Privacy Policy

You can browse johngodfrey.com without telling us who you are. We only collect personal information when you choose to give it - by contacting us, joining the newsletter, or placing an order. Payments are handled securely by Stripe; orders are printed and shipped by our print partner. We use privacy-friendly, cookieless analytics that can’t identify you; deeper Google Analytics is optional and stays off unless you accept it.

Depending on what you do, this may include:

• Contact form - your name, email address and message.
• Newsletter - your email address.
• Orders - your name, shipping and billing address, email, and the items ordered.

Some of this may have been provided through our previous store or mailing list and carried over to this site - it is the same information, held by the same business, for the same purposes described here.

Card payments are processed directly by Stripe, our payment provider. Your full card details are entered on Stripe’s secure checkout and are never stored on our servers - we only receive a confirmation that payment succeeded, plus the billing details needed for the order. Stripe processes this under its own privacy policy.

Our products are made to order. To print and ship your order, we share your name and shipping address with our print-on-demand fulfilment partner, who produce and deliver the item. They handle this information under their own privacy policy.

If you join the mailing list, we use your email address only to send occasional updates about new work and releases. We never sell or rent your email, and you can unsubscribe at any time.

We use two kinds of analytics. Umami is a privacy-friendly tool that runs for every visitor: it sets no cookies, stores no personal information, and records only anonymous, aggregated figures - page views, approximate region, and device/browser type. Because it can’t identify you, it needs no consent.

Separately, we offer Google Analytics (GA4) for deeper insight. GA4 uses cookies, so it is off by default - it only loads after you accept it in the cookie banner; decline or ignore the banner and it never loads at all. Your choice is remembered, and you can change it anytime via “Cookie settings” in the footer. If your browser sends a Global Privacy Control or Do Not Track signal, we treat that as a decline and don’t ask. The only other thing stored in your browser is your shopping cart, which is strictly necessary for the shop and never leaves your device. You can also use Google’s opt-out add-on at tools.google.com/dlpage/gaoptout.

By the nature of the web, a few services receive your IP address and basic request details when your browser contacts them: Stripe (payments/checkout), our print partner (fulfilment), Google Analytics (usage analytics, only after you consent), Google Fonts (the site’s typeface), and our hosting provider (which keeps standard server logs). Each operates under its own privacy policy.

We keep personal information only as long as we actually need it, and deliberately hold as little as possible.

• Orders - your full details (name, shipping address, email) are kept while we fulfil your order and through the returns/support window. After that (around 90 days) we automatically reduce the record: we drop your street address, postal code, surname and full email, keeping only a minimal token - first name and last initial, city/province/country, and a masked email - alongside the order and payment record we must retain for accounting and tax. The complete transaction always remains with Stripe under their policy.
• Contact-form messages - kept only as long as needed to answer you; the technical details we log for spam protection (such as your IP address) are removed within about 30 days.
• Newsletter - kept until you unsubscribe.

We take reasonable technical and organizational measures to protect your personal information. The site runs entirely over encrypted HTTPS; access to the admin area, where order and mailing-list details are held, is restricted, password-protected and secured with two-factor authentication; and full card details are never stored by us (see Payments). No online service can be guaranteed completely secure, but we work to keep your information safe and to limit who can access it.

Where it’s stored: your information is held in our own database on our hosting provider’s servers, which may be located outside Canada (for example, in the United States). When information is stored or processed in another country it may be subject to that country’s laws, but it remains protected under this policy and our providers’ own safeguards.

We handle personal information in line with Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA). You can ask us to access, correct or delete the information we hold about you by contacting us. Depending on where you live, you may also have rights under laws such as the EU / UK GDPR or California’s CCPA, and you may complain to your local data-protection authority (in Canada, the Office of the Privacy Commissioner).

This site is intended for a general audience and is not directed at children under 13. We do not knowingly collect their personal information.

We may update this policy as the site evolves. Any material change will be shown here with a new date at the top.

For any privacy question or request, contact us at email us or through our contact page.