Privacy Policy

1. Who We Are

Flying Cards is a sole trader business based in the United Kingdom. Trading address: 39 Arosa Drive, Birmingham, B17 0SB. For any privacy enquiries — including subject access, rectification, erasure, or marketing opt-out — contact hello@flyingcards.co.uk. Flying Cards is the data controller for the personal data described below.

2. What Data We Collect

• Account information: email address and password (passwords are hashed; we never see them in plaintext).
• Shipping information: name, address, postcode, and (optionally) phone number provided at checkout.
• Order history: products purchased, totals, shipping details, and tracking references.
• Support correspondence: messages you send via the contact form.
• Cookie preferences: your consent choice is stored in your browser's local storage.

3. How We Use Your Data

We use your data to:

• Process and fulfil your orders;
• Manage your account and authentication;
• Communicate with you about your orders;
• Respond to support requests; and
• Comply with our legal and tax obligations.

Our lawful bases for processing are contract performance (fulfilling your order), legal obligation (HMRC record-keeping), and legitimate interest (running the business and preventing fraud).

4. Data Sharing & Processors

We do not sell your personal data. We share it only with the following data processors, each of whom is contractually bound by UK GDPR Article 28 data-processing agreements:

• Supabase — authentication and database hosting. Data is stored in EU regions; transfers outside the UK rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
• Stripe — payment processing. Stripe is a UK GDPR processor; international transfers are covered by Standard Contractual Clauses and Stripe's UK adequacy mechanism.
• Shippo & couriers (Evri, DPD) — shipping label generation and parcel delivery. We share your name, address, and an order reference only.
• Resend — transactional email (order confirmations and shipping updates). Limited to your email, name, and order details.

5. Data Retention

We retain your account and order data for as long as your account is active or as needed to provide services. Order and tax records are kept for 6 years after the end of the relevant tax year to comply with HMRC requirements. Contact-form messages are kept for up to 12 months to follow up on support issues.

6. Your Rights (UK GDPR)

Under UK GDPR, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate data;
• Erase your data (right to be forgotten);
• Restrict or object to processing;
• Data portability;
• Withdraw any consent you have given (e.g. to receive marketing); and
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, email hello@flyingcards.co.uk. We will respond within one month.

7. Direct Marketing

We do not send promotional marketing emails. Transactional emails (order confirmations, shipping updates, and replies to your enquiries) are necessary to provide the service you have asked for. If we ever introduce a marketing list it will be strictly opt-in, and you will be able to unsubscribe at any time with one click.

8. Children's Privacy

Our products appeal to people of all ages, including children. However, accounts and purchases on this site require a debit or credit card and a delivery address, so are intended for adults (18+) or for adults purchasing on behalf of a child. We do not knowingly collect data from children under 13. If you believe a child under 13 has provided us with personal data, please email hello@flyingcards.co.uk and we will delete it.

9. Cookies

We use essential cookies for authentication and session management. We do not use third-party tracking, advertising, or analytics cookies. Your cookie consent preference is stored in your browser's local storage. If we ever add analytics or marketing cookies, they will be off by default and only set after you accept them on the consent banner.

10. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated date.