SupplySprout

We only collect the data we need to run the shop and we never sell it. This policy explains what we hold, why, and how to control it.

What we collect

Account info — name, email, hashed password (bcrypt), role (parent/teacher)
Order info — items, totals, shipping address, order history
Teacher verification — school name, school email, grade/subject (only if you apply)
Payment — handled by Stripe; we only receive a confirmation and the last 4 digits
Usage logs — session cookies and request logs for security

Why we hold it

To ship your order, send you order updates, apply your teacher discount, respond to support requests, and prevent fraud.

Who we share it with

Stripe — card processing
CJ Dropshipping — your shipping address, so your order can be sent to you
Resend — to deliver order confirmation and status emails
HM Revenue & Customs or authorities if legally required

That's it. No marketing resale, ever.

Your rights (UK/EU GDPR)

You can ask us at any time to: see what we hold about you, correct it, delete it, export it, or stop processing it. Email support@supplysprout.co.uk and we'll respond within 30 days.

Cookies

We use essential cookies for login sessions and cart state. We don't run advertising trackers. Analytics (if added later) will be opt-in.

Retention

Orders and invoices are kept 7 years (HMRC requirement). Accounts are deleted on request. Chat transcripts with the AI assistant are kept 90 days.