Privacy Policy

Last updated: 13 October 2026

Modern Savage (“Modern Savage”, “we”, “us” or “our”) respects your privacy. This Privacy Policy (“Policy”) explains what personal data we collect when you visit modernsavage.co (the “Site”), why we collect it, how we use it, and the rights you have over it. It applies whether you visit us from the UK, the US, or anywhere else, and it covers the UK GDPR and the Data Protection Act 2018 for UK visitors and US state privacy laws (including the California Consumer Privacy Act as amended by the CPRA, and comparable laws in Virginia, Colorado, Connecticut, Utah, Texas, and other states) for US visitors.

In short

You can order from this Site, so we handle order data: your name, email address, delivery address, phone number, what you bought, and your order history. Card details go straight to Stripe and never reach our servers. We do not sell your data. If marketing cookies are on we tell Meta which pages and products you look at, what you put in your basket, when you start a checkout, when you sign up and what you buy, so we can measure our advertising. In the United States they are on from your first page, with a notice that lets you opt out in one press. Everywhere else, including the UK, Europe and Canada, they are off until you turn them on. Wherever you are, we honour the Global Privacy Control signal as an opt-out, and nothing goes to Meta once you have opted out. You can change that, or ask us to delete your data, at any time.

Data controller

The data controller for personal data relating to new UK orders placed with Modern Savage Ltd on or after 2 October 2026 is Modern Savage Ltd (company number 17395103), at 1 Sans Walk, London EC1R 0LT. Modern Savage Inc., a company incorporated in Delaware, USA, remains the controller for personal data relating to US orders and existing UK orders and subscriptions that remain with it. Both companies use shared website, order database and email systems to handle customer service, orders and marketing communications, as described below.

You can reach us at support@modernsavage.co.

UK representative

Modern Savage Inc.’s representative in the United Kingdom for the purposes of Article 27 of the UK GDPR is Modern Savage Ltd (company number 17395103), at 1 Sans Walk, London EC1R 0LT. You may contact our representative about our processing of your personal data and your rights under UK data protection law by writing to that address or emailing support@modernsavage.co, marked for the attention of the UK representative.

What we collect

• Order data: your name, email address, delivery address, phone number, the items you bought, what you paid, and whether it was a one-off purchase or a subscription. Your phone number is collected because carriers need it for delivery notifications.
• How you reached us: with an order we keep the page you checked out on, any campaign tags on the link you followed, the name of the site or app that sent you (such as google.com, never the full address), the first page of your visit, which advertising networks’ click markers were on it (by name only) and when the visit began. We use it to see which adverts, emails and sites lead to orders.
• Payment data: handled entirely by Stripe. Your full card number never reaches our servers and we never store it. We keep the Stripe reference for your payment so we can match up a refund or answer a query about it.
• Unfinished checkouts: if you ask us to email you updates when you start an order, and then do not finish checking out, we keep your email address and what was in your basket so we can send you a single reminder. Our checkout page is operated by Stripe, which tells us the checkout was not completed and passes back the email address you entered. If you did not ask for those emails, or you decline where Stripe asks the same question on its own page, no reminder is sent. Every reminder carries a one-click unsubscribe, and unsubscribing stops it immediately, including a reminder that has not gone out yet.
• Newsletter signups: your email address. You can give us your name, but we do not require it.
• Product reviews: if you review something you bought, using the link we email you after it has been dispatched, we keep your rating, what you write and the name you choose to show (made from your first name and initial), linked to your order. A review is published under the product only after we have read it.
• Support messages: anything you include when you email support@modernsavage.co or use our contact form.
• Country cookie (ms_country2): stores your market region (“GB”, “US”, “CA” or “EU”) so we can show prices in the right currency and offer the correct shipping rate. Set on first visit based on the country our hosting provider (Vercel) associates with your IP, or by your choice in the country switcher.
• Security data: a one-way cryptographic hash of your IP address and your browser's User-Agent string (which names the browser and device type). We use the hash to rate-limit forms and block abuse, and we keep both with a newsletter or Founding Tribe sign-up, a handbook request or a contact message as a record of where it came from. We never keep your IP address in readable form for this. Advertising is the exception and it is described next.
• Advertising data, and only while marketing cookies are on (see Cookies below for when that is): which pages and products you look at, what you add to your basket, when you start a checkout, when you sign up and what you buy, together with the two Meta cookies (_fbp and _fbc) that let Meta match an order back to an advert. Sent to Meta as described below, which for that purpose means your IP address and browser User-Agent go unhashed, because Meta will not accept them any other way.
• Analytics: aggregated, privacy-friendly site analytics via Vercel Web Analytics. We see page views, referrer, country and device type. It sets no cookies, stores nothing on your device, and does not identify individual visitors.

Purpose of processing

We use order data to take, fulfil and support your order: to take payment, to get the parcel to your door, to email you a confirmation and tracking, to let you see your order history when you sign in, to manage a subscription, and to handle refunds, returns and queries. We are also required to keep order records for tax and consumer-law purposes.

We use your email address for direct marketing communications: product news, special offers and promotional emails about Modern Savage, but only if you asked for them. We also use personal data to reply to support messages, to keep the Site secure, and to show the right currency.

We use product reviews to collect customer feedback and, where published, help other customers understand their experiences of our products.

Legal basis (UK)

• Consent, Article 6(1)(a) UK GDPR: the legal basis for sending you direct marketing emails is the explicit consent you give by entering your email in our signup form. Ticking a consent box is not required in addition because submitting the form is itself an unambiguous, affirmative act of consent made for the single purpose described at the form (joining the Modern Savage marketing list). You can withdraw that consent at any time, see “How to unsubscribe” below. Withdrawing consent does not affect the lawfulness of emails we already sent.
• Contract, Article 6(1)(b): processing the orders you place with us, taking payment, delivering them and supporting them afterwards. This does not need your consent and cannot be withdrawn while an order is live, because we cannot deliver an order without the address it is going to.
• Legitimate interests, Article 6(1)(f): keeping the Site secure, preventing spam and abuse, understanding which content is useful to visitors, and collecting, checking and publishing customer reviews to help other customers make informed choices.
• Legal obligation, Article 6(1)(c): keeping order, payment and tax records for as long as the law requires.

Data retention

• Email address: kept until you unsubscribe, then removed (or suppressed for deliverability and to honour your unsubscribe) within 30 days.
• Support messages: kept for up to 24 months so we can help you on follow-up queries, then deleted, unless we are required to keep them longer by law.
• Security data: the hashed IP used to rate-limit forms is deleted within three days. The hashed IP and User-Agent kept with a sign-up or support message are deleted along with that record: within 30 days after you unsubscribe for a sign-up, and after 24 months for a support message, unless we are required to keep them longer by law. Any record kept solely to honour your unsubscribe does not include these security identifiers.
• Analytics: aggregated, no individual retention.
• Order data: kept for as long as required by tax and consumer law, usually 6 to 7 years from the date of the order. You can ask us to delete the rest of your account data sooner; we will keep only the minimum the law requires us to.
• Product reviews: published reviews are kept while the product is on sale and for up to two years afterwards, or until you ask us to remove them. Unpublished or rejected reviews are deleted after 12 months, or sooner where no longer needed. Any health information is removed promptly. Linked order details follow the order data retention period above.

Your rights under the UK GDPR

If you are in the UK, you have the right to:

• Access the personal data we hold about you and receive a copy of it;
• Correct / update data that is inaccurate or incomplete;
• Delete your personal data (the right to be forgotten / right to erasure);
• Restrict or object to certain uses or processing of your data;
• Data portability: receive your data in a structured, commonly used, machine-readable format;
• Withdraw consent and unsubscribe at any time (see “How to unsubscribe” below);
• Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

US state privacy rights

If you live in a US state with a comprehensive consumer privacy law, including California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, and other states such as Oregon, Montana, Tennessee, Iowa, Delaware, Indiana, New Jersey, New Hampshire, Minnesota and Maryland, you have rights over your personal information. What is covered varies by state, but these generally include:

• Know / access. Confirm whether we process your personal information, and get the categories and the specific pieces we hold, where we got them, why we collected them, and who we disclose them to.
• Correct personal information that is inaccurate.
• Delete your personal information, subject to legal exceptions, for example the order records we are required to keep for tax and consumer law.
• Data portability. Get a copy in a portable, readily usable format.
• Opt out of sale, sharing or targeted advertising. We do not sell your personal information. We do share browsing and purchase activity with Meta for advertising measurement, which California law calls cross-context behavioural advertising. For US visitors this is on from the first page, with a notice offering an opt-out. Your privacy choices at the bottom of any page, the Opt out button on that notice, or a Global Privacy Control signal from your browser turns it off, and it takes effect straight away. That is how you opt out of sharing. You do not need an account and we do not ask you to verify who you are to use it. You may also click on “Do Not Sell/Do Not Share My Personal Information for Cross-Context Behavioral Advertising” to modify your settings.
• Limit the use of sensitive personal information, where applicable. We do not use sensitive personal information for anything beyond providing our products and services.
• Non-discrimination. We will not deny you goods or services, charge you a different price, or give you a lower standard of service because you exercised a privacy right.
• Appeal. Where the law requires it you can appeal our decision on a request, and if the appeal is refused you can contact your state attorney general.

Universal opt-out signals. We honour the Global Privacy Control (GPC) browser signal as an opt-out of sale and sharing. If your browser sends it, the Meta pixel is never loaded and we send Meta nothing from our servers either. The advertising option is locked off while the signal is being sent, so nothing you or we click can turn it back on, and a yes you gave us before you switched the signal on is overridden. We may still ask you about analytics, which is measurement rather than sharing. Our statement of support is published at modernsavage.co/.well-known/gpc.json.

California “Shine the Light”. Under California Civil Code § 1798.83, California residents can ask about disclosures of personal information to third parties for those third parties’ own direct marketing purposes. Our sharing of personal information is described below. You can turn off sharing with Meta at any time with Your privacy choices (outside the United States, Cookie choices) at the bottom of any page.

Authorised agents and verification. You can use an authorised agent to make a request for you, with proof of authority. We take reasonable steps to check who you are before we answer, usually by confirming you control the email address on the account or the order.

How to unsubscribe or exercise your rights

You can unsubscribe or withdraw consent in any of the following ways:

• Click the Unsubscribe link in the footer of every marketing email we send. This is the quickest way and takes effect immediately;
• Use the one-click unsubscribe option your email client may show next to the sender name (Gmail, Apple Mail and Yahoo support this where available);
• Visit modernsavage.co/unsubscribe and enter your email; or
• Email support@modernsavage.co from the address you signed up with.

To exercise any other right (access, correction, deletion, portability, restriction, objection, appeal), email support@modernsavage.co from the address you signed up with. We will respond within 30 days (UK) or 45 days (US state laws), as required by law. In rare complex cases we may extend this, by a further two months in the UK or a further 45 days in the US, and we will tell you if we do.

Who we share your data with

We do not sell your personal data. We do not rent or trade your email address to third parties for their own marketing.

We share browsing and purchase activity with Meta for advertising measurement (“cross-context behavioural advertising” under California law) only while marketing cookies are on. In the United States that is on until you opt out; everywhere else it is off until you choose it. The full list of what Meta gets is below, and you can turn it off at any time with the privacy choices link at the bottom of any page, which is also how you opt out of sharing.

Modern Savage Ltd and Modern Savage Inc. share customer data through their shared website, order database and email systems. The same team handles customer service, order handling and marketing emails for UK and US customers. Modern Savage Inc. therefore continues to access UK customer data for these purposes, including from the United States. Marketing emails are sent only where you have asked to receive them.

We also use the following seven service providers (processors) who handle data on our behalf strictly to run the Site, fulfil your orders, answer your messages and send you the emails you asked for. They act on our instructions and nothing more:

• Stripe: takes your payment and runs the billing portal where you manage a subscription. Stripe is a payment processor and an independent controller of the card data it holds; see the Stripe privacy policy for what it does with it.
• ShipHero: our fulfilment platform, along with the carrier that delivers your parcel. They receive what they need to pack and deliver it: your name, delivery address, phone number and email address, and the items in your order and their prices.
• Supabase: stores our order and marketing databases and security data.
• Resend: sends the emails you've asked for and the ones about your order (confirmations, dispatch and tracking, sign-in links, review requests, automatic replies to support messages, marketing emails).
• Microsoft 365: runs our support inbox, support@modernsavage.co, where your emails to us and our replies are kept.
• ManyChat: runs our automatic replies on Instagram. If you ask for the handbook in an Instagram message, it passes us the email address you give it.
• Vercel: hosts the Site and provides the cookieless Vercel Web Analytics described above.

Where these providers act as our processors, their processing is governed by a data processing agreement and they may not use that data for their own purposes. Where a provider acts as an independent controller, its own privacy policy explains its processing. Apart from the sharing described in this Policy, we will only disclose your data outside them if the law requires us to (for example a valid court order).

Meta. Meta is not a processor for us. It decides for itself what it does with what it receives, so it is an independent controller and the relationship runs on Meta's own business tools terms rather than on a data processing agreement.

Only while marketing cookies are on, Meta receives:

• which pages and products you look at, what you add to your basket, when you start a checkout, when you sign up and what you buy, including the order value, currency and items;
• a one-way hashed version of your email address, first name, last name, town, postcode and country, which means Meta can match you to an account it already has but cannot read any of it as text; and
• your IP address and browser User-Agent unhashed, along with the two Meta cookies _fbp and _fbc. Meta requires these in the clear and rejects them hashed.

If you decline or opt out, or your browser sends a Global Privacy Control signal, Meta receives nothing at all, from your browser or from our servers.

Data security

We take appropriate technical and organisational measures to protect your personal data:

• All traffic to and from modernsavage.co is encrypted in transit using HTTPS (TLS);
• Data at rest on Supabase is encrypted using AES-256;
• Server-side secrets (API keys for email, database credentials) are stored as Vercel encrypted environment variables, not in source code;
• Access to the production database is restricted to a small number of admin accounts protected by unique, strong credentials;
• Form submissions are rate-limited using a hashed IP to prevent automated abuse;
• A honeypot field and anti-spam checks run on our newsletter, handbook and contact forms; and
• We minimise the data we collect: for the marketing list, just your email (and optionally your name); for an order, only what is needed to take payment and deliver it.

No system is 100% secure, but we follow industry-standard practices and will notify affected users and regulators of any data breach in line with UK GDPR and applicable US state law timelines.

International transfers

If you are in the UK, your data may be accessed and processed in the US by Modern Savage Inc. and processed on servers in the US by several of the providers above. For transfers from Modern Savage Ltd to Modern Savage Inc., we rely on the UK International Data Transfer Agreement entered into between the companies. For transfers to our service providers, we rely on the safeguards in that provider's data protection terms, such as the UK International Data Transfer Agreement, the UK Addendum to the Standard Contractual Clauses or the UK Extension to the EU-US Data Privacy Framework, to protect your rights.

For further information or a copy of the relevant transfer safeguards, please email support@modernsavage.co.

Cookies and similar technologies

Two cookies are necessary to run the shop. Anything beyond those is optional. In the United States it is on from your first page, with a notice that lets you turn it off in one press. Everywhere else, including the UK, Europe and Canada, it is off until you say otherwise, and the banner asks on your first visit. You can change your mind at any time with Cookie choices (called Your privacy choices in the United States) at the bottom of any page. Your account has no sign-in cookie: the link we email you carries a secure token instead.

Analytics. While analytics is on, we use Vercel Web Analytics to count page views, referrer, country and device type. It sets no cookies, stores nothing on your device and does not identify individual visitors or follow you to other sites. If you decline or opt out, the script is never loaded at all.

Advertising. We advertise on Meta, which owns Facebook and Instagram. While marketing cookies are on we load the Meta pixel, which sets _fbp and _fbc and reports what you look at, add to your basket, start to check out, sign up for and buy. We also send the same events from our own servers, so a purchase still counts if your browser blocks the pixel or you close the tab on the way back from payment. The full list of what Meta gets is under Who we share your data with above. If you decline or opt out, the pixel is never loaded and we send Meta nothing from our servers either.

Do Not Track. There is no uniform standard for the browser “Do Not Track” signal, so this Site does not respond to it. We do honour the Global Privacy Control signal, as described under US state privacy rights above, and that one is recognised by law in California.

Outside the United States, nothing optional runs until you answer the banner.

You can block or delete cookies in your browser at any time. Doing so will not break the Site, we will just need to re-detect your country on your next visit.

Children

The Site is not intended for children under 13, in either the US or the UK. We do not knowingly collect data from anyone below that age. If you believe a child has given us personal data, email support@modernsavage.co and we will delete it.

Changes to this Policy

If we change this Policy we will update the date at the top of the page. Material changes will be flagged in the Site's announcement bar before they take effect, and, where the changes affect how we use your email, we will email you before they apply.

Contact

Questions about this Policy, or want to exercise any of the rights above? Email support@modernsavage.co.