Privacy Policy

Last updated 7 September 2026

Piccadealy (Hoxton Vibes Ltd, a company registered in England and Wales, number 17437613, registered office 27 Old Gloucester Street, London, United Kingdom, WC1N 3AX) is the controller of the personal data described here. This policy says what we collect, why, who processes it for us, how long we keep it, and what you can ask us to do. Contact: hello@piccadealy.com.

1. Creators

• Account: your email address, your name if you give one, and the public key of any passkey you register. Used to sign you in and to send you sign-in links and service email. Basis: contract.
• Store: your handle, bio, products, prices, covers and files. Public by design, except deliverable files, which are private until bought.
• Payouts: a Stripe account is created for you. Stripe collects identity and bank details directly under its own privacy policy; we hold only the account id, its verification status, and the time and IP address at which you accepted Stripe's agreement, which Stripe requires us to keep. Basis: contract and legal obligation.
• Store drafting: if you use the wizard, your public TikTok profile and video captions, or the page you import, are sent to an AI model to draft product ideas. Nothing private is sent, and nothing is published until you approve it. Basis: your request.

2. Buyers

• Purchase: your email address, what you bought, the amount, and a Stripe payment reference. We never see your card number; Stripe takes the payment. Used to deliver the purchase, send the receipt, handle refunds, and keep the records the law requires. Basis: contract and legal obligation.
• Access links: a random token in the link we email you. Anyone with the link can open your purchase page, so keep it to yourself; you can request a fresh one from that page.

3. Visitors

• Stores set no cookies. A random session id is kept in your browser's local storage and sent with page views, card views and checkout opens, together with where the link was tapped (TikTok bio, story, QR code). This tells the creator how their store is doing. It is not tied to your name unless you buy. Basis: legitimate interest.
• Your IP address is used in memory for a short time to limit abuse (rate limiting and, where enabled, Cloudflare Turnstile). It is not stored with your visit.
• Email sign-ups: if you enter your email on a creator's card, we send one confirmation email. You join the creator's list only when you open the link in it. The creator can then email you; they, not we, decide what to send.

4. Who processes data for us

• Stripe — payments, payouts and identity verification.
• Resend — transactional email.
• Cloudflare — content delivery, file storage (R2) and, where enabled, Turnstile.
• Sentry — error reports, with personal data scrubbed.
• Google — the AI model behind the optional store-drafting wizard.

Some of these process data outside the UK. Where they do, transfers rest on the UK's adequacy decisions or standard contractual clauses.

5. How long we keep it

• Orders and payout records: six years after the transaction, for tax and dispute purposes.
• Stripe webhook payloads: ninety days.
• Creator accounts and stores: until you close them, then thirty days.
• Email sign-ups: until you unsubscribe or the creator removes you.
• Visit analytics: kept as counts; the session id is random and never joined to a name.

6. Your rights

Under UK data protection law you can ask for a copy of your data, ask us to correct or delete it, object to or restrict processing, and take your data elsewhere. Email hello@piccadealy.com and we will answer within a month. You can also complain to the Information Commissioner's Office at ico.org.uk.

7. Cookies

The creator dashboard sets one session cookie to keep you signed in. Stores and purchase pages set none. We use no advertising or tracking cookies anywhere.