Privacy & Cookies Policy

Most privacy policies are long because the shop is doing a lot. This one is short in the places that matter because this shop is doing very little.

This site runs no analytics. It does not track you, profile you, advertise to you, or sell anything about you to anybody. On every page of this shop except one, your browser makes no request to any company other than us. There is no Google on this site, no Meta pixel, no heatmap, no session recorder, no advertising tag, and no cookie banner — because there is nothing to ask you to consent to.

The rest of this page says exactly what we do hold, who else sees it and why, and how long we keep it.

Who is responsible for your information

Our Data controller is contactable at

• Email: hello@aminoand.co

Contact us at the above email address about anything on this page, including any of the rights listed further down. We aim to answer within one working day and we must answer a formal rights request within one month.

What we collect, and why

We collect only what an order needs.

When you buy something

• Your email address. It identifies your account and it is how we tell you what is happening to your order.
• Your name and delivery address. To get the parcel to you. They go on the label and nowhere else.
• What you ordered, what it cost and when. The order record.
• A payment reference. For a card payment, PayPal's reference for it. For a coin payment, the transaction hash and the Ethereum address the payment came from.

We never see or hold your card number. Card details are entered on PayPal's own pages and never touch this shop.

When you sign in

We email you a short-lived sign-in code. We hold the code until it expires and then delete it automatically.

When you ask to be told an item is back in stock

We hold your email address against that item, and we use it once, for that.

Technical information

Our host records ordinary web-server information about requests to the site — the address the request came from, what was asked for, and when. This is described under Cloudflare below, including a retention detail we think you should know about.

What we do not do

• We run no analytics of any kind. We do not know how many people visited a page, where they came from, or what they did next.
• We do not build a profile of you, and there is no automated decision-making or profiling anywhere in this shop.
• We do not send marketing email. Every email we send is about something you did — an order, a sign-in, a stock notice. See "Marketing" below.
• We do not sell, rent or share your information with anybody for their own marketing.
• We do not use your information for anything except running this shop.

Cookies

This shop sets four cookies. All four are strictly necessary and none of them are for tracking.

• us_basket — remembers what is in your basket. Set when you first add something. Lasts 30 days.
• us_session — keeps you signed in after you use a sign-in code.
• us_placed — lets you reach the payment screen for an order you have just placed without signing in first. It lasts only as long as we are holding your stock.
• us_return — set on unitseven.uk, the platform this shop runs on, only if you pay by card. It carries you back to your order after PayPal so the payment can be completed against it, and is deleted the moment you arrive. It lasts under an hour and is explained under "The card payment hop" below.

All four are HttpOnly, Secure and SameSite=Lax: no script on the page can read them, they travel only over an encrypted connection, and they are not sent from other sites.

Browse this shop and no cookie is set at all. Nothing is stored on your device until you do something that needs it — add to a basket, sign in, or place an order. That is why there is no cookie banner: under the Privacy and Electronic Communications Regulations, consent is not required for storage that is strictly necessary to provide a service you have asked for, and every one of these four is exactly that. There are no others to ask about.

The one third party your browser ever contacts

There is a single exception to "no third-party requests", and we would rather name it than round it down.

Cloudflare Turnstile is an anti-bot check. It loads on two places only:

• the sign-in page, and
• the back-in-stock form on a product page, and only once you open that form.

It is there because those two forms send email to an address somebody typed, and without a check they can be used to send mail to strangers. Turnstile is Cloudflare's privacy-preserving alternative to a CAPTCHA: it does not ask you to identify traffic lights, it does not track you across sites, and Cloudflare states that it processes only the data needed for the security check and does not access or transmit your form entries. We have not enabled its pre-clearance cookie, so it stores nothing on your device here.

Every other page in this shop — the home page, the range, every product, search, the basket, the checkout, the payment screen and these policies — makes no third-party request whatsoever. On the home page and the product pages that is enforced rather than intended: their performance budget allows a third-party request count of zero, and a change that introduced one would fail our build before it could reach you.

Who else sees your information

These are the companies we rely on to run the shop. Each is named with what it actually does, because "trusted partners" tells you nothing.

Cloudflare — the shop itself

Cloudflare hosts this shop: the site, the database, the product photographs and the Turnstile check. Everything you send us passes through and is stored on Cloudflare's infrastructure. Cloudflare acts as our processor under a data processing addendum, and relies on the UK International Data Transfer Addendum and Standard Contractual Clauses for transfers outside the UK.

One retention fact we want to state plainly. Cloudflare keeps seven days of request logs for this shop, and those logs include request headers — which means that if you are signed in or have a basket, your session cookie appears in a log entry for seven days. There is no setting that removes headers from those logs; the only alternative Cloudflare offers is to keep no per-request records at all, which would leave us unable to investigate a fault or an attack on a shop that takes money. We have switched off the logging of query strings, which is the part we can control. The logs are readable only with access to our Cloudflare account, they are deleted after seven days, and we treat who may read them as the control that matters.

Resend — the emails we send you

Resend delivers the shop's email: order confirmations, payment notices, dispatch notices, sign-in codes and stock notices. Your email address and the contents of those messages pass through Resend, which processes data in the United States as our processor, under Standard Contractual Clauses with the UK addendum. Resend publishes its own list of sub-processors.

PayPal — card payments

If you pay by card, PayPal handles the payment.

PayPal is not our processor. It is a data controller in its own right, and what it does with your information is governed by its own privacy statement rather than by this one. For customers in the United Kingdom the controller is PayPal UK Ltd, 5 Fleet Place, London EC4M 7RD. We receive from PayPal only a confirmation that the payment succeeded and a reference for it.

Alchemy — watching for coin payments

If you pay in USDT or USDC, Alchemy tells us when a transfer arrives at our receiving address.

We send Alchemy nothing about you: not your name, not your email, not your address. Alchemy watches a public blockchain and reports transfers to an address of ours. Those reports contain the sending wallet address and the amount — information that is already public on the Ethereum blockchain and would be there whether or not we used Alchemy.

CoinGecko — the exchange rate

CoinGecko supplies the USDT and USDC exchange rate so we can quote a coin price for a sterling total. No information about you reaches CoinGecko. Our server asks it for a price; nothing about you is in the question.

Proton — our mailbox

Email you send to hello@aminoand.co arrives in a mailbox hosted by Proton AG in Switzerland. Proton states that it cannot read the contents of encrypted messages and does not keep permanent IP logs by default. Switzerland is covered by UK adequacy regulations, so no additional transfer safeguard is needed.

Royal Mail — delivering the parcel

Royal Mail carries the parcel and therefore has your name and delivery address, as the label. This shop has no automatic connection to Royal Mail: the label is produced by hand from Royal Mail's own service when your order is packed. Royal Mail is a controller for its own delivery and tracking records.

Where your information goes

The United Kingdom, the United States and Switzerland.

Transfers to our United States processors — Cloudflare, Resend and Alchemy — are covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, and each of those companies also certifies under the UK Extension to the EU–US Data Privacy Framework. Switzerland has a UK adequacy decision. We do not transfer your information anywhere else.

Our legal grounds for holding it

• Performing our contract with you — your email, name, delivery address and order. We cannot sell you something and send it to you without these.
• A legal obligation — keeping transaction records for HMRC.
• Our legitimate interests — keeping the shop secure, preventing fraud, and being able to investigate a fault. We have weighed this against your privacy, which is why there is no analytics and why the security data we hold is as thin as it is.
• Your consent — only for the back-in-stock notice, which you ask for and can withdraw at any time by telling us.

How long we keep things

Some of this is our choice and some of it is not. Where the law sets the floor, we say so.

• Order, payment and refund records — 6 years from the end of the tax year they fall in. HMRC requires a sole trader to keep business records for at least five years after the filing deadline; six years from year end is the standard way of meeting that with a margin. This includes the delivery address, because it is evidence of the supply. We cannot delete these earlier on request, and this is the one limit on the erasure right below.
• Your account and email address — while your account is in use, and deleted after 3 years of no activity, or sooner if you ask. The order records above survive that deletion in a form that is kept for the tax obligation.
• Sign-in codes and email-change codes — minutes. Deleted automatically once they expire.
• Sessions — deleted automatically when they expire, and immediately when you sign out.
• Baskets you never checked out — deleted automatically after 30 days.
• Back-in-stock requests — until we notify you or you ask to come off, and in any case no longer than 12 months.
• The record of emails we sent you — 24 months, so we can answer "did you send it?" if a message goes astray.
• Web server logs — 7 days, fixed by Cloudflare, as described above.
• Blockchain transactions — our own copy of a coin payment is part of the order record and follows the 6 years above. The transaction itself is on a public blockchain permanently and neither we nor anybody else can remove it.

Marketing

We do not send marketing email today. Every email this shop sends is transactional: order received, payment received, part payment received, payment received late, order closed, dispatched, back in stock, a sign-in code, or a code confirming an email change. None of them are optional in the sense that matters, because each one is telling you something about a thing you did.

If we ever introduce a newsletter or offers, it will be opt-in: we will ask, you will have to say yes, and every message will carry a one-click unsubscribe. We will not add you to a marketing list because you bought something, and we will update this page before sending anything.

The card payment hop

If you pay by card, the shop sends you to PayPal by way of unitseven.uk, and brings you back the same way. That is the us_return cookie above.

It exists to ensure compatibility with the central platform which the shop is hosted and relies upon, the central platform is where orders are recorded, payments are reconciled, system and operational activities are managed and where a PayPal payment is opened and then completed.

The cookie itself holds a single random reference and nothing else. It lasts under an hour, it is deleted the moment you arrive back, and it carries nothing about you and nothing about what you bought.

Your rights

Under the UK GDPR you can ask us to:

• Give you a copy of the information we hold about you.
• Correct anything that is wrong.
• Delete it. We will, apart from the transaction records we are legally required to keep for six years — we will tell you exactly what is being kept and why.
• Restrict or object to what we do with it.
• Give you a portable copy, in a machine-readable file.
• Withdraw consent for the back-in-stock notice, at any time.

Email hello@aminoand.co. There is no charge and we will answer within one month.

If you are not happy with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would rather you told us first, but you do not have to.

Changes to this policy

If we change what we do with your information, we change this page and move the date below. If the change is significant and we hold your email address, we will tell you.

Last updated: 9 September 2026.