Privacy

Sam Underwood is responsible for the personal data this site collects. You can contact me about it at hello@samunderwood.co.uk.

The short version: the site doesn’t use analytics or advertising trackers. I only collect what’s needed to sell you things and let you download them again.

What I collect and why

When you buy something. Your email address, what you bought, the amount, and a reference to the payment and its receipt. I use these to deliver your purchase, let you download it again, and keep the accounts the law requires. The legal basis is the contract with you, and my legal obligation to keep tax records. Your card details go to Stripe and never reach me.

When you sign in to your wallpapers. Your email address, so I can send you a sign-in link. The link works once and expires. I keep a record of your signed-in browser so you stay signed in. The legal basis is the contract with you.

Your agreement to the download. Before you pay, you confirm you want the download straight away. A record of that, and when you agreed, is kept with your payment, because the law asks me to be able to show it.

When you use the site. Your IP address is used briefly to stop abuse, such as too many sign-in requests, and in a check that you’re not a bot (Cloudflare Turnstile). It isn’t kept with your purchases. The legal basis is my legitimate interest in keeping the shop secure.

I only email you about your purchases and sign-in links. I don’t send marketing.

Cookies and local storage

The site sets two cookies of its own, and only when you buy or sign in:

• __Host-wallpapers keeps you signed in to your wallpapers, for up to 30 days, or until you sign out;
• __Host-wallpapers-order lets the browser you paid with download that order, for 24 hours.

On pages where you can buy something, Stripe’s payment script loads and sets its own cookies, such as __stripe_mid and __stripe_sid, which it uses to detect fraud. Stripe explains them here.

Your browser also remembers whether you chose the light or dark theme, and whether you’ve seen the home page’s opening animation that visit. All of these are needed for the site to work or to take payments safely, so there’s no cookie banner.

Who your data is shared with

• Stripe processes payments, and may use your payment details to prevent fraud.
• Cloudflare hosts the site, stores purchase records and files, sends the emails, and runs the bot check.

Both may process data outside the UK. Where they do, it’s protected by the safeguards UK law requires, such as approved contract terms. I don’t sell your data or share it with anyone else, unless the law requires it.

How long it’s kept

• Purchase records, including your email address: for as long as you can download what you bought, and at least 6 years from the end of the tax year you bought in, as UK tax law requires.
• Sign-in links stop working once used, or after 30 minutes (7 days for the one in your purchase email). A signed-in browser stays signed in for up to 30 days, and an order download works for 24 hours. Records of these are kept with your purchase records.

Your rights

You can ask to see the personal data I hold about you, correct it, or have it deleted. You can also object to how it’s used, ask me to limit it, or ask for a copy to take elsewhere. Purchase records I’m required to keep for tax can’t be deleted until that time is up.

To use any of these rights, email hello@samunderwood.co.uk. If you’re unhappy with how I’ve handled your data, you can complain to the Information Commissioner’s Office.