Vault privacy notice

Who is responsible for your information

Daniel Arnold, trading as Fuck Art, is a sole trader and is responsible for the personal information described in this notice.

For privacy enquiries, email Oiduts@fuckart.co.uk or write to Fuck Art, 126 East Ferry Road, London, E14 9FP.

What we collect

When you join the Vault email list, we collect your first name and email address. We record the email consent you give, the wording you agreed to, its version and the time of your choice, together with the signup source and internal Vault tags.

You can also choose to share artwork and product interests, preferred garment sizes and quantities. These preferences are optional. They help us understand interest in the collection and do not reserve a product. An emotion selected here is an artwork preference.

We keep a unique submission reference and a coded request fingerprint to recognise retries of the same submission. Our website also processes technical information used to protect the signup service.

How we use your information

We use your consent to send emails about the Vault, the collection and its launch. The consent box starts unchecked. Joining uses single opt-in: you choose to receive these emails when you submit the form with that box selected. There is no separate email-confirmation step.

You can unsubscribe at any time using the link in our marketing emails. Choosing not to join the email list does not require you to consent to marketing for an unrelated purchase or service.

We use optional preferences to understand interest in the collection. We process technical information to protect the signup service and recognise repeated requests. Our legitimate interests are operating a reliable service, preventing misuse and understanding voluntarily expressed product interest. We retain consent and unsubscribe evidence to respect your choices and demonstrate how they were handled.

Where your information is processed

Our website service processes new Vault submissions and saves registration details, consent records and optional preferences in Shopify. The website's hosting and security services also process technical information needed to operate and protect the service.

For repeat submissions, we check the matching Shopify record to avoid duplicate registrations. An exact retry can recover the result of the same submission. This signup form does not automatically change an existing record or resubscribe someone who has unsubscribed.

To limit repeated or abusive requests, we use Cloudflare's database service for security counters. These contain coded identifiers derived from an IP address or email address, a time window and a request count, rather than the signup name or product preferences. These coded identifiers are not treated as anonymous merely because the original address is not displayed.

Earlier registrations submitted through Tally remain in Tally while those historical records are preserved and reconciled. Their original consent choices continue to matter; moving a record does not renew consent.

How long we keep information

We review Vault registrations after 12 months without meaningful interaction. As part of that review, we remove preferences that are no longer needed. This is a review point, not a promise that every record is automatically deleted after 12 months.

If you unsubscribe, we stop marketing to you and retain a minimal do-not-email record so that we can respect your choice. We keep only the information needed for that purpose.

Your rights

Depending on the circumstances, you can ask for access to your personal information, correction, deletion, restriction or portability. You can object to processing based on legitimate interests and withdraw your email consent. Contact us using the details above.

You can also raise a concern with the Information Commissioner's Office at ico.org.uk.

Service providers and international processing

Shopify and Cloudflare operate internationally, so information may be processed outside the UK. Their published data-processing terms describe safeguards including adequacy decisions and standard contractual clauses with applicable UK provisions. You can request further information about safeguards using our privacy contact above. Provider information: https://www.shopify.com/legal/dpa and https://www.cloudflare.com/cloudflare-customer-dpa/.

This website is hosted through OpenAI Sites on Cloudflare. The hosting service processes requests needed to serve and protect these pages. We do not include signup names, email addresses or preferences in application logs. Security counters are cleared during subsequent signup activity once their time windows are over 24 hours old; this is activity-driven cleanup, not a guaranteed deletion deadline.

Cookies and external fonts

The Vault form does not require an advertising or marketing cookie. If you enter the gallery password, we use a secure access cookie lasting up to eight hours; logging out clears it. The Vault page loads its typeface from Google Fonts, which receives the technical request needed to deliver that font. This notice covers Vault registration; no orders or payments are accepted through this form.