Last updated: 6 August 2026

Privacy Policy

1. Who is responsible for your data

The data controller is MintedFlow, trading as MintedFlow("we", "us"), a UK-registered business based in the United Kingdom.

Contact for privacy matters: hello@mintedflow.com
ICO registration number: ICO registration in progress

This policy explains what personal data we collect, why, how we protect it, and your rights.

2. What data we collect

Depending on how you use MintedFlow, we may collect:

Order and account data: your name and email address, and a record of what you purchased.
Payment data: processed by Stripe. We receive confirmation of payment and limited details (such as the last four digits of your card and billing country); we do not receive or store your full card number.
Communications: emails you send us for support.
Technical and usage data: basic analytics such as pages visited, approximate location (from IP), device/browser type, collected to run and improve the site.

3. Why we use it, and our lawful basis

What we do	Lawful basis (UK GDPR)
Process your order and deliver your download	Performance of a contract with you
Provide support and handle refunds/complaints	Performance of a contract / legitimate interests
Keep records for tax and accounting	Legal obligation
Site analytics, security, and fraud prevention	Legitimate interests (running a secure, functioning shop)
Send marketing emails (only if you opt in)	Consent (you can withdraw at any time)

4. Marketing

We will only send you marketing emails if you have opted in, or where the law otherwise allows it for existing customers about similar products. Every marketing email has an unsubscribe link, and you can opt out at any time by emailing us.

5. Who we share data with (our processors)

We use trusted third-party services to run MintedFlow. Each acts as our processor or as an independent controller for their part:

Stripe — payment processing.
Supabase — database and secure file storage (hosted in the UK/EU).
Vercel — website hosting and delivery.
Resend — transactional/order emails.
Vercel Analytics — site usage analytics.

Some of these providers may process data outside the UK. Where they do, appropriate safeguards (such as UK International Data Transfer Agreements or adequacy decisions) are in place. We do not sell your personal data.

6. How long we keep it

Order and payment records: retained for at least 6 years to meet UK tax and accounting requirements.
Support emails: kept only as long as needed to handle your query and a reasonable period after.
Marketing contacts: kept until you unsubscribe.

7. How we protect it

We use secure, access-controlled systems, encrypted connections, private file storage with short-lived download links, and keep credentials confidential. No system is perfectly secure, but we take reasonable steps to protect your data.

8. Your rights

Under UK data protection law you have the right to:

access the personal data we hold about you;
ask us to correct inaccurate data;
ask us to erase your data (where we're not required to keep it);
restrict or object to certain processing;
request portability of data you gave us;
withdraw consent at any time (where we rely on consent).

To exercise any of these, email hello@mintedflow.com. We'll respond within one month.

9. Complaints

If you're unhappy with how we've handled your data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113.

10. Cookies

We use only the cookies needed to run the site and, if enabled, basic analytics. Where required, we'll ask for your consent via a cookie banner. (If you add non-essential/analytics or marketing cookies, add a short cookie notice and a consent banner — this is a legal requirement under PECR.)

11. Changes to this policy

We may update this policy and will post the current version here with the "Last updated" date.

12. Contact

hello@mintedflow.com — MintedFlow trading as MintedFlow.