Legal
Privacy Policy
Plain English, because a privacy policy nobody can read is not consent.
Who we are
Gayo Wild Ltd (registered in England and Wales, company no. 16652264; registered office: Unit 17, The Water Gardens, London W2 2DA, United Kingdom) is the controller of the personal data described here. Contact: support@gayowild.com.
What we collect
- When you order: your name, email, delivery address and order contents. Payment is handled entirely by Stripe — we never see or store your card number.
- Your Gayo Wild Circle account: every order makes you a member, and you can also join without buying. We keep your name, email, member number, stamp card, the offers you have used, the devices you are signed in on, and your birthday if you choose to add it (day and month only, never the year).
- How you sign in: if you choose a password, it is stored only as a one-way scrambled form by Supabase, so nobody, including us, can read it. When you set one, only the first five characters of a scrambled form of it are sent to the free Have I Been Pwned service to check it has not appeared in a data breach; the password itself never leaves our server. If you sign in with Google or Facebook, we receive only your name, email address and an account ID from them. We never receive your password for those accounts, your contacts, photos or posts, and we do not use Facebook or Google advertising tools.
- When you contact us or report a problem: your name, email, message and any photo you attach.
- When you leave a review: your name, email and the review itself. Your email is never published.
- When you join the mailing list: your email, and only if you tick the box. It is never ticked for you, and nothing is sent until you confirm your address from the email we send.
- A record of your choices: each time you agree to, or stop, our emails, we note when, where and the exact words you saw, so we can always show what you agreed to.
Why we collect it
- To fulfil your order and run your account (our contract with you): delivery, tracking, receipts, your stamp card and offers.
- To answer you and put problems right (our legitimate interest in looking after customers).
- To check reviews are genuine (our legitimate interest, and our duty under consumer law).
- To email you news and offers, only with your consent, or — if you have bought from us — about our own coffee, unless you ticked “No thanks” in the basket. Every email has a one-click unsubscribe.
- To keep sales records (a legal obligation).
What we never do
We do not sell data to anyone, ever, and we do not use it for advertising profiles. We never add people who bought from us on Amazon or Etsy to our mailing list.
Who processes it
- Stripe — payments, saved cards and receipts. Stripe is PCI-DSS Level 1 certified.
- Supabase — our database, hosted in London, which also checks passwords and Google or Facebook sign-ins.
- Google and Facebook (Meta) — only if you choose to sign in with them: they confirm who you are and share your name and email with us, under their own privacy policies. You can disconnect them at any time under Privacy in your account.
- Google Customer Reviews — after checkout Google may ask, in its own window, whether you would like to rate your purchase. Only if you say yes does Google receive your email address, order number, country and expected delivery date, and email you one short survey, under Google's privacy policy.
- Resend — sends the emails the website itself sends: sign-in codes, order and despatch emails.
- Klaviyo — our newsletters and member emails, only for people who have agreed to them.
- Cloudflare — a check on sign-up forms that you are a person, not a robot.
- Royal Mail — your delivery address, so your parcel arrives.
- Some of these companies are based in the United States. Where your data leaves the UK, it is protected by the safeguards UK law requires, such as the UK–US data bridge or the UK’s standard contract clauses.
How long we keep it
Order records for six years, because UK tax law requires it. Enquiries for two years. Your Circle account until you delete it, which you can do yourself in one step. Mailing-list subscriptions until you unsubscribe. The record of your email choices for as long as we might need to show what you agreed to, including after you delete your account. Reviews stay published until you ask us to remove them.
Your rights
Under UK GDPR you can ask for a copy of your data, ask us to correct it, or ask us to delete it. If you have a Circle account, you can download everything we hold and delete your account yourself, under Privacy in your account. Otherwise email support@gayowild.com and we will action it within 30 days. You can also complain to the Information Commissioner's Office at ico.org.uk.
Cookies and local storage
We do not set any tracking cookies, and there is no consent banner on this site because there is nothing to consent to. Your basket is kept in your browser's own local storage, which never leaves your device and is not readable by us.
When you sign in, we set two strictly necessary cookies: one that keeps you signed in for 30 days (it cannot be read by the page), and one that only tells the page you are signed in. Signing out removes both. Signing in with Google or Facebook also sets a short-lived cookie for up to ten minutes, so the sign-in can only be completed in the browser that started it. Starting a checkout sets a similar cookie for up to six hours, so that only the browser that placed the order can add a password to the new account from the thank-you page. The account page remembers in your browser how you last signed in, to offer it first next time.
Stripe sets its own cookies once you reach the checkout, which it uses for fraud prevention. That happens on Stripe's pages, under Stripe's privacy policy.