Privacy policy

Last updated 26 October 2026.

This explains what personal information Epochery holds, why, who else sees it, how long it is kept, and your rights. It is written from what the site actually does. In short: we hold only what is needed to make and send what you order, there are no accounts, no tracking and no advertising, and nothing is ever sold.

Who is responsible for your information

The data controller is Christopher Hill, trading as Epochery, a sole trader in the United Kingdom, registered with the Information Commissioner's Office under number ZC270068.

For anything about your information: hello@epochery.com.

What we hold, why, and on what basis

We never send marketing, and there is no newsletter, account or login - the one email to people who asked to be told when we opened is the only exception, and it is sent once. You only give us details by placing an order, by writing to us or by asking for that email; without an order's details we cannot make or deliver it.

If you send something to someone else

They have not given us their details - you have - so we hold as little about them as we can, for as short a time as we can. Their name and address are used only to post it to them, and every email about it goes to you, never to them - except a digital card, which is emailed to them on the day you choose unless you have it sent to you to pass on yourself. Please only give us someone's details if you are sure they would be happy to receive what you are sending.

Digital cards

A digital card is a link: anyone who has it can open the card. Opening it shows the card and nothing else - not your name, email, order or what it cost. The only thing recorded is when it was first opened, shown on your order page.

Paying

You pay on Stripe's own secure page, so your card details go to Stripe and never to us. With a digital card in the order, Stripe asks for your billing address and tells us only its country; if it is outside the UK, the payment is refunded in full automatically. That is the only decision made about you without a person, and it never costs you anything.

Who else sees it

Only these companies, each only what it needs for its part, under its own data protection terms:

• Stripe - takes payment. Is sent your email, the order references and the amount.
• Prodigi (UK) - prints and posts. Is sent the name and address the parcel goes to and the print files (which include your words), and your email only when the parcel is coming to you.
• Resend - delivers our emails, so handles each email's address and contents.
• ImprovMX - forwards emails sent to hello@epochery.com to our mailbox.
• Hetzner - the server this site runs on, in Nuremberg, Germany, holds everything here.
• Backblaze - keeps encrypted copies of the nightly backup in Amsterdam, the Netherlands; they cannot read them.

NASA's JPL Horizons (opens in a new tab) is asked where the planets were on a date, by our server - it is sent the date and nothing else. Nobody is sent anything for advertising, and nothing is sold or shared beyond this list.

Outside the UK

Hetzner and Backblaze keep data in the European Economic Area, which UK law recognises as protecting it adequately. Three of these companies are American, so some information may be handled in the United States, with the safeguards UK law requires:

• Stripe and Resend are certified under the UK-US data bridge (the UK Extension to the EU-US Data Privacy Framework), and also use the UK's approved contract clauses.
• ImprovMX handles mail mostly in France, and briefly - an email is deleted once it has been passed on - with some of its sending servers in the United States; its data processing agreement with us includes the standard contract clauses with the UK's addendum to them, approved for such transfers.

How long it is kept

• Orders that are paid for: six years after the end of the tax year they were placed in, as HMRC expects business records to be kept; then your name, email, addresses and words are removed, and only the amounts stay in our accounts.
• Orders never paid for: deleted entirely 30 days after they were placed.
• Someone you sent something to: their name and address removed 30 days after delivery (anything posted but not marked delivered counts as delivered 14 days after posting), or after a cancellation or refund; their email 30 days after their digital card is sent.
• Print files: deleted 30 days after the order is delivered, cancelled or refunded.
• Reviews: until you take yours down - which you can do at any time from your order page - or the order's details are removed.
• An address given to be told when we open: deleted, with the note of which link you came from, as soon as that one email has been sent, or sooner if you ask us to take it off. The offer code in that email is kept, with nothing to say whose it was.
• Emails you send us: the note of who wrote, the subject and when, 90 days; the emails themselves stay in our mailbox while needed to deal with what you asked.
• The server's log: 30 days. Your IP address is also held in memory for a few minutes, to stop anyone overwhelming the site.
• Backups: 14 days on the server and 90 days encrypted off it, so anything removed is gone from them within 90 days.

Cookies and your browser

This site sets no cookies for visitors and runs no analytics, advertising or tracking, and loads nothing from anywhere else. Your basket and chosen language are kept in your browser's own storage, and a card's words while you write them; none of it leaves your browser until you order, and you can clear it at any time. The only cookies are the shop owner's own admin login and, while the site is a private preview before it opens, a pass for those let in with the preview password - it says only when it runs out.

Your rights

You have the right to:

• ask for a copy of the information we hold about you;
• have anything wrong corrected;
• have it deleted, where we no longer need it for the reasons above or the law to keep it;
• object to, or ask us to limit, what we do with it;
• have it sent to you, or to someone else, in a form a computer can read;
• withdraw your consent to a review at any time, by taking it down.

Write to hello@epochery.com. We will answer within one month, and it costs nothing. If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint (opens in a new tab), or 0303 123 1113 - though we would like the chance to put it right first.

Children

This shop is for adults: orders should be placed by someone aged 18 or over.

Changes

If what we do with information changes, this page changes first, with its date at the top. See also our terms of sale.