Privacy policy

Who is responsible

TonyFairytaleShop (“the shop”) is a boutique vintage storefront curated and fulfilled by Tony. The website is operated by SLAVATONE ENTERPRISE LTD.

For privacy questions or data requests, use the contact form. The trading name of the storefront is TonyFairytaleShop; the operating company is SLAVATONE ENTERPRISE LTD. Day-to-day shop curation is by Tony.

What we collect

• Orders. Email, name, phone, shipping address, order contents, and payment status so we can fulfil and support your purchase.
• Accounts. If you create an account: email, password (hashed by our auth provider), saved addresses, and order history linked to you.
• Messages. Name, email, and message text from the contact form.
• Marketing list. Email address if you join the newsletter (and when you unsubscribe).
• Checkout reminders. If you start checkout and leave items unpaid, we may email a gentle basket reminder to the address you entered — you can ignore it or use any unsubscribe link provided.
• Technical. Essential cookies for cart/session; optional analytics and ads cookies only if you accept them (see below).

Payments

Card payments are processed by Stripe. We do not store full card numbers. Stripe receives the details needed to take payment and may send its own receipt.

Services we use

We use trusted processors to run the shop:

• Supabase — database, authentication, and file storage.
• Stripe — payments and checkout.
• Resend — transactional and marketing emails (From address on our .co.uk domain).
• Vercel — website hosting.
• Google Analytics 4 and Google Ads— only if you accept optional analytics & ads cookies.
• OpenAI — used only inside the owner’s Studio to help draft product listing copy (notes/images the owner supplies). Customer contact messages and order data are not sent to OpenAI for that tool.
• Royal Mail Click & Drop — when we create a shipping label for your order (name, address, phone, item details needed to despatch).

Cookies & consent

Essential cookies keep your bag, checkout, and signed-in session working. They stay on.

Optional analytics & ads cookies (Google Analytics 4 and Google Ads tags) load only if you choose Accept analytics & ads on the cookie notice. We use Google Consent Mode so measurement stays off until you accept. You can change your mind by clearing site cookies for this domain and revisiting — the notice will appear again.

Newsletter

If you subscribe, we store your email to send occasional new-arrival notes or thank-you codes. You can unsubscribe any time via the link in those emails or this page.

How long we keep data

Order records are kept as long as needed for fulfilment, bookkeeping, and legal obligations. Newsletter emails are kept until you unsubscribe (we may retain a suppression record so we do not email you again by mistake). Contact messages are kept while useful to answer you, then removed or anonymised when no longer needed.

Your rights

Under UK GDPR you can ask for a copy of your data, corrections, or deletion where we no longer need it. Reach us via the contact form. We will respond as promptly as we can.