Privacy Policy

1. Who is responsible

Kathryn Barnes, trading as Fern Dale Handcrafted, operates Relic & Press and is the controller of maker account, platform billing, support and service-security information.

You run your own business and are the controller of your customer information. Relic & Press acts as your processor: we provide the account, storage and tools that let you receive orders, prepare designs and manage fulfilment. Storing and automatically handling information for those tools does not mean we routinely view your records or photos. Your own privacy notice explains how you use customer information, including any services you use outside Relic & Press. Payment providers handle payment information under their own privacy notices.

The maker account is a business tool, not a service aimed at children. Photos may show children or families and need the appropriate authority from the person submitting them. We do not use photo illustration to identify people or make biometric identity decisions.

2. Account information and your private records

Information we use to provide your account

• Account details: your name, email, sign-in identifiers, business name and subscription plan.
• Platform billing: subscription and AI-credit purchase references, amounts and payment status. Stripe handles full card numbers; Relic & Press does not store them.
• Support and service security: messages and attachments you send us, and limited technical logs needed to diagnose problems, protect accounts and keep the service working.
• AI allowance records: usage counts, credit balance and request status. An image hash helps apply generation limits; it is not a copy of the photo but may be personal information when linked to an account or order.

Information held in your account on your behalf

Your account holds the settings and business records you choose to enter, such as your branding, press measurements, products, prices, orders and bookings. Where you use customer ordering tools, it also holds the details needed for those orders: names and contact details, delivery addresses for postal orders, order and payment status, submitted photos and personalisation choices.

These are your records, not a separate customer database for Relic & Press to use. They are stored and automatically processed so your chosen tools work. We do not use them for our own marketing, sell them or make them available to other makers. Photos follow the deletion schedule below.

Shop content you deliberately publish—such as product images, wording, contact details and policies—is visible to shop visitors. Private customer photos are not public shop content.

Account information comes from sign-in, billing and your correspondence with us. Your private records come from what you and your customers submit through your tools, together with payment confirmations. Please enter only what is needed; photos and messages can contain personal or sensitive information.

3. Why we use information

We use your account details—not the contents of your customer photos—to set up your maker account, provide access and manage your subscription. Our lawful basis is contract, including steps you ask us to take before entering a contract. We also answer enquiries and provide support.

We use information to keep the service secure, resolve technical problems and manage the business on the basis of our legitimate interests, balanced against your rights and interests.

We use our own billing records to meet applicable legal obligations. Optional marketing requires an appropriate lawful basis and applicable electronic-marketing consent. A customer buying, booking or uploading a photo through your tools does not itself sign them up for marketing.

Your private customer records are handled on your instructions to make your account tools work, not for our own independent purposes. As the maker, you determine and explain the lawful basis for using those records. Optional AI photo generation requires the customer's separate permission before the selected photo is sent. We do not use permission to print an order as permission for publicity or unrelated processing.

If information needed for an order, delivery or account is not provided, the relevant service may not be possible. We will explain any new use of personal information and ensure it has an appropriate lawful basis.

4. Our photo & privacy promise

Only for your customers’ orders. Customer photos are held so you can prepare, print and press the order and deal with a necessary reprint before they expire. Relic & Press supplies the tools; we do not make or fulfil the order or routinely view its photos. They are not sold, published online or used as samples or advertising without separate written permission.

Private, not public. Customer photos are kept in private, access-controlled storage. They are not public shop images and cannot be viewed by another maker. You can see your customers’ photos to fulfil their orders. Routine storage, retrieval and deletion are automated. Limited human access for requested support or necessary security or legal handling is explained in section 6; optional AI processing is explained in section 5.

Children and families. We know many photos show children. They receive the same private handling and deletion deadlines. As the maker, you are responsible for ensuring that customers have the right and authority to use the photos they submit, including appropriate parent or guardian permission where needed.

Optional event galleries and social sharing. Each requires its own unchecked guest permission, separate from permission to fulfil the order and from marketing sign-ups. The guest must have authority from everyone shown, including a parent or guardian for children. Event galleries also require you to enable the display and approve each photo. Anyone with the event gallery link can see approved photos, but names, order details and payments are not shown. Closing the event stops the gallery. Guests can withdraw both permissions from their order page; the gallery removes the photo within 20 seconds. You must remove any social posts or external copies when asked. Permission does not extend our photo deadlines or permit you to keep downloaded photos beyond them. We retain the dated permission record with the order to evidence the choice.

Live event photos are available only until the first of these deadlines:

• 48 hours after collection;
• 24 hours after cancellation; or
• 14 days after upload if neither of the earlier deadlines has been reached. This is the final limit, including for orders that have not been collected.

Live event photos cannot be kept beyond that 14-day limit to wait for collection or finish an order.

Postal photos: a maximum of 14 days after upload, shortened to 24 hours after cancellation. Posting does not restart that 14-day clock.

Stored order photos and their derivatives follow the applicable deadline. An hourly cleanup removes expired files; permanent removal may follow the access deadline by up to one hour in normal operation. As the maker, you are responsible for responding to your customers' requests to delete photos sooner. Use the support hub if you need help removing a photo from your account. These deadlines apply to photos stored in your Relic & Press account. You must also delete any downloaded photos and print sheets within the same deadlines. Any temporary records retained by an AI provider follow that provider's arrangements, explained in section 5.

Print PDFs are prepared on your device rather than stored online by Relic & Press. You are responsible for deleting downloaded sheets and local photo copies and disposing of printed waste securely. Relic & Press cannot remotely remove files from your devices.

5. Optional AI illustrations

AI illustrations are an optional feature makers can offer to their customers. AI tools do not independently browse a maker's account or photo queue. Only when a customer chooses an offered illustration style and gives affirmative consent on their upload screen does the service automatically send that photo for illustration.

A resized copy of the customer's selected photo, together with instructions for their chosen style and backdrop, is sent through the Lovable AI Gateway to an OpenAI image model. The generation request contains only the image and prompt; it does not include the customer's postal address, email, payment details or any of your other maker order records.

The generated illustration is returned directly to the customer's screen for them to review, and is saved as an order photo in your account only if they choose to proceed with their order. Relic & Press keeps usage and credit records to track generation limits and your plan allowance; we do not keep a permanent photo library of every illustration attempt. AI providers may retain temporary logs under their service terms, which are separate from your account photo deletion schedule.

We do not use customer photos to train our own AI. OpenAI states that API data is not used to train its models by default, unless the account holder opts into data sharing. Its default abuse-monitoring logs may include submitted content and are kept for up to 30 days, with exceptions for legal requirements or protecting people and the service. This provider retention is separate from the photo deadlines above. See OpenAI's API data controls and Lovable's privacy notice for their published information.

Customers can always decline AI and place an order using their original photo, or use device-based filters (black-and-white, mono, sepia and faded film) which run entirely in their browser and never send photos to an AI service. Makers can turn off AI styles entirely or adjust generation limits per photo in their studio settings. AI illustrations are artistic representations and are not used for facial recognition or biometric identification decisions.

6. Who can see information

Your business records and customer photos are private to your maker account, except content you deliberately publish. Relic & Press does not routinely open, browse or inspect those records or photos. If you ask us for support, we may need to access the relevant information to investigate that specific problem; please share only what is necessary. Limited authorised access may also be needed to investigate a security incident or suspected abuse, or comply with the law. Access is restricted to what is necessary for that task and subject to confidentiality. Private storage is not a claim that authorised technical access is impossible.

• Lovable and its managed infrastructure providers: application hosting, database, authentication, storage, service diagnostics and AI-request routing.
• OpenAI: the selected photo and generation instructions only when the optional AI feature is used.
• Stripe: platform subscriptions/credit purchases and customer payments on the maker's connected account. Stripe also acts under its own responsibilities for fraud prevention, payment networks and regulatory requirements.
• Sign-in providers: information needed for the sign-in method you choose, under the provider's own privacy notice.
• Professional advisers or authorities: only where necessary for a lawful purpose such as legal obligations, a dispute or safeguarding.

This list describes providers involved in delivering the service; it does not mean each provider receives all the information in your account. Hosting providers store and automatically handle records so the tools work. The AI provider receives only the selected image and instructions for a generation your customer deliberately requests and consents to. Stripe and sign-in providers may be independent controllers for some of their activities. Your own privacy notice should explain any separate delivery, email or accounting services you use.

7. Security and safeguarding

Relic & Press uses encrypted connections, account-scoped access controls and private customer-photo storage. Keep credentials secure and downloaded files protected. We work with our hosting providers to protect information, although no system can guarantee complete security.

If we become aware of a personal-data breach, we will take appropriate action, notify the affected maker without undue delay where we act as processor, and provide information as it becomes available. Notifications to individuals or the regulator are made where legally required; a maker remains responsible for their own controller obligations.

Where content reasonably suggests unlawful activity or a risk of harm to a child or vulnerable person, relevant information may be disclosed to police, safeguarding services or another competent authority where lawfully necessary. We do not continuously monitor photos for emergencies and may be unable to give advance notice if it would increase a risk or is prohibited by law.

8. How long we keep other information

Photos have the short deletion deadlines described above. Your non-photo business records remain in your account to support your own fulfilment, enquiries and record-keeping. You are responsible for deciding how long your business needs those records, subject to applicable law. Relic & Press holds them on your behalf while providing the service, not as our own trading records. Separately, we retain account and support information as needed to provide and support your account, and our own subscription and credit-purchase records for applicable tax and accounting duties.

We retain information only for as long as needed for the purpose and any applicable legal duty. Contact us about retention or deletion of your platform account information, or if you need help managing records held in your account.

Cancelling a subscription stops its renewal but does not automatically delete the account or its records. Ask us about access, return or deletion of account information. Applicable rights and legal retention duties remain in force. As the maker, you handle requests about your own customer records; we will assist where necessary.

9. Cookies and device storage

We use browser storage to keep makers signed in, preserve unfinished shop changes and help customers return to their order tracker. The postal photo basket is held in device memory, not written as a photo library to persistent browser storage. Stripe may use its own payment-security and fraud-prevention storage during checkout.

Storage that is strictly necessary to provide a service you request does not require cookie consent. Optional storage, where used, requires consent unless a legal exemption applies.

You can clear or block browser storage in your browser settings. For you, this can sign you out or remove draft changes. Customers who clear or block storage may find it harder to return to their order tracker. Read third-party notices when using payment services or following external links.

10. International processing

Some service providers may process information outside the UK. Where this is a restricted transfer under UK data-protection law, an appropriate safeguard is required. This may be a UK adequacy regulation, an International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, as applicable.

Contact us for information about provider processing locations and applicable transfer safeguards. Permission to use AI is separate from the legal safeguards required for an international transfer.

11. Emails, visitor counting and business changes

Account, security, billing and requested support communications are separate from optional marketing. Customer order information is not sold, rented or used as a platform mailing list simply because someone uploads a photo or places an order. Makers are responsible for any marketing permission they obtain separately.

Our optional Relic & Press sign-up collects your email address and a dated record of your affirmative consent to maker news, tools and tips from Kathryn Barnes t/a Fern Dale Handcrafted. Consent is separate from signing up for an account or placing an order. Relic sign-ups are held separately from retail shop contacts and are not permission for unrelated shop offers. We save sign-ups first and, when a dedicated Relic list is connected, use Klaviyo to deliver marketing. We preserve existing unsubscribes and suppressions. You can unsubscribe through any marketing email or ask through the support hub. We retain consent and necessary suppression records to respect your choices and demonstrate compliance; active marketing details are kept only while needed for that purpose.

Optional website visitor counting begins only after you allow it. It records page paths without query strings, an external referring website where available, approximate country or town, device category and visit time. Connection and browser information is converted into a daily one-way identifier, not linked to your account, email or customer photos; raw IP addresses and full browser headers are not stored in the analytics record. These records can still be personal information. Consent is the basis for optional counting; necessary service-security logs are separate. We use the counts to improve the website, not to build advertising profiles. You may stop future counting through Privacy choices. We keep analytics only while needed to evaluate the site, periodically review that need, and consider erasure requests subject to applicable rights.

See our Cookies & device storage policy for the tab-session referral marker, saved privacy preference and how to change your choice. Klaviyo processes opted-in marketing contact details under its privacy notice; international processing is subject to the safeguards in section 10.

If the business is sold, merged or transferred, information needed to continue the service may pass to the new operator. We will limit any disclosure to what is needed, protect the information appropriately and explain the change to affected users. A transfer does not turn customer details into an unrestricted marketing list or remove their data-protection rights.

12. Your rights and complaints

We aim to send a first reply within 1 working day for paid Pro makers and 2 working days for other requests. Working days are Monday–Friday, excluding UK bank holidays. These are reply targets, not guaranteed resolution times; we will keep you updated if more investigation is needed. Support targets do not replace or extend the legal deadlines below.

Depending on the circumstances, you may request access, correction, erasure, restriction or portability of your data, object to processing and withdraw consent where consent is the basis. These rights are not absolute and some records may need to be retained for legal reasons.

Use the Support hub — support, data and privacy requests for requests about Relic & Press account or platform processing. You are responsible for handling requests from your customers about their records; we will assist you where necessary. We may reasonably need to confirm identity or clarify the request before disclosing information. For access requests, we carry out reasonable and proportionate searches for the personal information covered by the request; this does not remove your right of access. We normally respond within one calendar month, subject to lawful clarification and extension rules, and will explain any extension. Where you withdraw consent, this stops future processing relying on that consent, but does not make earlier lawful processing unlawful or remove a separate legal retention duty.

For a privacy complaint, use the support hub or write to the address above. You do not have to use the hub to exercise your rights; requests received by other means will also be considered. Describe what happened and the outcome you are seeking; we can help if you need assistance making the complaint. We will acknowledge it within 30 days, make appropriate enquiries, investigate without undue delay and keep you informed of progress and the outcome. You can complain to the Information Commissioner's Office at any time, whether or not you contact us first.

Optional AI illustrations are artistic outputs chosen and reviewed by customers, not automated decisions producing legal or similarly significant effects. We do not use them to determine eligibility, access to services or biometric identity.

This notice will be reviewed as the service and provider arrangements change. The date and version at the top identify the current wording. Our binding customer-data processor commitments and processing schedule are in section 5 of the Terms of Use.