Privacy Policy

1. Who We Are

InkSmithery is operated by an individual sole trader based in the United Kingdom. This policy explains what data we collect, why, and how we use it.

2. What Data We Collect

When you browse the site

We use a session cookie (PHPSESSID) to maintain your shopping cart and, if you log in, your account session. This cookie is essential for the site to function. We use a small first-party analytics script that sends aggregated browsing patterns (clicks, scrolls, time on page, search queries, cart events) to our own servers to help us understand how people use the shop and improve it. No session replay, no form values beyond the search box. See Section 7 for details of all cookies.

We collect basic aggregate statistics about site usage (such as which design categories are most popular) using our own server. This data is anonymous and aggregated - we do not create user profiles from it.

Advertising cookies (only with your consent)

When you first visit, we ask whether you accept advertising cookies. If you accept, we load two advertising tags in your browser: the Google Ads tag and the Pinterest Tag. They set cookies on your device and send Google and Pinterest information about your visit - the pages you view, products you add to your basket, purchases, and technical data such as your IP address, browser and device type, along with the identifiers stored in those cookies. We use this to:

• measure which of our adverts lead to visits and sales (conversion measurement); and
• show InkSmithery adverts on Google and Pinterest to people who have previously visited our shop (retargeting).

Google and Pinterest may link this information with data they already hold about you (for example, if you are logged in to a Google or Pinterest account), under their own privacy policies.

If you accept, we also give your browser a random advertising ID (the inksmithery_adid cookie, see Section 7). It identifies a browser, not a person, and is never linked to your name or account. If you go on to place an order, we send Google and Pinterest a hashed copy of your email address with the purchase. Hashing is one-way scrambling (SHA-256): they can only match it against an email they already hold, so they can tell us an advert led to a sale. We never send your name, phone number or delivery address, in plain or hashed form.

If you reject advertising cookies, or simply don’t choose, neither tag loads and no advertising cookie is set. The shop works exactly the same either way.

Legal basis: your consent (UK GDPR Article 6(1)(a), and regulation 6 of the Privacy and Electronic Communications Regulations). You can withdraw consent at any time using Cookie settings (also at the bottom of every page). Withdrawing stops the tags loading from then on and removes the advertising cookies stored on our site’s domain; cookies Google or Pinterest hold on their own domains can be cleared in your browser settings.

Server-side sales measurement (sets no advertising cookies)

Separately from the advertising cookies above, our server tells Pinterest and Google when key shop events happen, so we know which of our ads are actually producing sales. This is server-to-server: it does not use advertising cookies or run any advertising script in your browser, and it keeps the data sent to a minimum:

What we send to Pinterest (for events like page view, add to cart, purchase):

• The event name (e.g. "page_visit", "add_to_cart", "checkout")
• The product IDs involved and, for purchases, the order total
• Your IP address and browser user agent - required by Pinterest for fraud prevention, same as any website receives when you visit it
• If you haven’t accepted advertising cookies: a random one-off token for each event (not taken from any cookie, and no way to link it to you or your other visits)
• If you have: a hashed version of your random advertising ID, so Pinterest can recognise repeat visits from the same browser, and for purchases a hashed copy of your email
• For purchases, the IP address and browser recorded when you placed the order (previously we mistakenly sent our payment processor’s)

What we send to Google Ads (only if you accepted advertising cookies before ordering):

• The click ID from the ad you clicked (gclid), if any; a hashed copy of your email; the order total; and our order reference

What we never send: your name, phone number or delivery address, in any form; or your email in plain form. Your email goes to Google and Pinterest only hashed, and only if you accepted advertising cookies.

Because this is sent from our server rather than from your browser, it sets no cookies on your device. Pinterest processes their portion under their own privacy policy; Google under theirs. Legal basis: legitimate interests (measuring the advertising we pay for) for the basic Pinterest events; your consent for the advertising ID, the hashed email and the Google Ads click ID. You can opt out of all advertising events by emailing orders@inksmithery.com.

When you place an order

We collect the following information through our payment provider, Stripe:

• Your email address
• Your delivery address
• Your name (as provided at checkout)

We also store your order details (items purchased, quantities, prices, and order reference) in our database.

We do not collect or store your payment card details. All payment processing is handled by Stripe.

To enable secure card entry and fraud prevention, Stripe’s JavaScript loads on our cart and checkout pages. It collects technical signals about your device (browser, screen, IP address) which Stripe uses to detect fraudulent transactions. This is described in Stripe’s privacy policy.

If you choose to pay using Apple Pay, Google Pay, PayPal, Link or Amazon Pay, the wallet provider you select (Apple, Google, PayPal, Stripe Link or Amazon respectively) will see the merchant name and amount in order to authorise the payment. They handle this under their own privacy policies.

Reviews of your order (Google Customer Reviews)

If you accepted advertising cookies, your order confirmation page shows an optional invitation from Google Customer Reviews. If you opt in, Google emails you a short survey about your experience after your order should have arrived, and Google receives your email address, order number, delivery country and estimated delivery date. If you don’t opt in, nothing is sent. The survey is run by Google under Google’s privacy policy. If you didn’t accept advertising cookies, Google doesn’t ask; instead we may email you once ourselves to ask for a review (see Section 3).

3. How We Use Your Data

Your data is used for the following purposes:

• Order fulfilment: Your name, email, and delivery address are shared with our production partner, Printful, so they can print and ship your order.
• Your country: When you visit, we look up which country your IP address belongs to, on our own server, so we can show prices in your currency, tell you whether we deliver to you and count visits by country. The IP address is only used for that lookup and isn’t stored. Country data: IP Geolocation by DB-IP (CC BY 4.0).
• Order emails: We email your order confirmation and shipping updates.
• Order queries: Your email and order reference allow us to respond if you contact us about an order.
• Review requests: If you didn’t accept advertising cookies, we may email you once, a few days after your order is delivered, to ask for a review. If you did, the review invitation comes from Google Customer Reviews instead (see Section 2).
• Basket reminders (only if you opt in): If you have an account, have opted in to marketing emails, and leave items in your basket without ordering, we may send you one reminder email between 1 and 7 days later. It includes a one-click unsubscribe link.
• Discount codes: If you claim a discount code, we email it to the address you give us.
• Marketing emails (only if you opt in): If you tick the optional marketing box and then confirm by clicking the link we email you, we send occasional emails such as new articles from our tips section and shop news. Legal basis: your consent. Every marketing email includes a one-click unsubscribe link. Links in these emails go through a single campaign link shared by every recipient, which counts total clicks but cannot tell us who clicked. We do not use open-tracking pixels.

Beyond the parties listed in Section 4, we do not share your data with anyone.

4. Third-Party Services

We use the following third-party services to operate the shop:

• Stripe (stripe.com) - payment processing. Stripe handles your card details under their own privacy policy.
• Printful (printful.com) - order fulfilment. Printful receives your name and delivery address to print and ship your order, under their own privacy policy.
• Pinterest (pinterest.com) - advertising. With your consent, the Pinterest Tag sets cookies and collects the browsing information described in Section 2 (“Advertising cookies”) for conversion measurement and retargeting. Independently of cookie consent, our server sends Pinterest the limited event data described in Section 2 (“Server-side sales measurement”). We never send Pinterest your name, email or address. Processed under Pinterest’s privacy policy.
• Google Ads (google.com) - advertising. With your consent, the Google Ads tag sets cookies and collects the browsing information described in Section 2 (“Advertising cookies”) for conversion measurement and retargeting. If you arrived from one of our Google ads and accepted advertising cookies, our server also sends Google the click ID from its own ad system plus our order total and reference when you buy. We never send Google your name, email or address. Processed under Google’s privacy policy.
• Google Customer Reviews (google.com) - with your consent and only if you opt in on the order confirmation page: an optional survey about your order, run by Google (see Section 2).
• Instagram comment replies (Meta) - some of our Instagram reels invite you to comment a word such as “GOLF” to get the link. If you do, Instagram tells us about your comment, and we send you one direct message with the link and post a short public reply under your comment. We keep only the comment’s ID, which post it was on, the word and whether the message was sent, so that we never reply twice; we don’t store your name, username or anything else you wrote. Legal basis: legitimate interests (answering your request). The messages are delivered by Meta under Instagram’s privacy policy.
• Cloudflare Turnstile (cloudflare.com) - invisible spam protection on our contact form only. When you submit the contact form, a small Cloudflare script analyses technical signals from your browser (IP address, browser characteristics, request timing) to verify you’re a real person and not a spam bot. No cookies, no cross-site tracking, no advertising profile. Legal basis: legitimate interests (keeping our contact inbox usable). Processed under Cloudflare’s privacy policy.

The browser-based scripts on this site are: (a) our own first-party UX analytics, which sends aggregated browsing signals to our own servers - described in Section 7; (b) Stripe’s script on the cart and checkout pages for the fraud-prevention purpose described in Section 2; (c) Cloudflare Turnstile on the contact page for the spam protection described above; and (d) the Google Ads tag and Pinterest Tag - only after you accept advertising cookies. We do not use Google Analytics, the Meta Pixel, or session-replay tools.

5. Data Retention

Order data (email, delivery address, items purchased) is retained for as long as needed to fulfil orders, handle returns, and comply with UK tax and accounting requirements. Cookie durations are listed in Section 7.

6. Your Rights

Under UK data protection law (UK GDPR), you have the right to:

• Request a copy of the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to legal retention requirements)

To exercise any of these rights, email orders@inksmithery.com, with your order reference if you have one.

7. Cookies and similar technologies

We use two kinds of cookie: essential cookies, which the shop needs to work and which don’t require consent, and advertising cookies, which are only ever set if you accept them.

Cookie settings - review or change your choice at any time.

Essential cookies

Advertising cookies (only with your consent)

These are the cookies we observed the tags setting after accepting advertising cookies (tested in Chrome, September 2026; inksmithery_adid added October 2026). The Google Customer Reviews invitation on the order confirmation page set no cookies when it loaded in our test (Chrome, October 2026); if you opt in, that happens inside Google’s own window under Google’s privacy policy. Google and Pinterest may also set or read cookies on their own domains - for example if you are logged in to a Google or Pinterest account - depending on your browser settings, and they can change their cookies without notice. If you reject advertising cookies, none of these are set. If you withdraw consent, we delete the cookies set on inksmithery.com; cookies on Google’s or Pinterest’s own domains can be cleared in your browser settings.

We may also use localStorage (a browser-side storage mechanism similar to cookies) to remember small UI preferences - for example, whether you have already seen a one-time message and dismissed it. This data lives only on your device and is never transmitted to our servers. You can clear it at any time through your browser’s site-data settings.

First-party UX analytics. A small JavaScript file (~3KB, loaded asynchronously) records aggregated browsing signals on every page: click positions, scroll depth, time on page, viewport size, navigation between pages, and shop-specific events (search submitted, design viewed, variant selected, item added to cart, checkout started). These are sent directly to our own servers - no third party is involved at any stage. Each session is keyed by an anonymous hash of your PHPSESSID; we never store the raw session ID and never link this data to your name, email, or any account. We do capture the text you type into the shop’s search box (which helps us understand what visitors look for that we may not yet offer); we do not capture any other form input - your email, address, card details, and account fields are never recorded. We never record session replays, keystrokes, mouse traces, or any data that could identify you personally. Session-level data is retained for 30 days, after which only anonymous totals remain (e.g. “page X received N clicks last month”).

Because this data is keyed only by an anonymous session hash with no link to your name, email, or account, we cannot identify which historical sessions are yours. You can erase your current browser’s analytics data at any time by visiting /privacy/erase-my-analytics. Session-level data is automatically deleted after 30 days regardless.

8. Changes to This Policy

We may update this policy from time to time. The date at the top of the page shows when it was last updated.

9. Data Controller

The data controller for any personal data processed through this site is:

InkSmithery
Paul Newson trading as InkSmithery
Llanberris
Woods Loke East
Lowestoft
NR32 3DR
United Kingdom
orders@inksmithery.com

10. Contact

For any privacy-related queries, contact orders@inksmithery.com.