Privacy Policy

Last updated: 5 August 2026

Modern Savage (“we”, “us”, “our”) respects your privacy. This policy explains what personal data we collect when you visit modernsavage.co, why we collect it, how we use it, and the rights you have over it. It applies whether you visit us from the UK, the US, or anywhere else. It covers the UK GDPR and the Data Protection Act 2018 for UK visitors, and the California Consumer Privacy Act as amended by the CPRA, along with the Virginia, Colorado, Connecticut, Utah and Texas state privacy laws, for US visitors.

In short

You can order from this site, so we handle order data: your name, email address, delivery address, phone number, what you bought and your order history. Card details go straight to Stripe and never reach our servers. We do not sell your data, we do not share it for advertising, and you can ask us to delete it at any time.

Data controller

The data controller for personal data collected through this site is Modern Savage Inc., a company incorporated in Delaware, USA. If you live in the UK, Modern Savage is the controller for the purposes of the UK GDPR. If you live in the US, Modern Savage is the business that determines the purposes and means of processing your personal information for the purposes of state privacy laws (such as the CCPA/CPRA).

You can reach us at support@modernsavage.co.

What we collect

• Order data: your name, email address, delivery address, phone number, the items you bought, what you paid, and whether it was a one-off or a subscription. Your phone number is collected because carriers need it for delivery notifications.
• Payment data: handled entirely by Stripe. Your full card number never reaches our servers and we never store it. We keep the Stripe reference for your payment so we can match up a refund or answer a query about it.
• Unfinished checkouts: if you ask us to email you updates when you start an order, and then do not finish checking out, we keep your email address and what was in your basket so we can send you a single reminder. Our checkout page is operated by Stripe, which tells us the checkout was not completed and passes back the email address you entered. If you did not ask for those emails, or you decline where Stripe asks the same question on its own page, no reminder is sent. Every reminder carries a one-click unsubscribe, and unsubscribing stops it immediately, including a reminder that has not gone out yet.
• Newsletter signups: your email address. If you give us your name you can, but we do not require it.
• Support messages: anything you include when you email support@modernsavage.co.
• Country cookie (ms_country2): stores your market region (“GB”, “US”, “CA” or “EU”) so we can show prices in the right currency and offer the correct shipping rate. Set on first visit based on the country our hosting provider (Vercel) associates with your IP, or by your choice in the country switcher.
• Security data: a one-way cryptographic hash of your IP address and a shortened browser User-Agent string, used for a short period to rate-limit forms and block abuse.
• Analytics: aggregated, privacy-friendly site analytics via Vercel Web Analytics. We see page views, referrer, country and device type. It sets no cookies, stores nothing on your device, and does not identify individual visitors.

Purpose of processing

We use order data to take, fulfil and support your order: to take payment, to get the parcel to your door, to email you a confirmation and tracking, to let you see your order history when you sign in, to manage a subscription, and to handle refunds, returns and queries. We are also required to keep order records for tax and consumer-law purposes.

We use your email address for direct marketing communications: product news, special offers and promotional emails about Modern Savage, but only if you asked for them. We also use personal data to reply to support messages, to keep the site secure, and to show the right currency.

Legal basis (UK visitors)

• Explicit consent, Article 6(1)(a) UK GDPR: the legal basis for sending you direct marketing emails is the explicit consent you give by entering your email in our signup form. Ticking a consent box is not required in addition because submitting the form is itself an unambiguous, affirmative act of consent made for the single purpose described at the form (joining the Modern Savage marketing list). You can withdraw that consent at any time, see “How to unsubscribe” below. Withdrawing consent does not affect the lawfulness of emails we already sent.
• Legitimate interests, Article 6(1)(f): keeping the site secure, preventing spam and abuse, and understanding which content is useful to visitors.
• Contract, Article 6(1)(b): processing the orders you place with us, taking payment, delivering them and supporting them afterwards. This does not need your consent and you cannot withdraw it while an order is live, because we cannot deliver an order without the address it is going to.
• Legal obligation, Article 6(1)(c): keeping order, payment and tax records for as long as the law requires.

Data retention

• Email address: kept until you unsubscribe, then removed (or suppressed for deliverability and to honour your unsubscribe) within 30 days.
• Support messages: kept for up to 24 months so we can help you on follow-up queries, then deleted, unless we are required to keep them longer by law.
• Security data (hashed IP): minutes only. Used to rate-limit forms, then discarded.
• Analytics: aggregated, no individual retention.
• Order data: kept for as long as required by tax and consumer law, usually 6 to 7 years from the date of the order. You can ask us to delete the rest of your account data sooner; we will keep only the minimum the law requires us to.

Your rights

Under the UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct / update data that is inaccurate or incomplete
• Delete your personal data (the right to be forgotten / right to erasure)
• Restrict or object to certain uses of your data
• Ask for a copy of your data in a portable format (data portability)
• Withdraw consent and unsubscribe at any time (see below)
• Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk

If you live in a US state with a privacy law (California, Virginia, Colorado, Connecticut, Utah, Texas, and others), you have parallel rights including the right to know / access, the right to delete, the right to correct, the right to opt out of sale or sharing (we do not sell or share your personal information, see below), and the right not to be discriminated against for exercising these rights. We honour the Global Privacy Control (GPC) browser signal as an opt-out of sale / sharing.

How to unsubscribe or exercise your rights

You can unsubscribe or withdraw consent in any of the following ways:

• click the Unsubscribe link in the footer of every marketing email we send, this is the quickest way and it takes effect immediately
• use the one-click unsubscribe option that your email client may show next to the sender name (Gmail, Apple Mail, and Yahoo support this where available)
• visit modernsavage.co/unsubscribe and enter your email
• email support@modernsavage.co from the address you signed up with

To exercise any other right (access, correction, deletion, portability, restriction, objection), email support@modernsavage.co from the address you signed up with. We will respond within 30 days (UK) or 45 days (US state laws), as required by law. In rare complex cases we may extend this by a further two months and will tell you if we do.

One limit worth stating plainly: we are required to keep basic order records for six years for tax. If you have bought from us, a deletion request cannot remove those, and we will tell you exactly what was kept and why.

Who we share your data with

We do not sell your personal data. We do not share it for cross-context behavioural advertising. We do not rent or trade your email address to third parties for their own marketing.

We use a small number of service providers (processors) who handle data on our behalf strictly to run the site and send you the emails you asked for:

• Stripe, takes your payment and runs the billing portal where you manage a subscription. Stripe is a payment processor and an independent controller of the card data it holds; see the Stripe privacy policy for what it does with it.
• ShipHero, our fulfilment platform, and the carrier that delivers your parcel. They receive the name, address and phone number needed to deliver it, and nothing else.
• Supabase (EU-hosted), stores our order and marketing databases and short-lived security data.
• Resend, sends the emails you've asked for and the ones about your order (confirmations, dispatch and tracking, sign-in links, support replies, marketing emails).
• Vercel, hosts the site and provides the cookieless Vercel Web Analytics described above.

Each of these providers is bound by a data processing agreement with appropriate safeguards. We will only disclose your data outside these processors if the law requires us to (for example a valid court order).

Data security

We take appropriate technical and organisational measures to protect your personal data:

• all traffic to and from modernsavage.co is encrypted in transit using HTTPS (TLS)
• data at rest on Supabase is encrypted using AES-256
• server-side secrets (API keys for email, database credentials) are stored as Vercel encrypted environment variables, not in source code
• access to the production database is restricted to a small number of admin accounts protected by unique, strong credentials
• form submissions are rate-limited using a hashed IP to prevent automated abuse
• a honeypot field and anti-spam checks run on every form submission
• we minimise the data we collect: for the marketing list, just your email (and optionally your name); for an order, only what is needed to take payment and deliver it

No system is 100% secure, but we follow industry-standard practices and will notify affected users and regulators of any data breach in line with UK GDPR and applicable US state law timelines.

International transfers

If you are in the UK, your data may be processed on servers in the US (by Vercel, and sometimes Supabase). Where that happens, we rely on the UK International Data Transfer Agreement, and the UK Addendum to the Standard Contractual Clauses, to protect your rights.

Cookies and similar technologies

The site sets two cookies, both of them necessary to run the shop, and no others. There is no consent banner because there is nothing optional to consent to.

Analytics. We use Vercel Web Analytics to count page views, referrer, country and device type. It sets no cookies, stores nothing on your device and does not identify individual visitors or follow you to other sites.

Advertising. We run no advertising, retargeting or marketing tags on this site at all. If that ever changes we will ask your permission first, and this page will say so before it happens.

You can block or delete cookies in your browser at any time. Doing so will not break the site, we will just need to re-detect your country on your next visit.

Children

The site is not intended for children under 13, in either the US or the UK. We do not knowingly collect data from anyone below those ages. If you believe a child has given us personal data, email support@modernsavage.co and we will delete it.

Changes to this policy

If we change this policy we will update the date at the top of the page. Material changes will be flagged in the site's announcement bar before they take effect, and, where the changes affect how we use your email, we will email you before they apply.

Contact

Questions about this policy, or want to exercise any of the rights above? Email support@modernsavage.co.