Privacy notice

Who controls your information

The Fashion of Hair Ltd, trading as Quote To Tee, is the data controller. Our company number is 15640346 and our registered office is 124 City Road, London, EC1V 2NX, United Kingdom.

For privacy questions or requests, email hello@quotetotee.com.

What we collect

• the public X post URL, post text and handle you import, plus the words and design choices you select;
• your name, email, phone number and delivery address when you check out;
• Stripe session, payment and order identifiers, payment status and amount — not your full card details;
• Printful production identifiers, product choices, delivery status and carrier tracking;
• technical request data and a one-way hashed identifier used to prevent checkout abuse;
• cookie-free usage signals: a random per-visit identifier, general page type, referrer hostname, campaign labels and key steps such as loading a post, preparing a design or trying checkout;
• if you have not opted out and start checkout, a temporary link between that visit identifier and our internal order ID, used only to measure aggregate source-to-purchase conversion;
• messages and evidence you send when asking for support.

Why we use it

Contract

To create the design you request, take payment, make and deliver the t-shirt, show your order record, and provide support.

Legal obligations

To keep tax, accounting and transaction records and respond to lawful requests.

Legitimate interests

To secure checkout, prevent duplicate or abusive requests, troubleshoot fulfilment, protect legal rights, and understand aggregate product usage so we can improve reliability and the checkout journey.

Consent

We will ask separately before sending optional marketing. We do not currently use order data for marketing.

Who receives it

We share only what is needed with service providers that help run the order:

• Stripe for checkout, payment and payment records;
• Printful and delivery carriers to make and deliver the personalised t-shirt;
• OpenAI Sites and Cloudflare to host and secure the website, database and print file;
• Resend to send order-confirmation and dispatch emails; email open and click tracking is not used for our product analytics;
• Google Fonts to supply the site typefaces; your browser may send ordinary technical request data such as IP address and user agent;
• X when you ask us to retrieve a public post or interact with the @quote2tee bot; and
• professional advisers, insurers, payment-dispute services or authorities where reasonably necessary or legally required.

Some providers may process information outside the UK. Where UK data-protection law requires it, we rely on the provider’s approved transfer safeguards.

How long we keep it

Unpaid checkout

Up to 30 days

Paid order record

Up to 7 years for fulfilment, tax, accounting and legal claims

Frozen print file

The same period as the associated order record

Public X lookup cache

Up to 30 days

Shareable design link

Up to 12 months

Rate-limit record

Normally about 30 minutes

Raw usage analytics

Up to 90 days, after which it is deleted

Email delivery payload

Up to 90 days after it is sent or permanently fails; a minimal non-content idempotency key may be retained with the order record to prevent duplicate messages

Support messages

Only as long as reasonably needed for the issue and related legal obligations

We may keep limited information longer where a dispute, legal hold or law requires it.

Shareable links

Bot design links are unlisted rather than access-controlled: anyone who has the link may view the public-post text and design. Do not put private or sensitive information in a design.

Your order-record link contains the design and fulfilment status. It does not display your delivery address or payment-card details, but you should still keep that link private.

Your rights

Depending on the circumstances, you may ask for access, correction, deletion, restriction, portability, or object to our use of your personal information. You may also complain to the UK Information Commissioner’s Office.

We do not use order data for automated decisions or behavioural advertising. Our analytics event rows do not use cookies or contain the words you type, your email, address, payment identifiers or private order/design links. Unless you opt out, the random visit hash is temporarily linked to an internal order ID when checkout starts so we can report aggregate conversion; that bridge is deleted within 90 days. Stripe may use essential checkout technology on its hosted payment page.

Public-post authors and takedowns

A customer may submit text from a public post. If your words or handle appear in a design link and you want us to investigate or remove it, email hello@quotetotee.com with the URL and enough information to identify the content. We will assess the request and applicable rights.