Privacy policy

menubags.com is operated by Exotic Creations Ltd (“we”, “us”), a company registered in England & Wales under company number 15988286. We are the data controller for the personal data described in this notice, and our registered office is 17 Stane Street, Codmore Hill, Pulborough, England, RH20 1BB.

For any privacy question, or to exercise any of the rights set out below, email hello@menubags.com.

• Launch list email address. If you ask to be told when we open, we store the address you give us and which page you gave it on. Basis: consent, which you may withdraw at any time.
• Contact messages. If you use the contact form we store your name, email address and the message itself, so that we can reply. Basis: our legitimate interest in answering people who write to us.
• Account and order data. If you create a design or place an order we store your account email, your design, and the order and its history. Basis: performance of our contract with you.
• Payment data. Card payments are processed by Stripe. Your card details are entered on Stripe’s systems and are never received or stored by us. We receive only the outcome of the payment and a reference for it.

We do not use advertising cookies, analytics cookies, tracking pixels or cross-site trackers, and we do not profile you. Because of that there is no cookie banner on this site and no separate cookie policy — there is nothing to consent to.

The only cookies this site may set are strictly necessary ones: cookies that keep you signed in to your own account and that keep a checkout session secure. Strictly necessary cookies do not require consent under the Privacy and Electronic Communications Regulations. Stripe may set its own cookies on its checkout pages for fraud prevention; those are governed by Stripe’s privacy policy.

We do not sell your personal data and we do not share it for anyone else’s marketing. We use a small number of processors who handle data on our instructions:

• Supabase — database, authentication and file storage.
• Vercel — website hosting and delivery.
• Stripe — payment processing.
• Our manufacturer and carrier — where an order has been placed, the information needed to produce and deliver it.

We may also disclose data where we are required to by law, or to establish or defend legal claims.

Some of our processors operate outside the UK. Where personal data is transferred outside the UK we rely on UK adequacy regulations or on the International Data Transfer Agreement, or its addendum to the EU Standard Contractual Clauses, so that your data keeps an equivalent level of protection.

• Launch list addresses: until you ask to be removed, or until we have finished launching and no longer need the list.
• Contact messages: up to two years from your last correspondence with us.
• Order records: six years from the end of the financial year they fall in, because tax law requires it.
• Designs and account data: for as long as your account is open, and then for a short wind-down period.

Under UK GDPR you have the right to ask us for a copy of your personal data; to have inaccurate data corrected; to have data erased; to restrict or object to how we use it; and to receive it in a portable form. Where we rely on consent, you may withdraw it at any time without affecting what we did before you withdrew it.

Email hello@menubags.com to exercise any of these. We will respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you told us first so we can put it right.

Access to personal data is restricted at the database level, so that one customer’s data cannot be read by another. Data is encrypted in transit. No system is perfectly secure, but we take the protection of your data seriously and design for it rather than adding it afterwards.

If we change this notice we will update the date at the top of this page. If a change materially affects how we use data you have already given us, we will tell you directly.