1. Who we are
Trading name: Smithyy Bakes.
Legal seller details and postal address: These details will be displayed here before online ordering opens.
Privacy and customer contact: management@smithyybakes.uk.
Online ordering is not currently open.
2. Personal information we collect
Depending on how you use the website, we may collect your name, email address, authentication and account details, optional profile information, order items and quantities, order totals, delivery or collection details, order and payment status, Stripe transaction/session references, product ratings and customer-service messages. We do not intend to store your full payment-card details in our own website database; payment details are entered through Stripe's payment service.
The website may also store information locally in your browser to keep your basket, preferences or signed-in session working. Server and security logs may contain technical information needed to operate and protect the service.
3. How and why we use it
- Accounts and profiles: to register you, authenticate you and let you manage your profile.
- Orders and payments: to validate baskets and stock, process payment through Stripe, arrange collection or delivery, provide order history, answer questions and handle complaints or refunds.
- Necessary emails: to send account verification, password reset, payment and order messages.
- Reviews: to display and moderate product ratings from eligible verified purchasers.
- Security and reliability: to detect misuse, protect accounts and records, diagnose errors and maintain the website.
- Legal records: to meet applicable accounting, tax, food-safety, consumer and other legal obligations.
- Marketing: only where we have the required consent or another valid lawful basis, and where required we will provide an easy way to opt out.
4. Our lawful bases
Depending on the purpose, we expect to rely on taking steps requested by you or performing our contract with you (for account and order services), complying with legal obligations (for required records), legitimate interests (for security, preventing fraud and handling customer queries in a proportionate way), and consent where it is required (for marketing or non-essential technologies). We use the lawful basis that applies to each purpose and will update this notice if our data practices change.
5. Services we use
The website is designed to use these providers: Supabase for authentication and database hosting; Stripe for payment checkout and payment events; Resend for transactional email; Cloudflare for website hosting and related security; and Postcodes.io for approximate UK postcode-coordinate lookups if postcode delivery is enabled. Information is shared with a provider only to the extent needed for the relevant service, legal compliance or security.
The providers involved may process information in accordance with their own terms and privacy notices. We share information only to the extent needed to operate the relevant feature, meet legal obligations or protect the service.
6. How long we keep information
- Account information: while the account remains active, and for a reasonable period after a deletion request where necessary to complete the request, resolve disputes, prevent fraud or meet legal obligations.
- Order and accounting records: for as long as reasonably necessary to administer orders, handle claims and meet applicable tax, accounting and legal requirements.
- Support messages and technical logs: only for as long as reasonably necessary to resolve the issue, maintain security and document the outcome.
- Marketing preferences: while marketing is used and as needed to retain a record of your choice or opt-out.
We will not keep personal information for longer than we need it, unless a legal requirement or legitimate dispute requires retention.
7. Your choices and rights
Depending on the applicable law and lawful basis, you may be able to request access to your information, correction, deletion, restriction of processing, a copy in a portable format, or object to certain processing. Where we rely on consent, you can withdraw it. You can unsubscribe from marketing using the method in the message or contact us. To exercise a right, contact management@smithyybakes.uk. We may need to verify your identity before acting.
You can complain to the UK Information Commissioner's Office (ICO) if you believe your personal information has been handled improperly. We would appreciate the chance to address your concern first.
8. Cookies, browser storage and embedded services
The website uses browser storage and session mechanisms for core functions such as keeping a basket, remembering preferences and maintaining a signed-in account. Stripe Checkout and other linked services may use their own technologies. If non-essential analytics or advertising technologies are added, any legally required consent will be requested before they are used.
9. Keeping information secure
We use access controls and service-provider security features intended to restrict personal information to authorised purposes. No online service can promise absolute security. Please use a unique password and contact us promptly if you suspect unauthorised access to your account.
10. Changes and contact
We may update this notice when our services or data practices change. We will publish the latest version on this page and update the review date. Last reviewed: 10 October 2026. Privacy contact: management@smithyybakes.uk.