How we look after your information

StorieVerse is a trading name of Iris Futures Ltd, registered in England and Wales under company number 16763588. For privacy questions or to exercise your rights, email support@storieverse.com.

• Account and communications: email address, authentication identifiers, account records, support messages and attachments.
• Creative content: prompts, selected styles, generated artwork and images you upload to Transform.
• Basket and order information: product, size, colour, artwork, delivery address, order reference and status.
• Payment metadata: payment status, amount and checkout reference. Stripe processes full card details; StorieVerse does not receive or store them.
• Technical and security information: IP address, browser and device information, authentication and security events, server logs and diagnostics.
• Privacy choices: your choices and minimal browser-level evidence such as the notice version, categories chosen, time, expiry and pseudonymous identifiers.
• Optional Google Analytics: for browsers that affirmatively consent to this current notice, Google receives data about visits and navigation, including a public page path, sanitised page location, limited referrer and technical/browser information. If the separately gated purchase measurement is enabled, Google may also receive a purchase event for a verified paid clothing order containing a stable order reference, GBP merchandise value, delivery amount and generic clothing item names, unit prices and quantities. Google Analytics may use pseudonymous browser and session identifiers. We do not send names, email addresses, prompts, uploaded or generated artwork or payment-card information.

• To create or transform artwork and provide previews at your request: contract and steps you ask us to take before a contract.
• To manage accounts, baskets, checkout, orders, downloads, delivery and support: contract.
• To process payments and keep required transaction, tax and accounting records: contract and legal obligation.
• To secure the service, prevent fraud and misuse, diagnose faults and maintain reliability: our legitimate interests in operating a safe and effective service.
• To comply with law, handle privacy rights and keep proportionate consent and withdrawal evidence: legal obligation, accountability and legitimate interests.
• To understand consented visits and navigation, and where separately enabled measure verified paid clothing orders, through optional Google Analytics and improve the website: your consent.

We do not use customer designs in public showcases or marketing without separate permission.

Essential technologies provide security and requested core features such as signing in, saving your basket, checkout, orders and account access. They cannot be switched off through the Privacy choices control, although blocking them in your browser may cause parts of StorieVerse to stop working.

Optional Google Analytics measures visits and navigation to help improve StorieVerse. If separately enabled, it may also measure a verified paid clothing order against a consented browser/session. It runs only after this browser has affirmatively consented to this current notice through Privacy choices, and Google receives the Analytics data. We do not treat silence, continued browsing or a preselected control as consent. Rejecting Analytics does not affect the core service.

Advertising features are disabled. Google Signals, advertising personalisation, advertising identifiers and Google Ads conversion tracking are not used in this release. Any future advertising provider, purpose and recipient would be named and separately reviewed before use.

You can reopen Privacy choices from the footer at any time. Changing Analytics to off stops future Google Analytics collection immediately, disables the Google tag for this browser, removes the known Google Analytics browser cookies and suppresses eligible unsent purchase events. This browser control does not itself erase Analytics data already received by Google.

Any separate first-party Analytics records follow their own retention and erasure process, which may run asynchronously and may not be immediate. Google Analytics aggregate reporting is separate from browser-cookie removal. Consent-accountability evidence and required order, payment, tax and fulfilment records are retained separately where needed for our operations.

Clearing StorieVerse cookies or site data in your browser may sign you out, empty your basket, remove unsaved work and cause us to ask for your choice again.

• Current consent preference and its cookie: 180 days.
• Expired or orphaned current consent evidence: eligible for deletion after a further 30 days.
• Consent and withdrawal history: 24 months.
• Google Analytics cookies: _ga distinguishes browsers and _ga_46X2GELKGC preserves session state. This integration does not override gtag.js cookie expiry: Google documents a two-year default for each cookie, with the expiry refreshed on hits by default. Known cookies are expired when Analytics consent is withdrawn.
• Google Analytics user-level and event-level data: two months under the configured Google Analytics property retention setting. This is Google-side data retention, not cookie expiry. Purchase measurement is a separate release-gated purpose and sends nothing while that gate is off.
• Google Analytics standard aggregate reports: retained separately from user-level and event-level data. Google says the two-month data-retention setting does not affect standard aggregated reports, so this notice does not state a separate Google aggregate-report deletion period.
• Google purchase attribution hand-off: a consented browser attribution record is kept for at most 24 hours after the latest observed public activity. A server outbox row is eligible for delivery only up to 72 hours after the verified payment timestamp; after that, the event is suppressed and its identifiers and payload are removed. Terminal outbox status is retained for seven days for operational reconciliation, and attempt outcomes for 30 days. These StorieVerse periods are separate from Google Analytics cookie expiry and Google's two-month user/event retention.
• Separate first-party Analytics foundation: if separately enabled, its visitor identifier is limited to 180 days, its session to 30 minutes of inactivity or a 24-hour hard maximum, raw events to seven days, visitor-day and individual funnel facts to 30 days, and detailed aggregate reporting to 24 months. These are StorieVerse periods and are separate from Google Analytics.
• Completed privacy-rights evidence: 24 months; completed maintenance evidence: 90 days; released worker leases: seven days.
• Ordinary security and application logs: normally 30–90 days, with longer retention only for a documented incident.

Account, creative, support, order, payment, tax and fulfilment records follow their separate operational, contractual, legal and claims requirements; withdrawing Analytics does not delete those records.

We share only what is reasonably needed with service providers, including:

• Google Analytics for optional consented visits, navigation and, when separately enabled, verified paid clothing purchase measurement.
• Supabase for authentication, database and storage.
• Vercel for hosting, delivery and operational logs.
• Sentry for minimised error monitoring.
• Stripe for secure checkout, payment and fraud controls.
• OpenAI for requested AI-assisted image generation.
• Printful and relevant delivery partners for made-to-order production and delivery.
• Our configured email delivery provider for authentication, transactional and support communications.

We may disclose information where law requires it, to protect legal rights, or in a genuine business reorganisation. We do not sell personal information. Meta and TikTok are not active recipients.

Some providers or their subprocessors may process information outside the UK. Google publishes information about the international-transfer mechanisms applicable to its analytics services, including the UK Extension to the EU–US Data Privacy Framework and contractual safeguards where applicable. Contact support@storieverse.com for information about transfers relevant to your personal information.

Depending on the circumstances, you may have rights to be informed; access, correct or erase information; restrict or object to processing; receive certain data in a portable format; and withdraw consent. These rights are not absolute. We may need to verify your identity, and legal obligations or legal claims may require us to retain some records.

Email support@storieverse.com to make a request. You can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint. We would appreciate the opportunity to address your concern first.

StorieVerse is aimed at purchasers capable of entering contracts and an adult must place an order. Creative themes may nevertheless attract children or families. We use high-privacy defaults: Analytics requires affirmative consent and Advertising is not used. Tell us if you believe a child has provided information improperly.

Google Analytics visitor tracking is a consent-gated optional feature. It is not active until its release gates are enabled, no historical visits or purchases are backfilled, and collection begins only for eligible browsers that affirmatively consent to this current notice. If purchase measurement is enabled, a verified paid-live clothing order can be sent only when a fresh consented browser/session hand-off is still within its defined time window. The event contains no customer or creative content. Orders without that evidence, unpaid or failed orders, test orders and cancelled orders are excluded. No refund event is sent, and a purchase already accepted by the transport is not automatically reversed if a later refund occurs. This does not promise that every visit or order can be attributed, and Google applies its own reporting and attribution rules.

We use proportionate technical and organisational measures intended to protect information, but no online service can guarantee absolute security. We will update this notice when the service, providers or law changes. Material new optional purposes or providers require appropriate information, review and consent rather than a silent wording change.