personal data for direct marketing.
Who we share it with
We use a small number of trusted services, each seeing only the data it needs: Clerk (authentication, US); Stripe (payments, US, PCI-DSS); Supabase (database + image storage, EU/Frankfurt); Hetzner (image processing, Germany); Vercel (hosting + analytics, US); Resend (transactional email, US). We don't share your data with anyone for advertising or marketing. Ever.
We engage the following processors and sub-processors:
| Processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Clerk | Authentication | USA | Standard Contractual Clauses (UK addendum) |
| Stripe | Payment processing | USA | Standard Contractual Clauses (UK addendum) |
| Supabase | Database, file storage | EU (Frankfurt) | Adequacy |
| Hetzner | Image processing | Germany | Adequacy |
| Vercel | Hosting, analytics | USA | Standard Contractual Clauses (UK addendum) |
| Resend | Transactional email | USA | Standard Contractual Clauses (UK addendum) |
Where data is transferred outside the UK to jurisdictions without an adequacy decision, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
How long we keep it
Different things have different timelines, but the principle is: not a day longer than we need to. Your uploaded images: deleted automatically 5 days after estimated delivery (opt in to keep them for re-ordering). Order records: 7 years (tax law requirement). Account info: kept while your account is active — delete anytime. Analytics: aggregate only. If you ask us to delete your account, your personal details come off the system; we keep an anonymised order record for tax compliance that can't be linked back to you.
Retention periods: Uploaded content: deleted automatically 5 days after estimated delivery date, with the dispatch date as the start of the delivery estimate. Customers may opt in to retain uploads in their account for re-ordering. Transaction records: retained for 7 years, as required by HMRC and applicable tax law. Account data: retained for the duration of the account. Deletion requests honoured within 30 days; transaction records associated with the account are anonymised rather than deleted to maintain compliance with tax retention requirements. Analytics data: retained by Vercel in aggregate, non-personal form, per the Vercel Analytics retention policy.
Your rights
Under UK GDPR, you have the right to: see what we have on you; correct anything wrong; delete your account and personal data (with the tax-record caveat above); take your data with you; object to certain processing; restrict how we use your data while we sort something out; complain to the ICO. To exercise any of these, email contact@impry.me. We'll respond within 30 days, usually much sooner.
You have the following rights under UK GDPR Articles 15–22: Right of access (Art. 15); Right to rectification (Art. 16); Right to erasure (Art. 17), subject to legal retention obligations; Right to restriction of processing (Art. 18); Right to data portability (Art. 20); Right to object (Art. 21); Rights related to automated decision-making (Art. 22) — not currently applicable, as we do not engage in automated decision-making with legal or significant effects. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) if you believe your data has been processed unlawfully.
Cookies
We don't use tracking cookies. Our analytics provider (Vercel Analytics) is cookieless by design. The only things we set are strictly necessary cookies for authentication (Clerk) and your shopping session — without these, you literally couldn't log in or check out. No banner needed because we have nothing to ask you to consent to.
We use only strictly necessary cookies as defined under PECR Regulation 6(4), specifically: authentication tokens (Clerk) and session management for cart and checkout. No analytics, advertising, or third-party tracking cookies are deployed. Vercel Analytics operates without cookies or persistent identifiers.
Children
You need to be 16 or over to use impry.me. If you're under 16, ask a parent or guardian to place the order — they'll be the one entering into the contract with us, and they take responsibility for the order. If we find out we've collected data from someone under 16 without parental involvement, we'll delete it.
impry.me is not directed at children under 16. Account creation requires the user to be at least 16 years of age, or for the order to be placed with the permission and supervision of a parent or guardian who accepts contractual responsibility. We do not knowingly collect personal data from children under 16, and any such data identified will be deleted promptly.
Security
Data is encrypted in transit (HTTPS everywhere) and at rest (Supabase storage). Payment data never touches our infrastructure — Stripe handles it directly under their PCI-DSS Level 1 compliance. If something goes wrong and your data is affected by a breach, we'll tell you and the ICO within the timeframes UK law requires (72 hours to the ICO; without undue delay to you if there's a high risk to your rights).
Changes to this policy
If we change this policy, we'll update the date at the bottom and, for material changes, email registered users to let them know. Continued use of the service after a change means you've accepted the updated version.
Talk to us
Questions about your data, requests to exercise your rights, or anything else: contact@impry.me.