Privacy Policy

Little Rose is the data controller responsible for your personal information. Our legal trading name is shown in the business details section. You can contact us at hello@littlerose.shop (or visit /contact) for any privacy questions or requests.

When you shop with us, we collect your name, email, and shipping address to fulfil your order. If you contact us, we collect your name, email, and message details. If you join the newsletter, we collect your email and opt-in preferences. Payment information is collected and processed directly by Stripe (https://stripe.com), an industry-standard payment provider - we never see or store your card details. We only receive confirmation that payment was successful.

Payments are processed by Stripe. Stripe handles your payment details and may collect technical information such as device and transaction data to detect fraud and complete the payment. If you choose Klarna (when available), Klarna processes your credit application and repayment terms directly. We receive confirmation of payment and limited transaction details (like status and amount), but we do not store full card details.

We process your data under: (1) Contract – to fulfil and deliver your order; (2) Consent – when you opt into our newsletter or optional communications (you can withdraw consent at any time); (3) Legitimate interests – to prevent fraud, keep our services secure, and improve our website; and (4) Legal obligations – to comply with tax, accounting, and regulatory requirements.

Your information is securely stored using industry-standard cloud database and hosting services that use enterprise-grade security practices to protect your data. Payment information is processed through Stripe and never stored directly by us.

We use your information to process orders, send shipping updates, and provide customer support. We also keep operational logs (e.g., order events, payment status changes, email delivery logs, and security/anti-fraud records) to keep our services reliable and secure. We do not sell your data. You may receive occasional updates about new products if you have opted into our newsletter.

We only share your data with trusted service providers acting as our processors and only to the extent necessary to provide our services. This includes Stripe for payments, Brevo for email communications, our hosting providers, and Google Analytics for website analytics. These providers are bound by contracts to protect your information and may not use it for their own purposes.

Some service providers may process data outside the UK/EEA (for example, Google Analytics or Brevo). Where this occurs, we use appropriate safeguards such as Standard Contractual Clauses (SCCs) to protect your information.

We retain order and support records for as long as necessary to fulfil your order and meet legal, accounting, or reporting requirements. Where data is held based on your consent (for example, newsletters), we keep it until you unsubscribe or request deletion.

You can request account deletion from your account page. We apply a short cool-off period before processing, and we complete deletion or anonymisation requests within one month in line with UK GDPR. If you have orders, we keep order records for accounting and fulfilment history but remove personal data where possible.

We only send marketing emails if you have opted in. Marketing emails are sent via Brevo. You can unsubscribe at any time using the link in our emails, by contacting us, or by visiting /newsletter/unsubscribe.

Under UK GDPR you have rights to access, correct, delete, restrict, or object to processing of your data, and to data portability. Where we rely on consent, you can withdraw it at any time. Contact us at hello@littlerose.shop (or visit /contact) to exercise your rights.

We use cookies to keep you logged in and provide essential site functionality. With your consent, we use Google Analytics to understand how our site is used and to improve it. For full details on how we use cookies and tracking technologies, please visit our /cookies page.

We use Google reCAPTCHA to protect our public forms from abuse. reCAPTCHA is subject to the Google Privacy Policy (https://policies.google.com/privacy) and Terms of Service (https://policies.google.com/terms).

Our services are not intended for children under 13, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

If you have concerns about how we handle your data, contact us at hello@littlerose.shop (or visit /contact). You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/.

We may update this privacy notice from time to time to reflect changes to our practices or legal requirements. We’ll indicate the latest update above.

Authorised administrators may use Google Gemini to draft product descriptions, suggest visible product details from a photo, or edit a product photo's background using either text guidance or a selected background reference image. Submitted product details and selected photos are sent to Google for processing. These are internal admin actions, not customer-facing AI features: customer accounts, orders and checkout are not submitted by these tools. Generated drafts do not automatically change published products; an administrator must review and deliberately save any descriptions or approved images before customers can see them. Administrators should not submit customer information or photos containing personal information.

Source photos and generated previews are staged in a separate private Cloudflare R2 bucket. They become eligible for deletion after 24 hours and are removed by the hourly cleanup job; outages may delay cleanup. Job inputs and results are retained in our database for recovery and become eligible for removal after seven days, while an operational usage and audit record remains. These retention periods apply to our storage, not Google's processing or retention, which is governed by the applicable Gemini API terms. Approved product images and custom reusable background images are stored in our regular shared R2 asset storage and are not covered by the 24-hour staging cleanup.

The admin product form also uses browser local storage for operational drafts and recovery, including entered product details, request identifiers and temporary image references, but not photo bytes. This storage is for administrators only and does not introduce customer tracking cookies or submit customer browsing activity to Gemini.

When you start checkout, we temporarily store your selected products, quantities, prices, options, personalisation text and font in our database so payment retries do not lose your instructions. Personalisation may include names or other personal information. This is necessary to prepare and fulfil your purchase (contract), and to reconcile payments reliably (legitimate interests); it is not used for advertising. We link the record to your account when signed in and to the Stripe checkout session and resulting order. Stripe receives an opaque reference, rather than this full temporary cart; Stripe still processes the payment and customer details needed for checkout.

Once all order items have been safely stored, we remove the duplicate personalisation from the temporary record immediately and use the order items for payment replays. The remaining completion link becomes eligible for removal after seven days. Abandoned attempts and Stripe-confirmed expired, unpaid checkouts become eligible after seven days. An hourly cleanup checks a limited batch: outages, backlogs or incomplete Stripe reconciliation can delay removal. Open checkouts, pending payments, unknown outcomes and paid checkouts whose order items are not yet safely stored are retained until resolved, rather than deleted solely because of age. Order records have their separate fulfilment and legal retention requirements.

Account deletion detaches temporary checkout records from your account and marks them for erasure. Active payment instructions may be retained only to resolve the payment and fulfil the purchase, then the temporary copy is removed. Signed-in customers can download their currently linked temporary checkout records at /api/account/checkout-data. For full data-access or erasure requests, including guest checkouts, contact hello@littlerose.shop or /contact with your checkout or order reference; we verify ownership before providing data. Please do not send card details.

Your browser cart also contains options and personalisation: the checkout cookie lasts up to seven days, while local-storage cart items older than 30 days are removed when the cart next loads. Local storage has no automatic expiry, so data may remain on a browser that is not revisited until you clear it.