Privacy Policy

DROP AI CLOTHING, trading as DROP AI CLOTHING, is the data controller for the personal data described in this notice. We are responsible for deciding how and why it is used.

Data controller

DROP AI CLOTHING

Trading as

DROP AI CLOTHING

Data protection contact

support@dropaiclothing.com

We have not appointed a statutory Data Protection Officer, as we are not required to. Data protection questions go to the contact above.

• Identity and contact data: name, email address, delivery and billing address, telephone number if you give one.
• Account data: your login identifier, authentication tokens, password reset requests. Passwords are stored only as salted hashes by our authentication provider — we never see them.
• Order and transaction data: items ordered, sizes and colours, order totals, coupon or loyalty points used, delivery status, refunds and cancellations.
• Payment data: card details are entered directly into Stripe's secure payment form. We receive only a payment reference, the amount, the outcome, and limited card metadata such as the last four digits and card type. We never hold your full card number or security code.
• Custom artwork and design data: files you upload, print placement choices and instructions, and your confirmation that you hold the necessary rights.
• Communications data: contact-form messages, emails you send us, newsletter and waitlist sign-ups, stock alert requests, and marketing preferences.
• Technical and security data: IP address, browser and device information, bot-protection signals, and error diagnostics.
• Preference data: optional on-device information such as recently viewed products and style-quiz answers, stored in your browser only if you accept preference storage.

We do not ask for special category data (such as health, ethnicity, religion, political opinions or biometric data), and we do not intend to hold any. Please do not include such information in messages or artwork. If you send it to us anyway, we will handle it confidentially and delete it when it is no longer needed. Our products are not aimed at children and we do not knowingly collect data from anyone under 16.

Under UK GDPR we must have a lawful basis for each purpose. Ours are set out below.

Taking and fulfilling your order

Performance of a contract — we cannot supply goods without your name, address, email and order details.

Taking payment and preventing payment fraud

Performance of a contract, and legitimate interests in preventing fraudulent transactions and chargeback abuse.

Managing your account

Performance of a contract, and your consent where you chose to register.

Order emails (confirmation, dispatch, delivery, refunds)

Performance of a contract. These are service messages, not marketing, and cannot be switched off while an order is live.

Returns, cancellations and complaints

Legal obligation under consumer law, and performance of a contract.

Producing personalised items from your artwork

Performance of a contract, plus your consent for us to feature a design in marketing (only if you give it separately).

Marketing emails and newsletters

Your consent, which you may withdraw at any time. Where you have bought from us we may also rely on the soft opt-in for similar products, always with a working unsubscribe in every message.

Back-in-stock alerts and drop waitlists

Your consent for the specific notification you asked for. We do not use these addresses for general marketing.

Loyalty points

Performance of a contract and our legitimate interest in rewarding customers.

Bot protection, rate limiting and site security

Legitimate interests in protecting the site, our customers and our systems from abuse; and legal obligation to keep personal data secure.

Abandoned basket reminders

Your consent, given when you provide your email address and agree to a reminder. One reminder only, with an opt-out.

Accounting, tax and record keeping

Legal obligation under UK tax and company law.

Improving the site and diagnosing faults

Legitimate interests in operating a working shop. We use error diagnostics, not tracking profiles.

Where we rely on legitimate interests, we have considered your rights and interests and limited our use accordingly. You may object at any time — see your rights below.

• Marketing consent is always optional, separate from placing an order, and never pre-ticked. Refusing it does not affect your ability to buy.
• We record the date, the wording you agreed to and where you gave consent, so we can evidence it.
• Every marketing email carries a one-click unsubscribe. Withdrawing consent is as easy as giving it.
• You can also email support@dropaiclothing.com and we will remove you promptly and keep a minimal suppression record so you are not re-added.
• We do not sell, rent or share your data with third parties for their own marketing.

We share data only with service providers who process it on our instructions under a written contract, and with professional advisers or authorities where the law requires it.

We do not currently use analytics, advertising or social-media tracking providers. If that changes, we will update this notice and ask for your consent first.

Some providers above process data outside the UK. Where they do, we rely on UK adequacy regulations or on the International Data Transfer Agreement / the UK Addendum to the EU Standard Contractual Clauses, together with the provider's technical safeguards. You can ask us for details of the mechanism used for a specific provider.

Order and transaction records

6 years after the end of the tax year in which the order was placed (UK tax and accounting requirements).

Account data

For as long as your account is open, then up to 12 months after you ask us to close it, so we can handle any residual queries.

Custom artwork files

Up to 24 months after the order is completed, so we can handle reprints, returns and disputes. Deleted sooner on request where no dispute is open.

Unused artwork upload sessions

Expired automatically and cleared shortly after, if no order is completed.

Email delivery logs

Up to 24 months, to evidence that service and consent-related emails were sent.

Marketing consent records and suppression list

Kept while you are subscribed, and afterwards as a minimal record so we do not contact you again.

Contact-form messages

Up to 24 months after the matter is closed.

Stock alerts and drop waitlists

Until the notification is sent, or 12 months, whichever comes first.

Abandoned basket data

Up to 30 days, then deleted or anonymised.

Security and abuse logs

Up to 12 months.

You have the right to:

• be informed about how we use your data — that is the purpose of this notice;
• request a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have data erased where we no longer have a lawful reason to keep it (we may need to retain order records for tax purposes);
• restrict how we use your data while a concern is investigated;
• object to processing based on legitimate interests;
• object to direct marketing at any time — this is an absolute right;
• receive data you gave us in a portable, machine-readable form; and
• withdraw consent at any time where consent is our basis.

To exercise any right, email support@dropaiclothing.com. We respond within one month and will tell you if we need longer for a complex request. There is no charge in ordinary cases. We may ask you to confirm your identity so we do not disclose data to the wrong person.

• Payments are handled entirely by Stripe's hosted payment form; card numbers never reach our servers.
• Accounts and databases use row-level access controls so customers can only see their own records.
• Uploaded artwork is held in private storage that is not publicly browsable, with server-side validation of file type and size.
• The site is served over HTTPS with strict transport security and a content security policy.
• Public forms are rate limited and protected against automated abuse.
• Access to systems is limited to the people who need it.

We use a small amount of strictly necessary browser storage to run the shop, plus optional preference storage that only operates if you accept it. We do not use advertising or cross-site tracking technologies. Full details, and the controls to change your choices, are in our Cookie Policy.

If you are unhappy with how we have handled your data, please tell us first at support@dropaiclothing.com so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator: ico.org.uk, helpline 0303 123 1113.

We update this notice when our processing changes. The date at the top shows the current version. Where a change materially affects you — for example a new purpose or a new category of provider — we will tell you directly and, where the law requires it, ask for your consent.