privacy policy

1. Who is responsible for your data

This website, soonerased.com (the “Site”), is operated by SOON ERASED LTD, a company registered in England and Wales under company number 16692885, trading as Soon Erased (“Soon Erased”, “we”, “us”, “our”).

Contact: hello@soonerased.com or +44 7421 363431. Registered office address: Bramshaw House, Enstone Road, Little Tew, Chipping Norton, OX7 4HZ. For returns we confirm the address to send to when you tell us you are cancelling, so nothing goes astray.

We are the data controller for the personal data described in this policy, which we process in accordance with UK data protection law (the UK GDPR and the Data Protection Act 2018). This policy covers the Site; it should be read alongside our Terms of use and Terms of sale.

2. What we collect, and why

Newsletter

If you subscribe, we store your email address, when you subscribed and where the signup came from, and we send you occasional emails about new work, collections and studio news. Lawful basis: consent — you gave us the address for this purpose, and every email includes an unsubscribe link that works immediately. Unsubscribing stops the emails; we keep a record of the unsubscribe so we don’t email you again.

Enquiries — artwork and studio

When you enquire about a work or about a studio project we collect what you put in the form: your name, email address, optionally your business, and your message. We use it to answer you and, if things go further, to prepare a proposal or invoice. Lawful basis: taking steps at your request prior to entering a contract, and our legitimate interest in running the gallery and studio.

Purchases

When you buy a work by card, Stripe collects your name, email address, phone number, billing and delivery address on its own payment page and passes them to us so we can confirm the order and deliver the work. Card details never reach us. We keep the order record for 6 years as required for tax and legal purposes. Lawful basis: performance of a contract and our legal obligations.

Artist portal and admin accounts

Portal accounts are created by invitation and hold your name, email address and a securely hashed password (we cannot read your password), plus the profile and artwork information you manage in the portal. Admin sign-in additionally uses a one-time code sent by email. Lawful basis: performance of our agreement with you.

Technical data

Our infrastructure records IP addresses in server logs and uses them briefly for rate limiting (protecting the forms from abuse). We use Vercel Analytics, which is cookie-free and gives us aggregated, anonymised page statistics — it does not track you across sites. Lawful basis: legitimate interest in keeping the Site secure and understanding how it is used.

If you accept analytics cookies from the banner, we also use Google Analytics for a fuller picture of how the Site is used (pages visited, rough location, device type, how you found us). It sets cookies on your device and Google processes the data as described in their own privacy policy. Lawful basis: consent — see §6 for how to accept, decline or change your mind.

3. Who we share data with

We never sell personal data, and we don’t share it with anyone for their own marketing. Data is handled by the service providers who run our infrastructure, acting on our instructions as processors:

• Vercel — hosting, serverless infrastructure and anonymised analytics;
• Resend — sending transactional and newsletter email;
• our database provider — storing the data described above;
• Google (Google Analytics) — only if you accept analytics cookies.

Some of these providers process data in the United States. Where data leaves the UK, it does so under recognised safeguards — the UK Extension to the EU–US Data Privacy Framework or the International Data Transfer Agreement/Addendum (standard contractual clauses).

We may also disclose data where the law requires it, or to professional advisers where genuinely necessary.

4. How long we keep it

• Newsletter: until you unsubscribe (then a suppression record only, so we don’t contact you again);
• Enquiries: up to 24 months after our last exchange, then deleted — unless the enquiry became a purchase or project, in which case the records are kept as part of that transaction (up to 6 years, as required for tax and legal purposes);
• Portal accounts: for as long as we represent you, then removed on request or when the relationship ends;
• Server logs: short-lived and rotated automatically.

5. Your rights

Under UK GDPR you can ask us to:

• tell you what data we hold about you, and give you a copy (access);
• correct inaccurate data (rectification);
• delete your data (erasure), where we have no overriding need to keep it;
• limit what we do with it (restriction);
• give you your data in a portable format (portability);
• stop processing based on legitimate interests (objection);
• withdraw consent at any time, where consent is the basis (e.g. the newsletter).

Email hello@soonerased.com and we’ll respond within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk, though we’d appreciate the chance to sort it out first.

6. Cookies

The Site uses essential cookies that don’t require consent: session cookies that keep artists and admins signed in to the portal, short-lived security cookies protecting the forms, and a small note of your cookie choice itself. There are no advertising or cross-site tracking cookies.

If you accept the banner, we additionally set Google Analytics cookies to understand how the Site is used. These are optional — nothing is set until you say yes, declining costs you nothing, and you can change your mind at any time via “Cookie settings” in the footer.

7. Security

Data is transmitted over HTTPS and stored in access-controlled infrastructure. Passwords are hashed, admin access requires two-factor authentication, and form endpoints are rate-limited. No system is perfectly secure, but we treat your data the way we’d want ours treated.

8. Children

The Site is not directed at children and we do not knowingly collect children’s data.

9. Changes to this policy

We’ll update this page if our practices change, and the date at the top will always tell you when it was last revised. Significant changes will be flagged to newsletter subscribers and portal users directly.

10. Contact

Anything about your data: hello@soonerased.com.