Privacy policy
Last updated: 22 September 2026
Who we are
Vivid Delights is a trading brand of Vivid Intelligence Ltd, a company registered in England and Wales (company number 13434339), whose registered office is at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. Vivid Intelligence Ltd is the controller of the personal data described in this policy and is registered with the Information Commissioner's Office under registration number ZC228860. For anything about your data, email hello@vividdelights.co.uk.
What we collect and why
To take an order we need your name, email address, delivery address and payment through Stripe; without them we cannot accept or deliver it. Everything else described here is optional: a phone number, an account, reminders, photos, the emails you ask for, and reviews.
When you place an order
We collect your name, email address, delivery address and, if you give one, your phone number, together with what you ordered and the words you ask us to print on labels, stickers and cards. We use this to make and deliver your order, to email you about it (confirmation, dispatch and tracking), and to keep the records the law requires. Payment is taken by Stripe: we receive confirmation that you have paid, but never your full card details.
If you have an account
You sign in with a link we email to you. Your account holds your order history, the delivery addresses and designs you save, and any reminders you set. From the account pages you can download a copy of your account details, orders, addresses, saved designs, reminders and gift cards, and delete your account. For a copy of anything else we hold about you, email us. Deleting your account removes your saved addresses, designs and reminders, and your name, email address and phone number from the account. We keep past orders, including the delivery details and personalisation on them, and any reviews you have sent, for the periods set out below.
Reminders
If you ask us to remind you about an occasion, we keep its name and date and email you before it comes round each year, with a link to order again. Every reminder email has a link to stop it, and you can change or stop reminders from your account at any time.
Your basket
While you shop we keep your basket, meaning the items and their personalisation. When you go to checkout we record the email address you enter. If you tick the box asking for it, and only then, we send one email with a link back to your basket if you do not finish. No address receives more than one of these emails a month, and each one has a link to stop them.
Designs you email to yourself
If you use “Email yourself this design”, we keep the design and your email address and send you the link. If you share a design, anyone with the share link can see it until the link expires.
Photos you upload
If you upload a photo for a label or sticker, we use it only to make your order and to run the check described here. Before we save it, the photo is sent to a US-based automated image-moderation service, which checks it for us against our print rules: no sexual images, violence, hate symbols, drugs or self-harm. We do not save a photo that fails, and it cannot be printed. If a photo is refused and you think it should not have been, email us and a person will look at it. A photo that passes is saved at a public web address with a long, hard-to-guess link. It is not listed anywhere, but anyone who obtains the link can view the photo, so please do not upload a photo unless you are comfortable with that. If your photo shows other people, including children, please make sure you are entitled to share it with us.
The journal email
If you sign up on the site, we first email you a link to confirm your address, and we only add you once you use it. If you are signed in, ticking the journal box in your account details adds you straight away, because we already know the address is yours. The journal email goes out at most once a month, when there is something new to read, and every email has a link to unsubscribe. We keep a record of when you subscribed and, if you unsubscribe, a record that you did.
Gift cards
If you buy a gift card, we keep your details as the buyer and the recipient's name, email address and your message, and we email the card to the recipient. If someone has sent you a gift card, we received your name, email address and their message from them, to send you the card; we share these with Stripe to take their payment and with Postmark to send the card, and use them for nothing else.
Enquiries and messages
When you contact us, or ask about sweet cart hire or favours, we receive the details you give us by email and use them to reply and to arrange anything you book.
Reviews
If you write a review, we keep your rating, title, review and the name and email address you give. We read it before publishing it on our site with your rating, title, review and name; your email address is never published. We do not currently ask for reviews by email.
Cookies and analytics
We use the cookies the site needs to work, such as your basket and your sign-in. With your permission, we also use Google Analytics to understand how the site is used. You can change your choice at any time; our Cookies page lists every cookie.
Keeping the site working and secure
When something goes wrong on the site, an error-monitoring service records technical details of the fault, such as the page, the browser and the error. We remove cookies, sign-in details, and fields that hold email addresses or phone numbers before a report is sent, but a report can still include part of a web address or an error message. We also keep a scrambled form of your IP address, and of your email address when you sign up to the journal, for 2 days, to stop repeated misuse of forms such as sign-in, sign-up and photo upload.
Our lawful bases
| What we do | Lawful basis |
|---|---|
| Making and delivering your order, emailing you about it, and running your account and saved designs | Contract: we need the data to provide what you asked for. |
| Keeping order, payment and tax records | Legal obligation. |
| Reminder emails, the basket email and the journal email | Consent, which you give by asking for them. You can withdraw it at any time with the link in each email. |
| Google Analytics | Consent, given through our cookie banner. |
| Checking uploaded photos, preventing fraud and misuse, and fixing faults on the site | Legitimate interests: keeping the site safe and working, and not printing unlawful or harmful images. |
| Publishing a review you send us | Consent: you choose to send it, and you can ask us to remove it. |
| Replying to enquiries | Legitimate interests, or taking steps at your request before a booking. |
Who handles your data
These service providers handle personal data for us, under our instructions: Postmark, which sends our emails; Vercel, which hosts the site and stores uploaded photos, which are kept in London; Supabase, which hosts our database, also in London; the error-monitoring service and the image-moderation service described above; and Google, which provides analytics if you accept analytics cookies.
Two organisations also use the data they receive for their own purposes, under their own privacy policies. Stripe takes payments, receives the details of what is being bought (for a gift card, the recipient's details and your message), and uses payment data, for example, to prevent fraud. Royal Mail receives your name, delivery address, email address, phone number and a description of the parcel's contents and value, to deliver it and send you tracking updates.
Reviews we publish can be read by anyone. Otherwise we do not sell, rent or share your data with anyone else, unless the law requires us to.
Transfers outside the UK
Some of these providers are based in the United States or handle data there, including the image-moderation service. For each such transfer we rely either on the UK's adequacy regulations for the United States (the UK-US data bridge), where the provider is certified to it, or on the International Data Transfer Addendum to the standard contractual clauses in the provider's data processing terms. Email us for details of the safeguard that applies to a particular provider.
How long we keep it
| Data | How long |
|---|---|
| Orders, invoices and payment records, including the delivery details and personalisation on them | Six years after the end of the financial year in which you ordered, as tax law requires. |
| Uploaded photos | Until 90 days after the last order that uses them is dispatched, and never while such an order is still to be made. A photo on an order refunded or cancelled before dispatch goes 30 days after that order; one no order uses goes 30 days after upload, unless it is still in a basket, a design link or a saved design, in which case it is kept while it is there. |
| Baskets, including the email address entered at checkout | 35 days after the basket was started. |
| Designs you email to yourself, and share links, with a scrambled IP address | The link works for 14 days. We delete them 35 days after they were made. |
| Your account, saved addresses, saved designs and reminders | Until you delete them or your account. |
| The journal email | Until you unsubscribe. After that we keep your email address with a note that you unsubscribed, and a record of the emails we sent you, so that we do not email you again; ask us and we will delete them. |
| A request to stop basket emails or review requests | Kept as the minimum record we need to respect it. |
| Gift cards, including the recipient's name, email address and message | Six years after the card is used up or expires, as financial records. |
| Reviews you send us, published or not | Until you ask us to remove them. |
| Enquiries | As long as we need them to answer you and to handle any order or booking that follows. |
| Sign-in records | 30 days after the sign-in expires or is ended. |
| Links you ask for to look up an order | 7 days after the link expires. |
| The personalisation saved while you pay | 7 days if the payment is not completed; otherwise 35 days, the order keeping its own copy. |
| Links in review requests | 30 days after the link expires. |
| Scrambled IP addresses and email addresses used to limit repeated requests | 2 days. |
| Records that stop a second basket email within a month | 35 days. |
| Error reports | For the period the error-monitoring service keeps them, after which it deletes them. |
| Analytics data | As set in Google Analytics, and no longer than 14 months. |
Your rights
You can object at any time to any email we send you about ordering again, and we will stop: use the link in the email or tell us.
You also have the right to ask for a copy of your data, to have it corrected or deleted, to restrict how we use it, to object to our use of it where we rely on legitimate interests, and to receive it in a form you can take elsewhere. Where we rely on consent, you can withdraw it at any time; this does not affect anything we did before. To use any of these rights, email hello@vividdelights.co.uk. We reply within one month, as the law requires.
Complaints
If you are unhappy with how we have handled your data, please tell us first so that we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Changes to this policy
When the way we use data changes, we update this page and the date at the top.