Privacy policy

The Wreath Man is run by Daly Finnegan, a sole trader based at 50 Tullybroom Road, Clogher, County Tyrone, BT76 0XS, Northern Ireland, trading as The Wreath Man. Daly Finnegan is the “controller” of the personal information described here, which means responsible for deciding how it's used and keeping it safe.

For anything about your personal information, email dalyfinnegan6@gmail.com.

When you place an order: your name, email address, shipping address, what you ordered, and how much you paid. We use this to make and deliver your wreath, send your order confirmation, and deal with any questions, refunds, or problems with your order. We need it to carry out our contract with you.

Payment details: we never see or store your card details. Payments are processed by Stripe, and your card details go straight to them. Stripe shows us limited information about a payment, such as the card type and its last four digits, so we can match payments to orders and handle refunds. Stripe also runs automated fraud checks, which can occasionally decline a payment.

If you create an account: your email address, your password (stored by our account provider in a scrambled form that can't be read back, not even by us), and, if you choose to save them, your name and default shipping address. Your account also shows your order history. Accounts are optional - you can always check out as a guest.

If you use the contact form: your name, email address, and message, which are emailed to us so we can reply. We rely on our legitimate interest in answering enquiries.

If you use the chat assistant: the messages you type are sent to Anthropic, the company whose AI writes the replies. If you ask about an order, the order reference and email address you give are used to look it up. We don't keep a copy of chat conversations ourselves. Please don't share card details or other sensitive information in the chat.

Website analytics: we use Vercel Web Analytics to count page visits and see roughly where visitors come from (such as country, device type, and the website that linked to us). It doesn't use cookies and doesn't identify you personally. We rely on our legitimate interest in understanding how the site is used.

Technical information: like most websites, our hosting provider briefly logs technical details such as your IP address when you visit, to keep the site running and secure. We also use your IP address for a short time to stop the contact form and chat from being flooded with messages.

We don't sell your information, and we don't send marketing emails.

We only share your information with the services we need to run the shop. They handle it on our behalf and only for these purposes:

• Stripe - takes payments and screens them for fraud.
• Supabase - stores orders and accounts (servers in Ireland).
• Resend - sends order confirmations, sign-in emails, and contact-form messages.
• Google (Gmail) - our email inbox, where order notifications and contact-form messages arrive.
• Vercel - hosts the website and provides the analytics described above.
• Anthropic - powers the chat assistant.
• Royal Mail / Parcelforce - receives your name and delivery address so your wreath can be delivered.

The payment form also loads a typeface from Google Fonts, which means your browser contacts Google when it displays that form.

We may also share information if the law requires it, for example with HMRC.

Some of these services are based in, or process information in, the United States and other countries. When that happens, the transfer is protected by safeguards recognised under UK data protection law, such as the UK-US data bridge or the standard contractual clauses in those companies' data processing terms.

• Order records - 6 years, because UK tax rules require us to keep business records for that long.
• Your account and saved details - until you ask us to delete them. Orders you placed while signed in are still kept as order records for the 6 years above.
• Contact-form messages - only as long as we need to deal with your enquiry.

We only use what's needed for the site to work, so we don't ask for cookie consent:

• Sign-in cookies, if you sign in to an account, so the site remembers you're signed in.
• Stripe's cookies on the checkout page, used to prevent fraud.
• Your basket and your light/dark theme choice, saved in your own browser (not sent to us).

Our analytics don't use cookies.

You have the right to:

• ask for a copy of the personal information we hold about you
• ask us to correct anything that's wrong
• ask us to delete your information, including your account (we may still need to keep order records for tax purposes)
• object to, or ask us to limit, how we use your information
• ask for the information you gave us in a format you can take elsewhere

To use any of these rights, email dalyfinnegan6@gmail.com. We'll reply within one month. You can also update your saved name and address yourself on your account page.

If you're unhappy with how we've handled your information, please tell us first so we can try to put it right. You can also complain to the UK Information Commissioner's Office (ico.org.uk). If you live in Ireland, you can also complain to the Data Protection Commission (dataprotection.ie).

Our shop isn't aimed at children, and we don't knowingly collect information from anyone under 13.

If we change how we use your information, we'll update this page and the date at the top.