Privacy policy

What we collect

When you ask for a quote or a sample pack: your name, email address, company name if you give one, your phone number if you give one, and what you told us about the boxes you need. We also record which page of this site you were on when you sent it, so we know which of our pages are actually useful. None of these forms asks for a card.

When you send any of our forms we also record the approximate location our hosting provider works out from your internet connection (country, region and city, never a street address), the timezone it reports, and the kind of device, browser and operating system you used. We keep this to spot fraud and to understand who our pages are reaching. The IP address it was derived from is not stored alongside your enquiry; it only appears in the ordinary server logs mentioned below.

If you create an account: the same details, plus any shipping addresses you save. An account is optional. Pricing a box, downloading a dieline, using the 3D designer, asking for a quote and asking for a free sample pack all work without one, and they always will.

When you send artwork: the files themselves, which we keep on file so a reorder does not mean starting again.

When you pay for an order by card: you pay on Stripe's own checkout page, not on ours, so your card number goes to Stripe and never reaches us. What we keep is Stripe's reference for the payment, the amount, what it was for (a deposit, the balance, or the whole order), when it was paid, and any refund. That is enough to match the money to your order and to refund it if we ever need to, and it is all we hold.

When you use the 3D designer: the box you are working on, including any picture you add to it, is kept in your own browser on this device so a refresh does not lose it. It is not sent to us. If you choose to save a design to your account, the design and its pictures are uploaded and stored privately with Supabase: only you can open them, and our team looks at them only when you send that design with a quote request, in which case the request is linked to it. Before a picture is stored anywhere, your browser redraws it, which removes hidden details such as the location a phone camera writes into a photo.

Our server keeps ordinary request logs, which include IP addresses, for security and debugging.

Enquiries, accounts and saved addresses are stored in a hosted database run by Supabase, on our behalf and under our instructions, on servers in the United States. Before September 2026 they were held in a file on one of our own machines. Nothing else about what we collect changed with that move; where it sits did, and that is worth telling you rather than leaving you to assume.

We keep a record of the emails we send you: the address we sent to, the subject line, what it was about, when it went, and whether our mail provider accepted it. We do not keep the message itself. It is there so we can answer two questions we previously could not, which are whether anybody actually replied to you and whether our email has quietly stopped arriving.

If we send you a quote, we record when the quote page is opened, along with the same approximate location and device details described above. We do this so we can tell the difference between a quote you have read and are thinking about and one whose email never reached you, which need opposite responses from us. There is no tracking pixel in the email itself, so we cannot tell whether you opened the message, only whether the quote page was opened. The record is deleted with the quote.

When you open one of our blog posts, we count that it was opened, along with the country our hosting provider works out, the kind of device, and the name of the site that sent you if there was one (for example google.com). No cookie is set, nothing identifies you, and search engine bots are left out. It tells us which posts people actually read.

We count what happens on the site so we can tell which parts are useful: that somebody priced a box, added one to a cart, or sent a request, along with the page it happened on and the box type and quantity. Some of this counting is done by us on our own server, where it records no IP address, sets no cookie, and cannot be tied back to you. The same events are also sent to Google Analytics, which sets its own cookies and processes the data on Google's servers in the United States. We ask Google to anonymise the IP address it sees. We do not use it for advertising and we have not linked it to any ad account.

What we do not collect

We never see, store or handle your card number. Card payments happen on Stripe's hosted checkout at checkout.stripe.com, and our pages only ever send you there. Paying by bank transfer against an invoice is always an option too.

We do not run advertising trackers, and we do not set cookies to follow you around other sites. Two kinds of cookie are strictly necessary: one that keeps you signed in if you create an account, and one that keeps our own staff signed into the admin. Google Analytics also sets a few first party cookies to tell repeat visits apart. Those last between one day and two years. Nothing here is used for advertising.

The only third party analytics service we use is Google Analytics, and only to measure the funnel described above. If you would rather not be counted by it, a browser that blocks analytics cookies or an ad blocker will stop it, and our own server side counting does not identify you either way.

Some guides include a YouTube video. Nothing from YouTube loads until you press play on it: until then it is a card we draw ourselves. When you do press play, the video is loaded from youtube-nocookie.com, and YouTube, which is owned by Google, then receives your IP address and sets whatever it needs to play the video, under Google’s own privacy policy.

If you tick the box to have your details remembered on a form, your name, email, company and phone are saved in your own browser so you do not type them again. That copy stays on your device, is never sent to us for that purpose, and unticking the box deletes it straight away. It is off unless you turn it on.

We do not buy contact lists and we do not sell yours.

Why we keep it

To answer your enquiry, price your job, produce your boxes and get them to you. That is the whole purpose. If you ask a question and never order, we keep the message so we recognise you if you come back.

We do not add you to a mailing list because you asked for a quote. If we ever start sending a newsletter it will be something you opt into.

Who else sees it

Our manufacturing partner sees what they need to make your order: the artwork, the specification and the delivery address. They cannot use it for anything else.

A few companies handle data for us, as processors acting on our instructions and nothing more: Supabase stores the database, SMTP2GO sends the email we send you, Stripe processes card payments, our hosting provider runs the site itself, and Google Analytics measures how the site is used. Stripe also keeps its own records of a card payment, as any payment provider must, under its own privacy policy.

Nobody else, unless the law requires it.

How long we keep it

Enquiries that never became an order: about two years, then deleted.

Order records: seven years, because tax and accounting rules require it.

Artwork and dielines: for as long as you are a customer, so reorders stay easy. Ask and we will delete them sooner.

Designs saved from the 3D designer: until you delete them, which you can do yourself from your account at any time. Deleting a design deletes its pictures too. A quote request you sent with a design keeps its own written description of the box after the design is gone.

Your choices

Ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Email us and we will do it. We may have to keep order records where the law says so, and we will tell you if that applies.

If you have an account, you can change your details and add or remove a saved address yourself at any time. Closing the account is a message to us rather than a button, on purpose: we would rather a person checked what it means for an order you have in production than have it happen by accident.

Depending on where you live you may have additional rights, including under the GDPR in Europe or the CCPA in California. We apply the same approach to everyone rather than treating people differently by postcode.

Security

The site runs over HTTPS. Access to enquiry data is limited to the people who need it and is behind a login. No system is perfect, and anyone who claims otherwise is selling something, but we do not keep what we do not need, which is the most effective protection there is.

Children

This is a business to business site and is not aimed at children.

Changes

If this policy changes we will update the date below. If a change is significant, and it affects an order you have with us, we will tell you directly.