Privacy Policy

VinylArt Co is run by VinylArt Co LTD, a company registered in England & Wales (company no. 10877872, VAT no. 359629450), registered office Unit 2, 26 Hadfield Road, Cardiff, CF11 8AQ, United Kingdom. We are the "controller" of your personal data, which means we decide how it is used and we are responsible for it.

• Privacy questions and requests: privacy@vinylart.co
• ICO registration number: ZB005032

We don't have a Data Protection Officer (we're not required to), but the email above reaches the people who run the business.

• We collect what we need to make and deliver your record: your account, your order, and the music, artwork and words you put on it.
• We never see or store your card number — Stripe handles payment.
• We use AI from Anthropic and Google, plus OpenRouter and OpenAI for a few small jobs. What you type, say or upload to those tools is sent to them to get an answer.
• Files in My files (your account) are kept until you delete them or your account is closed. If you order without an account, the audio you upload is deleted 30 days after your record's audio is finished. Photos and artwork stay with your order so we can reprint or replace it. Vinnie chat logs are deleted after 30 days.
• We don't sell your data and there is nobody else's tracking on our site. We measure how the site is used ourselves, on our own servers. That includes a replay of each visit, with anything you type hidden, and we use replays only to troubleshoot technical problems and improve the site's speed. You can turn all of it off with one click under Measurement on this site (end of section 3). We only send marketing email if you ask for it.
• You can ask for a copy of your data, or for it to be deleted, at any time.

Data protection law says we need a legal reason ("lawful basis") for each use. The ones we rely on are: contract (we need it to do what you asked), legal obligation (the law makes us keep it), legitimate interests (a reasonable business need that doesn't override your rights — you can object), and consent (you said yes, and you can change your mind).

Your Account

• What: name, email address, password (stored only as a one-way scrambled "hash" — we can't read it), and optionally your mobile number. Your preferred country, currency and language. Your store-credit balance and history. Saved delivery addresses.
• Why: to let you sign in, save designs, check out and see your orders.
• Legal reason: contract.

Signing in by Text Message

• What: if your account has a mobile number — including one you gave us for delivery on a past order — you can sign in with a 6-digit code we text to it. We store the code only in scrambled form, it works for 5 minutes, and we store the time it was sent.
• Who sends it: our own workshop system, using Twilio (see section 4).
• Legal reason: contract (keeping your account secure).

Your Order

• What: your name, delivery address (also used as billing address), email, phone number if you give it, what you ordered (product, options, design preview, track list), the price, any discount or gift card, and a Stripe payment reference. Records of tax (VAT) on the sale.
• Why: to make your record, take payment, ship it, deal with problems or returns, and keep the accounts.
• Legal reason: contract; and legal obligation for tax records.
• Do you have to give it? We need your name, email and delivery address to take an order — without them we can't make or send your record. Your phone number is optional (carriers use it if there's a delivery problem).

Payment

• Card details are entered into a secure form provided by Stripe and go straight to Stripe. They never touch our servers. We receive only a payment reference, the amount and the email on your account. If you top up store credit, Stripe also keeps a customer profile with your name and email so it can match top-ups to your account.
• Fraud checks: Stripe automatically screens payments for fraud and may decline one without a person reviewing it. If that happens to you, email us — a real person will look at it, you can explain, and you can challenge the decision.
• Legal reason: contract; legitimate interests (preventing fraud).

The Music, Artwork and Words on Your Record

• What: audio files you upload, the tracks you choose from our music search, images and photos you upload, text you add (names, dates, dedications), and images you create with our AI artwork tools.
• Why: to design, master and cut your record.
• Legal reason: contract.
• Please only upload photos and recordings of other people if you have their permission. If a photo shows someone's face we treat it with care, but we don't use it to identify anyone.

Vinnie (Our Assistant) — Text and Voice

• What: what you type or say to Vinnie and Vinnie's replies. If you're signed in, Vinnie also knows your first name and country, and — only if you ask about an order — that order's number, status, dates, tracking link and the town and country it's going to (not your street address, email or phone).
• Voice: when you tap the microphone, the recording is sent to Google (or OpenAI as a backup) to be turned into text. Your browser's own speech recognition also shows live captions while you speak; in Chrome that is provided by Google. We don't save the audio — only the resulting text.
• Why: to answer your questions and help you design and order.
• Logs: we keep a log of Vinnie conversations for 30 days so we can fix problems and improve answers, then it's deleted automatically.
• Legal reason: contract when you're using Vinnie to design or order; legitimate interests for the 30-day log.
• Other people in what you upload: photos, voices and names of other people (a wedding song, a message from a grandparent) are processed on the basis of our legitimate interest in making the record you asked for. You confirm at checkout that you have their permission, and we use their data for nothing else.
• Vinnie is an AI. It can make mistakes. It doesn't make decisions about you that have a legal or similarly significant effect — it can't, for example, refuse your order or change a price.
• AI providers: Anthropic, Google, OpenRouter and OpenAI process what we send only to give us an answer. Under our agreements with them they don't use it to train their AI models.

Feedback

• What: after delivery, Vinnie may ask how your record turned out. Anything you choose to tell us (a rating and a comment) is saved with your account.
• Why: to improve our work. We don't publish it. Legal reason: legitimate interests.

Reviews and Showing Your Record

• If you leave a review on Trustpilot, Trustpilot is responsible for that review. We may show your review (your display name, photo if you set one, rating, date and text) on our website.
• We'd love to show off the records we make. We only show a photo, 3D render or artwork of your record on our website or social media if you ticked the box to say we can. You can change your mind at any time and we'll take it down.
• Legal reason: consent (showing your record); legitimate interests (showing public reviews).

Your Visit to the Website

• What: your IP address (the number that identifies your internet connection), browser type, and the pages you request.
• Why: to show prices in your currency and the shipping options for your country (we look up your country from your IP address on our own server, using country data from IPinfo — we don't send it anywhere or store the result against you), to keep the site secure and working, and to stop abuse.
• Legal reason: legitimate interests.
• We do not use Google Analytics, advertising pixels or anyone else's tracking or profiling tools.

How We Measure the Site (Our Own, Nobody Else's)

• What: a random visitor number and visit number (two cookies, below), the pages you view, where your visit came from (a search, one of our ads and its click code, a link), your country, region and approximate town (worked out from your IP address on our server, using location data from DB-IP; the IP address itself is not stored), your type of device and browser, how fast pages load, errors the site hits, and the steps you take in the designer and checkout — for example that you opened the designer, added a record to your cart, started checkout or paid — and the order a visit led to.
• Never: your name, email, address or phone number, your photos or your audio. For the boxes you fill in, we note only whether each one was filled, never what you typed.
• Replays: on every visit we also record a replay of how the pages were used: what was on screen, clicks, scrolling and mouse movement. We use replays only to troubleshoot technical problems and to improve the site's speed: a button that doesn't respond, a page that breaks or loads slowly, a step where something goes wrong. They are never given to an advertising company, never used to target ads, and never used to build a profile of you. Anything typed into the site is hidden in a replay, and so are the words in checkout, your account and chats with Vinnie. Card details go into our payment provider's own secure box, which is never recorded, and the photos and audio you upload and the designer's preview aren't recorded either. Replays are kept for up to 90 days, then deleted.
• Why: to find what's broken or slow and fix it, to understand which pages and designer steps work, and to know which of our ads lead to sales.
• Who sees it: only us. It is written on our own server and read by our own marketing system; no other company receives it.
• How long: the individual events 90 days, a one-line summary of each visit 25 months (so we can compare one Christmas with the next), and after that only totals.
• Turning it off: use “Turn off measurement” under Measurement on this site, just below this section. From then on nothing is set, sent or recorded for that browser (we remember the choice with one cookie).
• Legal reason: legitimate interests (running and improving the shop). You can object at any time with that link or by emailing us.

Cart Reminders

• What: if you start a checkout, give us your email and then leave without ordering, we may send you up to three short emails about that cart (about an hour, a day and three days later) with a button that takes you back to it.
• They stop as soon as you order, and every one has an unsubscribe link that stops them for good. They are about your cart only, never offers or other products.
• We keep a record of which reminders went out and whether a cart was later ordered, so we never send one twice and know whether they help.
• Legal reason: legitimate interests; you gave us your email in the course of buying from us.

When You Contact Us

• What: whatever you send us by email or message, including photos of a damaged record.
• Why / legal reason: to help you — contract, or legitimate interests if it isn't about an order.

Marketing

• We only send marketing emails if you opt in, and every email has an unsubscribe link. Account and order emails (like "your record has shipped") aren't marketing and you'll get them regardless. Legal reason: consent.

Data We Get from Other Places

• Trustpilot: if you review us there, we collect your public display name, profile photo, rating, date and review text from Trustpilot, and may match the review to your order so we can show the record you're talking about.
• Stripe and carriers: whether your payment went through, and tracking updates for your parcel.
• Our previous website: see section 10.

Children

• You must be 18 or over to place an order (see our Terms). Our site isn't aimed at children and we don't knowingly collect data from anyone under 13.

Our Legitimate Interests, in One Place

Where we rely on legitimate interests, they are: keeping the site secure and preventing fraud and abuse; fixing problems and improving Vinnie (the 30-day logs); showing prices and shipping for your country; understanding feedback about our records; showing public reviews; and defending legal claims.

We don't sell your personal data. We share it only with companies that help us run VinylArt Co, under contracts that require them to protect it and use it only for us, or where the law requires it.

If we ever sell or restructure the business, your data would pass to the new owner under this same policy.

Our servers are in Germany. The UK recognises the EU as giving adequate protection, and the EU recognises the UK, so data moves between them without extra paperwork.

Some of the services in section 4 are in the USA:

• Google, Stripe and Twilio are certified under the UK Extension to the EU–US Data Privacy Framework, which the UK government has approved as giving adequate protection.
• Anthropic, OpenAI and OpenRouter are protected by contracts using the International Data Transfer Addendum approved by the UK regulator (and the European Commission's standard contractual clauses for EU customers).
• Royal Mail and UPS receive your delivery details because you've asked us to send your record to that address, and international carriers must pass customs details to the destination country.

Email us if you'd like a copy of the safeguards we use.

Cookies are small files a website saves in your browser. We only use ones the site needs to work or that remember a choice you made. We don't use anyone else's analytics or advertising cookies, and nothing on our pages reports to Google, Meta or any other tracker. We measure our own site ourselves (see “How we measure the site” in section 3), and the “Turn off measurement” switch under Measurement on this site (end of section 3) stops it. The one extra thing: if you arrive from one of our ads or a tagged link, we remember that for 90 days so we can tell which ads led to a sale. That is the only tracking on the site and it is ours alone. For an order that came from a Google ad, we tell Google Ads which of its ad clicks led to it and the order's value; nothing else about you. Visitors who find us any other way have nothing saved.

Cookies

Things saved in your browser (not cookies, never sent to us automatically)

You can delete all of these in your browser settings; the site will just forget your choices and sign you out.

Your right to object. Where we use your data because of our legitimate interests (section 3), you can object at any time and we'll stop unless we have a strong reason that outweighs your interests (for example, investigating fraud). If you object to marketing, we always stop.

You also have the right to:

• Get a copy of the personal data we hold about you.
• Correct anything that's wrong.
• Delete your data. We'll delete everything we don't have to keep by law — for example, we must keep records of your order for tax purposes, so those stay for the period in section 6.
• Restrict how we use your data, for example while we check something you've told us.
• Take your data elsewhere (data portability) in a common format.
• Withdraw consent any time, e.g. to marketing emails or to showing your record. This doesn't affect anything we did before you withdrew it.
• Ask a person to review any decision made automatically about you (see "Fraud checks").

To use any of these, email privacy@vinylart.co from the email address on your account (so we know it's you). It's free. We'll reply within one month. If we need to check who you are or what you're asking for, that month starts once you've told us; for complicated requests we may need up to two more months and will tell you why.

If you're unhappy with how we've handled your data, you can complain to us at privacy@vinylart.co. We'll confirm we've received your complaint within 30 days, look into it properly, and tell you the outcome without undue delay.

You can also complain to the UK regulator, the Information Commission (formerly the Information Commissioner's Office) — ico.org.uk, 0303 123 1113. If you live in the EU you can complain to the data protection authority in your country — in Spain, the Agencia Española de Protección de Datos (aepd.es).

If you bought from us through our previous website, we've brought your customer account (name, email address, phone number and addresses) and your order history across, so you can sign in and see your past orders. We didn't bring over your password — you'll set a new one the next time you sign in — or old design files. We didn't bring over any marketing preferences either: if you'd like marketing emails from us, you'll need to opt in again. Accounts that were incomplete, duplicates or clearly not real customers were not moved and have been deleted. Our legal reason for moving your account and orders is our legitimate interest in continuing to serve you and keep our order records; everything in this policy applies to your data in the same way.

Our site uses encryption (HTTPS) everywhere. Passwords are stored as one-way hashes. Card details never reach us. Access to customer data is limited to the people who need it to make and ship your record, and admin areas require sign-in. No system is perfect — if something goes wrong that puts you at risk, we'll tell you and the regulator as the law requires.

We'll update this page when things change, and change the date at the top. If a change is significant we'll tell you by email or on the site before it takes effect.

VinylArt Co LTD, Unit 2, 26 Hadfield Road, Cardiff, CF11 8AQ, United Kingdom. Email: privacy@vinylart.co