Privacy Policy

Who we are

Timbermere Studio is a trading name of Fast Forex (“we”, “us”), a sole trader and the data controller for the personal information described here. We're a single-maker workshop based in Selby, North Yorkshire, United Kingdom.

• Registered trading address: Unit 16 Selby Business Park, Oakney Wood Road, Selby, North Yorkshire, YO8 8LZ
• Email: studio@timbermere.com
• WhatsApp (messages only): +44 7915 084868

What we collect

We collect only what we need to take and fulfil your order, and to answer you when you get in touch:

• Order details — your name, delivery address, email address, what you bought, and any notes you add at checkout. Checkout is handled by our payment provider, Snipcart; your card payment is processed by their payment partner. We never see or store your full card details.
• Correspondence — if you email us or message us on WhatsApp, we keep your message and how to reach you, so we can reply and resolve your query: your email address, or on WhatsApp your phone number, your profile name and photo, and anything you send us there, such as photographs or voice notes.
• Newsletter — if you subscribe to our workshop letter, your email address, so we can send it. You confirm your subscription by email (double opt-in) and can unsubscribe from any letter.
• Emailing your saved boards — if you ask us to email your favourites from the Favourites page, your email address and the pieces on your list at that moment, so we can send you that one email. It doesn't sign you up to anything: the workshop letter is a separate box, unticked unless you tick it.
• Service enquiries — if you ask us to quote for the Refresh Service, your name, email address, what you tell us about the board, and photographs of your property. Two things are worth knowing about the photographs. Your browser resizes and re-saves each one before it is sent, which removes the location data a phone normally embeds — so we never receive the coordinates of where the picture was taken. And they are only ever attached to the email that reaches the workshop: they are not uploaded to our website or stored in our content system.

Site analytics (with your consent) — if you accept analytics in our cookie notice, we use Microsoft Clarity for anonymous session insights (heatmaps and recordings, with form fields and the checkout masked) to improve the site. It doesn't collect your name or email and isn't used for advertising — see our Cookie Policy.

Visitor statistics (no cookies) — we count page views and everyday shop actions using Umami and Cloudflare Web Analytics: which pages get read, which parts of the shop get used (such as items added to the bag), which site or search engine sent you, roughly which country you're in, and how quickly pages render. This sets no cookie, stores nothing on your device, doesn't identify you, and doesn't follow you to other sites. Because it sets no cookie, the cookie notice's Reject doesn't govern it — our basis is legitimate interests, and you have the right to object. There is a switch that stops it on our Cookie Policy page; we remember that choice and won't ask you to make it twice.

Advertising measurement (with your consent) — we advertise on Google. If you choose Accept all in our cookie notice, Google's tag records that a visit came from one of those adverts, and tells us if it ended in an order — with the order number and total, never your name or address. It is how we tell whether the advertising is worth paying for. We have switched off Google's advertising-audience collection, so it isn't used to profile you or to show you adverts elsewhere. Choosing Analytics only or Reject means none of it loads — see our Cookie Policy.

Advertising on Pinterest (with your consent) — we also advertise on Pinterest. If you choose Accept all, Pinterest's tag records the pages you view here and the pieces you add to your bag, and, if you buy, the order number, the value of the goods and which pieces they were. That tells us whether a Pinterest advert led to an order, and lets Pinterest show our adverts, on Pinterest, to people who have visited the site. It never receives your name, email address or delivery address. Choosing Analytics only or Reject means none of it loads — see our Cookie Policy.

Why we use it, and our lawful basis

• To process and deliver your order and provide customer service — performance of our contract with you.
• To keep business and tax records — compliance with a legal obligation.
• To keep the website secure and working — our legitimate interests in running the shop safely.
• To assess your board and quote for restoring it — steps taken at your request before entering into a contract, and then performance of that contract if you accept the quote.
• To show a before-and-after photograph of your board publicly — your consent, asked for separately and only after the work is done. We never assume it, saying no changes nothing about your restoration, and you can change your mind later.
• To send our workshop letter, if you've subscribed — your consent, which you can withdraw at any time by unsubscribing.
• To email you the list of saved boards you asked for — doing what you asked us to. We send it once and don't keep the email or your address.
• To ask, after delivery, how your order is getting on and whether you’d write a review — at most three short emails, the same for every buyer and never with an offer — our legitimate interests in hearing how our pieces do and in honest reviews for other buyers. You can object at any time: reply “no thanks”, or use the link at the foot of the email, and they stop.
• To understand and improve how the site is used, if you accept analytics — your consent, which you can withdraw any time via Cookie settings.
• To count page views, see which pages are worth keeping, and check the site is fast enough — our legitimate interests in knowing what it's actually doing. This sets no cookies and identifies nobody. You can object at any time with the switch on our Cookie Policy page, and we stop.
• To see whether a Google advert led to an order, if you choose Accept all — your consent, which you can withdraw any time via Cookie settings. This is a separate answer from analytics; agreeing to one never agrees to the other.
• To see whether a Pinterest advert led to an order, and to let Pinterest show our adverts on Pinterest to people who have visited, if you choose Accept all — your consent, which you can withdraw any time via Cookie settings.

Who we share it with

We share your information with the providers that help us run the shop and, only if you choose Accept all, with the advertising platforms we use:

• Snipcart — checkout and payment processing.
• PayPal — product pages load PayPal’s own instalment message, so PayPal sees that a page was opened (including your IP address) even if you never use it. It has to come from PayPal because PayPal is the lender and the wording is theirs by law. It sets no cookie on our site, and it is the only outside script here that isn’t held back until you choose — payment information at the till, rather than measurement. PayPal is a separate controller for it, under its own privacy statement.
• Delivery couriers — to ship your order to you.
• WhatsApp — if you message us there, WhatsApp (part of Meta) carries the conversation, end-to-end encrypted, and runs your own WhatsApp account as a separate controller under its own privacy policy. The chats themselves are kept on the workshop’s own devices. We use WhatsApp only to answer you: no broadcasts, no marketing, and its business AI and advertising features are switched off. If you’d rather not use it, email us instead.
• EmailOctopus — our newsletter provider (EU-hosted), which stores subscriber details (your email, and your first name if you share it) and sends the letter. Only if you subscribe.
• Reviews — if you leave one, the display name you choose and your words are published on the product’s page (that’s their purpose). The link to your order is kept privately for verification. See the review policy.
• Microsoft Clarity — anonymous session analytics (heatmaps and recordings), processed by Microsoft as our processor. Only if you accept analytics cookies; Microsoft may process data outside the UK under standard contractual clauses.
• Umami and Cloudflare Web Analytics — cookieless visitor statistics, processed as our processors. No cookies, nothing stored on your device, and nothing that identifies you.
• Google — we advertise on Google, and if you choose Accept all we load Google’s tag so we can see whether an advert led to an order. Google then receives that you visited and what you bought, along with your IP address. We have switched off Google’s advertising-audience collection, so this is used to count sales, not to profile you or follow you around other sites. Nothing loads and nothing is sent unless you accept advertising cookies. Google Ireland Ltd is a separate controller for it, under its own privacy policy.
• Pinterest — we advertise on Pinterest, and if you choose Accept all we load Pinterest’s tag. Pinterest then receives the pages you view, the pieces you add to your bag and, if you buy, the order number, goods value and pieces, along with your IP address and browser details — never your name, email or address. It uses this to tell us whether an advert worked and to show our adverts on Pinterest to people who have visited. Nothing loads and nothing is sent unless you accept advertising cookies. Pinterest Europe Ltd decides how it uses that data, under its own privacy policy.
• Service enquiries — an enquiry and its photographs travel through Resend, our transactional email provider, into the workshop’s Google Workspace mailbox, where the maker reads them. Nobody else receives them. They are not sold, not shared with anyone else, not used for advertising, and not used to train any AI system.
• Your saved boards, by email — when you ask for it, the email goes through Resend too, to the address you give and nobody else. Your address isn't added to any list unless you tick the workshop-letter box.
• Ewald’s emails after an order — the review emails go through Resend as well, to the address on your order, which is looked up when each one goes and never kept with them. A copy goes to the workshop’s Google Workspace mailbox, so that your reply finds the conversation.
• Our hosting and infrastructure — Railway (hosting), Cloudflare (security/delivery), and Sanity (content). These handle the running of the site, not marketing.

We never sell your personal data. It is used for advertising only in the ways described above, and only if you choose Accept all: Google counts whether an advert led to a sale and is never used to aim adverts at you; Pinterest does the same and may also show our adverts, on Pinterest, to people who have visited. Nothing you send us — an enquiry, a photograph, a message — is ever used for advertising, and an order reaches an advertising platform only as its number, goods value and pieces.

We do allow AI systems to read the writing we publish on this site — that is what it is for. That permission has nothing to do with anything you send us: your photographs, messages and details are never part of it.

Where your data is processed

Some of these providers may process data outside the UK. Where they do, appropriate safeguards (such as UK ‘adequacy’ decisions or standard contractual clauses / the UK addendum) are in place to protect it.

If you message us on WhatsApp, WhatsApp’s service is provided from the United States, so your account details and the record that our conversation happened are processed there, under the safeguards WhatsApp sets out in its own policy. The messages themselves are end-to-end encrypted.

To be specific about the one that involves photographs: a Refresh Service enquiry is handled by Resend and by Google Workspace, both US companies, so your message and its photographs are processed outside the UK under those safeguards. If you would rather they weren't, email us instead of using the form and we'll work out another way. The same goes for an email of your saved boards, and for Ewald’s emails after an order: Resend sends them, under the same safeguards.

If you accept advertising cookies, Pinterest may also process what its tag receives in the United States, under the safeguards Pinterest sets out in its own policy.

How long we keep it

We keep order and transaction records for around six years, to meet UK accounting and tax rules. Enquiry emails are kept only as long as needed to deal with your query.

With an order’s records we also keep a note of the review emails: which went and when, whether each was delivered, any line Ewald added just for you, the delivery day he confirmed, when you replied, and any request to stop them — never your address, which stays with the order at Snipcart. Resend keeps its own delivery record of each email for 30 days and then deletes it.

If you email yourself your saved boards, we keep no copy of the email and no record of your address — only, for at most a day, a one-way scrambled form of it in the server's memory, so that one inbox can't be sent a flood of them. Resend, which sends it, keeps its delivery record for 30 days and then deletes it.

WhatsApp chats are deleted from our devices 1 year after the last message, unless a chat records the terms of an order or a commission, in which case it is kept with that order’s records.

A Refresh Service enquiry — your name, email, what you told us and the details of the job— is kept for 1 year after the job is closed, then deleted. Your photographs are not kept separately at all: they exist only as attachments on the email, and go when that correspondence goes. If we've asked and you've agreed to us publishing a before-and-after picture, that one photograph is kept for as long as it's published — tell us at any time and we'll take it down.

Your rights

Under UK data-protection law you have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected;
• ask us to delete data, or restrict or object to how we use it;
• ask for your data in a portable format, where applicable.

To exercise any of these, email studio@timbermere.com. If you're unhappy with how we handle your data, you can complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last reviewed.