Privacy Policy

Last updated: 5 September 2026

1. Who we are

vtstr is the controller of the personal data described in this policy. Questions or requests: support@vtstr.com.

2. What we collect

• Account data: your email address, name and password (stored securely, never in readable form).
• Profile data: phone number and delivery address, if you choose to save them.
• Order data: the items, quantities, totals and status of your orders.
• Messages: what you send us through forms or by email, including large-order enquiries.
• Technical data: basic data needed to serve the website and keep it secure, such as IP address and browser type.

3. Why we use it and our legal basis

• To create and run your account and to process and deliver your orders: performance of a contract.
• To send account emails such as address confirmation and password reset: performance of a contract and our legitimate interest in keeping accounts secure.
• To respond to your enquiries: our legitimate interest in running our business.
• To keep the website secure and prevent abuse: legitimate interests.
• To meet legal, tax and accounting obligations: legal obligation.

We do not sell your personal data and we do not use it for automated decision-making.

4. Who we share it with

We use trusted service providers who process data on our behalf: Supabase (account database and authentication), Resend (transactional email), and Cloudflare (website hosting and delivery). They may process data outside the UK; where they do, we rely on appropriate safeguards such as the UK International Data Transfer Addendum or an adequacy arrangement. We may also share data with delivery partners to fulfil your order, and where the law requires.

5. How long we keep it

We keep account and profile data while your account is open. Order records are kept for as long as needed for accounting and legal purposes, typically six years. Enquiries are kept for as long as needed to deal with them. You can ask us to delete your account at any time.

6. Your rights

Under UK data protection law you have the right to access your data, correct it, have it erased, restrict or object to its use, and receive a portable copy. To exercise these rights, email support@vtstr.com. We will respond within one month.

If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to put things right first.

7. Cookies and similar technologies

See our Cookie Policy.

8. Security

We use industry-standard safeguards, including encrypted connections and access controls that limit each customer to their own data. No system is completely secure, so please use a strong, unique password.

9. Changes

We may update this policy and will post the new version here with a new date.