PRIVACY
POLICY.

1.0 WHO WE ARE

2.0 WHAT WE COLLECT

Depending on how you interact with us, we may collect personal identifiers (name, email, phone, billing and shipping address, company name); communications (messages and emails with our team); and technical request data (IP address, browser type, pages visited) processed by our host. If you write to us through the contact form on our website, we receive the email address and message you enter and any files you attach, and your IP address is used briefly to limit how often the form can be sent. If you pay the Stitch Lab fee, we also receive the payment details Stripe shows to the businesses it serves: your name and email, the card brand, its last four digits, expiry date and country, any billing address you enter, the amount, the date and the payment status, and the IP address and other signals Stripe uses to screen payments for fraud. We never receive your full card number or security code. If you accept analytics cookies, Google Analytics also collects usage data about your visit, as described in clause 9.0.

STITCH LAB FORM

IDENTIFIERS, ORDER DETAIL, PAYMENT

CONTACT FORM

EMAIL, MESSAGE, FILES

EMAIL ENQUIRIES

CORRESPONDENCE

ANALYTICS

COOKIELESS, AGGREGATE ONLY

ANALYTICS COOKIES

USAGE DATA, ONLY WITH CONSENT

3.0 WHY WE COLLECT IT

We may use your personal data to process and deliver your orders, provide customer support, communicate updates, offers, and relevant information (if you opt in), improve our website, products, and services, and comply with legal obligations. We will not sell your personal information to third parties.

We state the lawful basis for each purpose separately.

Processing and delivering your order, taking payment, and providing support

Contract, Art. 6(1)(b)

Responding to enquiries made through the Stitch Lab form, our contact form or email, and protecting the contact form from misuse

Legitimate interest, Art. 6(1)(f)

Keeping accounting and tax records

Legal obligation, Art. 6(1)(c)

Marketing emails, where you have opted in

Consent, Art. 6(1)(a)

Improving the website

Legitimate interest, Art. 6(1)(f)

Measuring how the website is used, with Google Analytics

Consent, Art. 6(1)(a)

Where we rely on your consent you may withdraw it at any time. For Google Analytics, open the cookie settings from COOKIES at the bottom of the home page.

4.0 WHO WE SHARE IT WITH

We share your data only with the service providers who process it on our behalf, with the freight forwarders and carriers that deliver your order, which act as independent controllers under their own privacy policies, and with authorities where the law requires it. Stripe also acts as an independent controller for some purposes, as described below.

This website loads Cloudflare's analytics beacon from elsewhere, and Google Analytics only if you accept it; both are described in clause 9.0. Our main recipients are:

Cloudflare

Hosting, technical request data, contact form

Tally

Stitch Lab form

Stripe

Stitch Lab card payments

Google

Analytics, only with consent

Our manufacturing partners

Techpack, no contact details

Freight forwarders and carriers

Delivery and customs details

Cloudflare hosts this website and processes technical request data such as your IP address in order to serve pages and protect the site. It also delivers what you send through the contact form on our website: your message, your email address and any files you attach are passed on to our team as an email, and nothing you send is stored on the website. Tally hosts the Stitch Lab form on its own website, which you reach by following a link from ours; anything you enter there is submitted to Tally and passed to us. When you pay the Stitch Lab fee in that form, Stripe processes the payment: your card details go directly to Stripe, and we receive only the payment details described in clause 2.0. For some purposes, such as preventing fraud and meeting its own legal obligations, Stripe acts as an independent controller under its own privacy policy. Our manufacturing partners receive only the Techpack for your garment, from which we remove any names and contact details. The freight forwarders and carriers that ship your order receive your name, delivery address, email and phone number, and the details customs need, such as your company name, VAT number and the contents and value of the shipment, so that they can deliver it and clear it through customs. Google Ireland Limited provides Google Analytics as our processor and receives usage data only if you accept analytics cookies. We do not sell personal data, and we run no advertising or cross-site tracking.

5.0 TRANSFERS OUTSIDE THE EU

We do not transfer your personal data outside the European Economic Area, with three exceptions. If you pay the Stitch Lab fee, Stripe may process your payment data in the United States; Stripe's US company is certified under the EU-U.S. Data Privacy Framework, and Stripe's data transfer terms add the EU standard contractual clauses as a fallback. If you accept analytics cookies, Google may process the usage data collected by Google Analytics in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, which the European Commission has found to provide adequate protection, and Google's data processing terms add the EU standard contractual clauses. Delivering an order involves international freight, so the freight forwarders and carriers that deliver it may also use your delivery details outside the EEA, to transport your goods and clear them through customs. Where we ourselves pass these details to a forwarder outside the EEA, in a country the European Commission has not found to provide adequate protection, we do so under the EU standard contractual clauses, and you can ask us for a copy. If you decline analytics cookies, the only external request this website makes is to Cloudflare's cookieless analytics beacon, served by a processor already named in clause 4.0; it loads no external fonts or advertising scripts, and involves no transfer beyond our existing hosting arrangement.

6.0 HOW LONG WE KEEP IT

We keep your personal information only as long as necessary to fulfill the purposes described in this Policy or as required by law. We use appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction.

Order records, quotes, techpacks, invoices and payment records

5 years from financial year end

Enquiries that do not become orders

12 months from last contact

Marketing consents

Until withdrawn, plus 12 months

Google Analytics event data, if you accept analytics cookies

2 months

Your cookie choice, kept in your browser

12 months

7.0 YOUR RIGHTS

Under GDPR, you have the right to access, correct, or delete your personal data; to restrict or object to certain processing; to withdraw consent at any time; and to request data portability.

To exercise any of these rights, email ralfs@ashtraystudio.eu. We will respond within one month. We may ask you to confirm your identity first. Exercising your rights is free unless a request is manifestly unfounded or excessive.

8.0 COMPLAINTS

If you think we have handled your personal data improperly, please contact us first at ralfs@ashtraystudio.eu so we can try to resolve it. You also have the right to complain to the Latvian supervisory authority.

9.0 COOKIES

We measure traffic in two ways. Cloudflare Web Analytics is cookieless: it stores nothing on your device, does not fingerprint you, and does not follow you to other websites. It reports only aggregate figures, such as how many pages were viewed, which pages, which site you arrived from, and broad country and device type. None of it identifies you.

Google Analytics runs only if you accept it in the cookie banner; if you decline, it does not load at all. Once accepted, it sets two cookies, _ga and _ga_R7BSQ5ZBDX, which last up to 13 months and let Google tell a returning visit from a new one. It records the pages you view, how you arrived, and your approximate location, device and browser. Google Analytics does not log or store IP addresses, and we have switched off Google signals and advertising features, so this data is not used for advertising and is not linked to your Google account.

To remember your choice, the website keeps a small record of it in your browser's local storage for 12 months. That record is strictly necessary and is used for nothing else. You can change your choice at any time: open the cookie settings from COOKIES at the bottom of the home page. Withdrawing consent stops Google Analytics and deletes its cookies. We run no advertising and no cross-site tracking, and there is no chat widget.

10.0 CHANGES TO THIS POLICY

This policy was last updated on 4 November 2026. We may update it from time to time. We will post any changes on this page and update the revision history below.