Privacy Policy
Last updated: October 2026
This policy explains what personal data Wyrmfuel collects through wyrmfuel.com, why, who handles it for us, and your rights. We keep it short because we collect very little: there are no advertising tools on this site, and Google Analytics only runs if you accept analytics cookies.
1. What We Collect and Why
- Orders: when you check out, Stripe collects your name, email, shipping address and payment details on its own secure checkout page. We receive your name, email, shipping address and what you ordered (never your full card number) so we can make, ship and support your order. Lawful basis: performing our contract with you.
- Newsletter: if you enter your email in the newsletter box, tick “Send me Wyrmfuel drops and news” on the wallpapers page, or opt in at checkout, we add it to our mailing list to send you drops and offers. For the newsletter box and the wallpapers box we first email you a link to confirm, and add you only once you click it; we note where you signed up and, for the wallpapers box, which wording you agreed to and when. The wallpapers themselves are free to download without giving an email. Lawful basis: your consent; every email has an unsubscribe link.
- Contact form: your name, email, subject and message, so we can reply. We also keep a one-way, salted hash of your IP address (never the address itself) for a few minutes to stop spam. Lawful basis: our legitimate interest in answering you and blocking abuse.
- Virtual Try-On: if you use it, the photo you upload is sent, with the garment image, to Google's Gemini API to generate the try-on picture, and the result is sent straight back to your browser. We don't save your photo or the result. Only use a photo of yourself, or of someone who has agreed. Lawful basis: your request to use the feature.
- Server logs: like any website, our host (Netlify) briefly records technical data such as IP address and browser type to deliver the site and keep it secure.
2. Who Handles Your Data for Us
We don't sell your personal data. These providers process it on our behalf, only for the purposes above:
- Stripe – checkout and payments
- Printful – printing and shipping your order (receives your name, shipping address and order details)
- MailerLite – our mailing list, and customer emails about your order
- Resend – sending contact-form replies and notifications
- Sanity – stores contact-form messages, and serves site images and Wyrmfuel FM audio
- Google (Gemini API) – generates Virtual Try-On images
- Google (Google Analytics) – site usage statistics, only if you accept analytics cookies (see section 4)
- Netlify – website hosting
Some of these providers are based in, or use servers in, the USA. Where data leaves the UK it is protected by the UK International Data Transfer Addendum, standard contractual clauses or the UK-US Data Bridge, as applicable.
We may also disclose data where the law requires it.
3. Cookies and Browser Storage
We don't use advertising cookies. Analytics cookies are only set if you accept them (see section 4). Otherwise the site only stores what it needs to work, in your own browser:
- Your cart (
wf-cart-v1, local storage) – keeps your basket between pages and visits until you check out or empty it. - Wyrmfuel FM player (
wf_fm_*, local storage) – remembers the track, position, volume and whether you closed the player. - Your cookie choice (
wf-consent, local storage) – remembers whether you accepted or rejected analytics cookies, so we don't ask on every page.
When you go to checkout, Stripe's payment page may set its own strictly necessary cookies for payment security and fraud prevention.
Our Instagram reels and social links open on those platforms. Nothing from Instagram, TikTok, YouTube, Facebook or X loads on our site until you click through, and once you're on their site their own cookie and privacy policies apply.
You can clear local storage at any time in your browser settings; this just empties your cart, resets the player and asks for your cookie choice again.
5. How Long We Keep It
- Order records: 7 years, for tax and accounting purposes.
- Mailing list: until you unsubscribe.
- Contact messages: as long as needed to deal with your enquiry, then deleted within 2 years.
- Try-On photos: not kept.
6. Data Security
The site is served over HTTPS, payments are handled entirely by Stripe, and access to our provider accounts is restricted. No method of transmission over the internet is 100% secure, but we take reasonable steps to protect your data.
7. Your Rights
Under UK data protection law you can ask to:
- access the personal data we hold about you
- correct it if it's wrong
- delete it
- object to, or restrict, how we use it
- receive a copy in a portable format
- withdraw consent at any time (e.g. unsubscribe from emails)
To exercise these rights, email contact@wyrmfuel.com. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.
8. Third-Party Links
Links to other websites (including our social channels) are governed by those sites' own privacy policies.
9. Children
This site isn't intended for children under 16 and we don't knowingly collect their personal data. If you think we have, please contact us and we'll delete it.
10. Changes to This Policy
If we change how we handle data, for example by adding a new service, we'll update this page and the date at the top.
Contact Us
If you have any questions about this privacy policy or how we handle your data, please contact us at: