Privacy Policy
The short version. We use your details to make and deliver your star gift, to keep your star in our register, and to answer you when you get in touch. We send offers only if you asked for them or have bought from us, and one click stops them. Google Analytics and Google Ads tags load only if you press Allow. We never sell your data.
1. Who we are
The Star Naming Co. (thestarnamingco.co.uk) is a trading name of Crowther Creative Products Limited, registered in England and Wales (company number 04994959), registered office 6 Downlands, Harrietsham, Maidstone, Kent, ME17 1LE, United Kingdom. We are the “controller” of the personal data described here: we decide how it is used and we are responsible for looking after it.
We are registered with the Information Commissioner's Office (ICO), registration number [ICO registration number].
Questions about this policy or your data: info@thestarnamingco.co.uk, our contact form, or post to the address above.
2. What we collect, why, and our lawful basis
UK data protection law says we need a lawful reason (a “lawful basis”) for each use of your data. Here is everything we collect, what we use it for, and which basis applies.
| What | Why we use it | Lawful basis |
|---|---|---|
| Website orders: your name, email address, billing address, phone number (if given), what you bought and the payment result | To take payment through our Shopify checkout, confirm your order and deal with any problem with it. Card details are handled by the payment provider at checkout; we never see or store your full card number. | Contract |
| Your dedication: the star name, personal message, occasion and constellation you choose, and the registration date | To record your star in our register, make your documents and run your star page. This is kept permanently, because that permanence is the product. | Contract |
| Delivery details: the recipient's name and postal address (and, for orders outside the UK, the customs details the carrier needs) | To print the postage label and post a printed gift pack | Contract |
| Etsy and Amazon orders: your name, delivery address, order number, what you bought and any personalisation you entered | Etsy or Amazon passes these to us so we can make and send your order. For Etsy orders our register reads the “you made a sale” email Etsy sends us, so your star can be set up automatically. We never send offers to Etsy or Amazon buyers. | Contract |
| Order emails: your email address and order details | To send your star page, documents and order updates from our register | Contract |
| Unfinished checkouts: your email address and the details you typed at checkout | If you start our Shopify checkout but don't finish paying, Shopify may send you one reminder with a link back to your cart. Every reminder has an unsubscribe link. | Legitimate interests (helping you finish an order you started) |
| E-gift recipients: their name, their email address and your name | If you use “Send their gift email” on your star page, we email the gift reveal to them. We use their address only for that gift email: they are never added to a mailing list or sent anything else. We keep a send log (date, registry number, their email and the two names) so we can limit each star to 10 gift emails and answer delivery questions. Please only enter someone's details if you're happy for us to email them your gift. If you share the gift link yourself instead (WhatsApp or copy link), the names travel in the link and we don't receive them. | Legitimate interests (delivering the gift you asked us to send) |
| Mailing list: your email address, and when and where you signed up | If you ask for the 10% code, we add you to our mailing list to send occasional offers. The code is shown on screen when you sign up. | Consent (you can withdraw it at any time) |
| Offers to customers: your email address | If you buy from our website, we may send occasional emails about our own star gifts, such as Christmas and Valentine's offers. Untick “Email me with news and offers” at checkout and we won't; every email has a one-click unsubscribe. | Legitimate interests (the “soft opt-in” for existing customers under the Privacy and Electronic Communications Regulations) |
| Enquiries about buying: your email address | If you email us asking about buying a star, we may send occasional offers on our star gifts afterwards. We'll say so when we reply, and every email has an unsubscribe link. | Legitimate interests (the “soft opt-in”) |
| Emails you send us: your email address, name and whatever you write | To answer you. Our inbox uses an AI assistant to sort incoming email and prepare draft replies (see section 4). A person reads every draft and decides what to send. | Legitimate interests (answering you and running good customer service) |
| Contact form: your name, email, order or registry number and message | To reply to you. The form uses Google reCAPTCHA to stop spam, so Google receives information about your browser and device when you use it. | Legitimate interests (answering you and keeping the form free of spam) |
| Show us your star: the photo you email us, your email address and first names | To consider and show your photo on our website, with first names only, and to send your free-star code. Please only send a photo of someone else if they are happy for it to be shown. | Consent (ask and we take the photo down) |
| Reviews: your name, email address and order reference | About a week after a website order, Trustpilot emails you on our behalf to ask for a review. You don't have to leave one. Etsy and Amazon buyers are not invited. | Legitimate interests (collecting honest feedback) |
| Where you came from: advertising tags in the link (such as utm_source) and the website that sent you | Noted on your first page view, kept in your browser for that visit only, and passed to Shopify with your order, so we know which channels lead to sales | Legitimate interests |
| Analytics and advert measurement (Google Analytics 4 and a Google Ads tag) | To count visits, see which pages are useful, and tell whether an advert led to an order. Loaded only if you press Allow (see Cookies). | Consent |
| Cookie-free visit counting (Cloudflare Web Analytics) | To count page views, referring pages and general region, without identifying you | Legitimate interests |
| Technical logs: IP address, pages requested, browser type | Kept briefly by our hosting providers to keep the site working and secure | Legitimate interests (security) |
| Accounting records: order, payment, refund and VAT records | To keep the accounts and tax records the law requires, and share them with our accountants | Legal obligation |
We don't ask for any “special category” data (such as health or religion). A dedication might mention something personal, such as a memorial for someone who has died; we use it only to make your star.
We do not sell your details or share them for anyone else's marketing. No decisions with legal or similarly significant effects are made about you by automated means.
3. A note on your star page
Your star page and certificate are reachable by anyone who has your registry number or link. That's how gift recipients view their star and how entries stay verifiable. The page shows the star name, dedication message and registration date. Please don't put anything in a dedication that you wouldn't want the recipient, or anyone they share the link with, to see. We do not publish a browsable list of dedications.
4. Who we share it with
We use a small number of companies (“processors”) to run the business. They may use your data only to provide their service to us, under contracts that protect it.
| Company | What they do for us | Where the data is |
|---|---|---|
| Shopify | Our checkout, payments, customer and mailing list, order and offer emails, some postage labels | Ireland, Canada, USA |
| Google (Workspace: Sheets, Apps Script, Gmail) | Our star register, mailing list, order emails, gift emails and Etsy order set-up | USA, EU |
| Microsoft (Microsoft 365) | Our email inbox (info@thestarnamingco.co.uk) | [UK / EU: check tenant data location] |
| Anthropic (Claude) | The AI assistant that sorts our incoming email and drafts replies for a person to check. It sees the emails you send us, not your payment details. [confirm the account is on commercial terms, so content is not used to train AI models] | USA |
| Royal Mail (including Click & Drop) | Postage labels and delivery of printed packs | UK (and the destination country's postal service for overseas orders) |
| Netlify | Website hosting and the contact form | USA |
| Google (reCAPTCHA) | Spam protection on the contact form | USA |
| Google (Analytics and Ads) | Visit measurement and advert performance, only if you press Allow | USA |
| Cloudflare | Cookie-free visit counting | USA and worldwide network |
| Trustpilot | Our review score on our pages, and review invitations | EU (Denmark) |
Etsy and Amazon are not our processors: they run their own marketplaces and are responsible for your account and the data you give them there, under their own privacy policies. We use only what they pass to us to fulfil your order.
We also share records with our accountants and professional advisers where needed, and with anyone the law requires us to (for example HMRC, or the police with proper authority).
Transfers outside the UK
Where a provider handles data outside the UK, we rely on the UK's approved safeguards: an adequacy decision (such as for the EU), the UK–US “data bridge” where the company is certified under it, or the ICO's International Data Transfer Agreement or Addendum to the EU standard contractual clauses.
5. How long we keep it
- Register entries (star name, dedication, registration date): permanently, because that's the service. You can ask us to remove one (see section 6).
- Order, payment and delivery records: six years from the end of the financial year they relate to, because UK tax and company law requires it.
- Mailing-list and offer-email addresses: until you unsubscribe. After that we keep just your email address on a “do not email” list so we never email you offers again.
- E-gift send log: 12 months from sending.
- Emails and contact-form messages: as long as we need them to deal with your question, and no longer than [2 years]; anything about an order is kept with that order's records.
- Unfinished checkouts: for as long as Shopify keeps them in our store admin.
- Show us your star photos: until you ask us to take them down.
- Google Analytics data: [14 months: check the GA4 data-retention setting].
6. Your rights
Under UK data protection law you have the right to:
- ask for a copy of the data we hold about you (a “subject access request”)
- have anything wrong corrected
- have your data deleted, including a dedication. Deleting a dedication removes the star it represents, so we'll confirm with you before we act. We may need to keep accounting records the law requires.
- ask us to restrict how we use your data, or object to us using it on the basis of legitimate interests
- object to marketing at any time; we will always stop
- receive data you gave us in a common format, or have it sent to another company
- withdraw consent at any time, where we rely on consent (this doesn't affect what we did before)
To use any of these, email info@thestarnamingco.co.uk. It's free, and we'll reply within one month. We may ask you to confirm who you are first.
7. Complaints
If you're unhappy with how we've handled your data, please tell us first and we'll try to put it right. You can also complain to the Information Commissioner's Office: online at ico.org.uk/make-a-complaint, by phone on 0303 123 1113, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
8. Cookies and similar technology
When you first visit, a bar at the foot of the page asks whether you allow Google Analytics (GA4), which counts visits and shows which pages are useful, and a Google Ads tag, which measures whether an advert led to an order. Neither is needed to buy. Press Allow or No thanks; we remember your choice in your browser (local storage).
Google's tags are not loaded at all until you press Allow: before you choose, and if you press No thanks, our pages send nothing to Google Analytics or Google Ads and no Google cookies are set. After you press Allow, the tags load on each page you visit and set analytics and advertising cookies. We do not sell this data or use it to identify you personally.
Changing your mind. Use Cookie settings (also at the foot of every page) to bring the bar back and choose again. Pressing No thanks after an earlier Allow stops the tags loading on later pages and removes Google's analytics and advertising cookies set on our site.
Things the site needs to work. Our pages keep your cart in your browser for the visit (session storage), and Shopify's checkout uses strictly necessary cookies to run the cart and take payment. We also keep a few small notes in your browser (local storage): your cookie choice, whether you've closed or used the 10% offer, and a copy of the star details you've looked up so your star page opens quickly next time. None of these are sent to anyone. Shopify's checkout pages are run by Shopify, which may set its own cookies there under Shopify's cookie policy.
Contact form. Google reCAPTCHA on our contact page sets cookies and reads information about your browser to tell people from spam robots. It loads only on that page.
Trustpilot. To show our current Trustpilot score, every page fetches it from widget.trustpilot.com when it loads. That request sends Trustpilot your IP address and basic browser information; it sets no cookies on our site. If you follow a link to Trustpilot, Trustpilot's own privacy policy applies there.
Cloudflare Web Analytics sets no cookies and stores nothing on your device. It records only page views, the page that referred you and your general region, and does not identify you or follow you across other websites.
9. Keeping it safe
Our website and checkout use encrypted connections (HTTPS). Your data is held with the providers listed above, who protect it to recognised security standards, and access is limited to the people who need it to run the business, using two-step sign-in. If something ever went wrong that put your data at risk, we would tell you and the ICO as the law requires.
10. Children
Our gifts are bought by adults. We don't knowingly collect data from children under 13. A star may be named for a child; in that case the dedication is given to us by the adult buying it.
11. Changes to this policy
If we change this policy, we'll update the date at the top of this page. If a change matters, such as a new use of your data, we'll tell customers and mailing-list members by email first.