The plain-English version. The legal coverage is here too, every right under GDPR and CCPA, but we wrote it the way we'd say it out loud.
Last updated: 27 May 2026
When you buy from us, we keep what you'd expect: your name, the email you ordered with, the address we ship to, the payment confirmation from Stripe (not your card number). That's it for first-party data. We don't sell any of it. We don't share it with advertisers. We never will.
If you want it deleted, email help@casahush.com. We'll delete it within 30 days. We keep order records for 7 years because UK tax law requires it, but we'll redact identifying details on request.
| Data | Why | How long |
|---|---|---|
| Your name and shipping address | So we can post your order to the right place | 7 years (tax records) |
| Email address | Order confirmations, shipping updates, reply to your questions | Until you ask us to delete it |
| Phone number (optional) | Only if you give it, for delivery issues | Until you ask us to delete it |
| Payment confirmation token from Stripe | To match the order to the payment | 7 years (tax records) |
| Order history | So you can see what you've bought, and we can issue refunds if needed | 7 years (tax records) |
| Customer service emails | So we can find context next time you write | 3 years |
| Anonymous website analytics | To know which pages people find, what's broken | 14 months |
We use a small number of services to run the shop. Each one only sees what it needs to do its job.
That's it. No data brokers. No "marketing partners." No companies whose name you don't recognize.
We use four cookies, and only four.
casahush_cart, remembers what's in your bag between pages. Strictly necessary. No tracking.casahush_session, keeps you logged in across pages during a single browser session. Expires when you close the browser.No marketing cookies. No third-party tracking. The cookie banner you might be used to from other sites, we don't show one because we don't have anything you need to consent to beyond what's strictly necessary.
You have these rights under GDPR (if you're in the EU, UK, or Switzerland) and CCPA/CPRA (if you're in California, Virginia, Colorado, Connecticut, or Utah). They apply regardless of where you live, we extend them to all customers.
Email help@casahush.com with what you need. We don't require a form, an account login, or proof of identity beyond confirming you have access to the email the order was placed with.
We don't send marketing emails by default. If you tick the "send me notes about new releases" box at checkout, you'll get a short email roughly once a quarter, never more. Every email has an unsubscribe link. We never share your address with anyone for marketing.
Casa Hush is not directed at children under 16. We don't knowingly collect data from anyone under 16. If you believe a child has provided us data, email us and we'll delete it.
Our hosting (Vercel) and email (Resend) are US-based services. UK and EU customer data therefore travels to US servers. Both vendors are certified under the EU–US Data Privacy Framework and offer Standard Contractual Clauses (SCCs) for international data transfers. We have those agreements in place.
If we change anything material, we'll update the "Last updated" date at the top and email anyone with an active order. If you don't have an order in flight, the change appears here. We don't bury changes.
Email help@casahush.com. We read every message. Mei doesn't handle data requests (she handles the cutting and stitching), those go to Maya, Jess, or David.
Postal address for formal requests: Casa Hush Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.