Privacy Policy

This Privacy Policy explains how Dear Milo ("Dear Milo", "we", "us", "our") collects, uses, stores, and protects your personal information when you use dearmiloshop.com (the "Site") or buy our products. We are the data controller for the personal information described in this policy.

Identity and contact details

• Trading as: Dear Milo
• Privacy contact: [email protected]

If you live in the UK or EU, this policy meets our obligations under the UK GDPR, the Data Protection Act 2018, and the EU GDPR. If you live in California, see "Notice for California Residents" below.

What we collect and why

• Identity and contact data (name, email, billing and shipping address) — to fulfil your order and send confirmations. Lawful basis: performance of a contract (Article 6(1)(b) UK GDPR).
• Order details (items, customisation, pet name) — to produce your custom product. Lawful basis: contract.
• Pet photos (images you upload) — to generate your AI preview and produce the embroidery design. Lawful basis: contract.
• Payment information (card last 4 digits, transaction ID) — to process payment. We never see or store full card numbers; Stripe handles this. Lawful basis: contract / legal obligation.
• Account information (email, hashed password, order history) — if you create an account. Lawful basis: contract / consent.
• Marketing preferences — only if you opt in. Lawful basis: consent (Article 6(1)(a) UK GDPR).
• Technical data (IP address, browser, device, cookies) — security, fraud prevention, analytics (with consent). Lawful basis: legitimate interest / consent.
• Communications (emails, support) — to respond to you. Lawful basis: legitimate interest.

We do not collect special category data. Please don't include any in messages or photos.

Pet photos and AI processing

When you upload a photo, it is sent to a third-party AI image-generation provider to generate your design preview, and stored with our cloud storage provider (EU-hosted). To fulfil your order, your design is then shared with our fulfilment partners — for printed items, via a time-limited secure link. Once your order is fulfilled, we keep the photo for 90 days in case you reorder or query the order. You can request earlier deletion.

We do not use your pet photos to train any AI model.

By placing an order you grant us permission to use your pet photo and the resulting design in our own marketing and social media. We rely on our legitimate interest in promoting our products for this, and you can object and opt out at any time — before or after your order — by emailing us. We'll stop using it in new marketing within 30 days.

Who we share your data with

We share data only with vetted service providers. Each provides UK GDPR-compliant Standard Contractual Clauses (SCCs).

• Stripe — payment processing (UK, EU, US). PCI-DSS Level 1.
• Cloud database & storage provider — database, authentication and file storage (EU — Frankfurt).
• AI image-generation provider — creates your design preview (EU and US).
• Embroidery fulfilment partner — production and shipping of embroidered items (US and EU).
• Print fulfilment partner — production of printed items; receives your design and a time-limited (7-day) secure link to your source photo (US and EU).
• Website hosting provider — hosts the Site (US with EU edge).
• TikTok / Meta / Google Ads — advertising, only with your marketing consent.

We do not sell your data.

How long we keep your data

• Order records: 6 years (required by HMRC).
• Pet photos: 90 days after order fulfilment.
• Account data: while active + 2 years of inactivity.
• Cookie consent records: 12 months.

Your rights

Under UK and EU GDPR you have the right to: access, rectify, erase, restrict, object, port your data, withdraw consent, and lodge a complaint with the ICO (ico.org.uk). Email [email protected] to exercise any of these. We respond within 30 days.

Marketing & UGC consent

We send marketing emails only to people who sign up for them (for example, via the discount signup on our site) and to customers about similar products, always with a one-click unsubscribe in every email. You can opt out at any time.

Placing an order grants us a non-exclusive, royalty-free licence to use your pet photo and design in marketing. This is separate from email marketing above and does not require you to opt into emails. You can opt out at any time by emailing us; we'll remove the content from new uses within 30 days.

Security

We protect your data with HTTPS/TLS 1.3 encryption in transit, encryption at rest, hashed passwords (Argon2), row-level access controls on our database, webhook signature verification on payment events, and rate limiting on sensitive endpoints.

Children

Dear Milo is not directed at children under 16. If you believe a child has given us their data, email us and we'll delete it.

Notice for California Residents (CCPA / CPRA)

We do not sell your personal information. We do not share your personal information for cross-context behavioural advertising unless you've consented through our cookie banner. You have the right to know, delete, correct, and limit use of sensitive personal information. Email [email protected] to exercise these rights.

Contact

[email protected]