Little Oddities Curiosities

Who the Merchant is

Little Oddities Curiosities is the data controller for this website. The Merchant can be reached through Send Word to the Merchant or via the Merchant's Instagram.

Information collected on a casual visit

The shop works without you handing over any personal information. Your Curiosity Cabinet (the items you set aside while browsing) is stored in your browser's localStorage so it stays with you between pages during your visit. This is kept only on your device and is not sent to the Merchant's server. Clearing your browser data will remove it.

Information collected when you create an account

Creating a "Recognised Traveller" account is optional. When you do, the Merchant collects:

• Your traveller name
• Your email address
• A password (stored as a salted hash — never in plain text)
• Your notification preferences (whether to be notified of Merchant's Messages about your orders)

Why: to identify you, keep your account secure, and send you order updates if you opt in.

Lawful basis: performance of a contract (your account) and your consent for optional notifications.

Who receives it: the Merchant's PostgreSQL database (G7Cloud), which hosts the customer store.

If you forget your password, the Merchant's server sends a reset link to your email address using Resend (a secure email service), but only when the Merchant has configured the Resend API key and sender address. No other shop or order emails are sent through Resend.

Why: to let you recover access to your account.

Lawful basis: performance of a contract (account security).

Who receives it: Resend (as the email delivery service) and your email provider.

Information collected during checkout

To place an order you provide:

• Your traveller name
• Your email address
• Your chosen shipping method

Payment card details are never entered on or handled by this website. After you choose to proceed, you are redirected to Stripe, which securely collects and processes your payment. The Merchant receives only the minimum information needed to fulfil your order — the contents of your basket, your shipping method, and the Stripe Checkout Session ID.

Why: to process and fulfil your order.

Lawful basis: performance of a contract (your purchase).

Who receives it: Stripe (for payment processing) and the Merchant's PostgreSQL database (G7Cloud, for order records).

Saved delivery addresses (the Traveller's Map)

You may save delivery addresses in your Keepings under "Traveller's Map". Each address includes: a label, address line 1, address line 2 (optional), city, region/county, postcode, and country. These are stored so you do not need to retype them each time you order.

Why: to speed up checkout with your preferred delivery landmarks.

Lawful basis: performance of a contract and your consent.

Who receives it: the Merchant's PostgreSQL database (G7Cloud).

You can view, edit, or remove these addresses at any time in your Traveller's Keepings.

Saved treasures (the Traveller's Satchel / Wishlist)

If you have an account, you can save treasures to your Satchel. The Merchant stores only the product IDs of the treasures you have saved, linked to your account.

Why: to remember which treasures you have set aside.

Lawful basis: your consent.

Who receives it: the Merchant's PostgreSQL database (G7Cloud).

Order history (Merchant's Messages)

Once you have placed an order, your order details — what you bought, when, the total, and the fulfilment status — are made available in your Traveller's Keepings under "Merchant's Messages". This is read directly from Stripe Checkout Sessions tied to your email.

Why: to show you the status of your treasures.

Lawful basis: performance of a contract.

Who receives it: Stripe (which stores the original checkout session) and the Merchant's PostgreSQL database (G7Cloud, for order status records).

Send Word to the Merchant

When you send a letter through the contact form, the Merchant collects the name, email address, subject, and message you write. These are delivered to the Merchant via Formspree, which forwards them to the Merchant so a reply can be sent in due course.

Why: to respond to your question or request.

Lawful basis: your consent and legitimate interests (responding to inquiries).

Who receives it: Formspree (as the email delivery service) and the Merchant directly.

Current third-party services

The shop works with the following services, each serving a specific purpose:

• Stripe — securely processes payments at checkout. Card details are entered on Stripe's hosted page and are never handled by the shop itself.
• Formspree — delivers letters sent through the contact form to the Merchant.
• Resend — sends password-reset emails to account holders (when configured).
• G7Cloud PostgreSQL — hosts the Merchant's database of customer accounts, addresses, wishlist items, and order status records.
• Google Fonts — on certain pages (the shop front, Merchant's Guide, and account pages), the Merchant loads the Caveat font from fonts.googleapis.com and fonts.gstatic.com to write in the Merchant's own hand. This is a font-delivery service and is not used for analytics or tracking.

Technical information

The Merchant's server logs store the time and date of requests, along with the IP address and browser information, in so far as it is needed to keep the shop running and secure. This is standard server logging.

Why: to operate and secure the shop.

Lawful basis: legitimate interests (operating the website securely).

Browser storage and cookies

The shop uses localStorage and sessionStorage in your browser for:

• The Curiosity Cabinet cart contents (localStorage, so it persists between visits).
• Account session tokens: your login token and basic customer info are stored in sessionStorage (lost when you close the tab) or localStorage (if you check "Remember this Traveller"), so you stay signed in.

The shop does not use analytics, advertising trackers, or third-party cookies for tracking. See Cookie Information for the full picture.

Lawful basis: legitimate interests (functional necessity) and your consent (for "Remember this Traveller").

How long the Merchant keeps your information

The Merchant keeps your information only for as long as it is needed:

• Cart contents: until you check out or clear your Curiosity Cabinet (stored only in your browser).
• Accounts: for as long as the account remains open.
• Order records: retained to fulfil and follow up on your orders, and as required for tax/financial records.
• Addresses & Satchel items: until you remove them or close your account.

You can delete your own account at any time in your Traveller's Keepings, which removes your account and all associated personal data.

Your rights

Under data protection law (including the UK GDPR), you have the right to:

• Be informed about how your data is used (this page).
• Ask for a copy of the personal data the Merchant holds about you.
• Ask for inaccurate data to be corrected.
• Ask for your data to be deleted (subject to legal obligations).
• Object to or restrict certain processing.
• Withdraw consent at any time (for example, by turning off notifications in your Preferences).

To exercise any of these rights, please Send Word to the Merchant.

Complaints

If you believe your data has been mishandled, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection supervisory authority. You may also complain to your local data protection authority if you are based outside the UK.

Changes to this notice

The Merchant may update this notice. Any changes will be posted here with an updated "last updated" reference.

Need help?

For any question about privacy or your data, please Send Word to the Merchant.