Privacy

About this notice

This notice explains how Mepoku uses personal information when you browse, sign in, order or contact us. For questions about Mepoku or your personal information, email orders@mepoku.com. We handle requests personally.

Privacy at a glance

• We use your information to manage your order, deliver it and help with any questions.
• You can order without an account. Signing in lets you save a basket and view your orders.
• We share information with the services that run the shop, process payments and deliver orders. Our garment supplier does not receive customer details.
• Ordering does not sign you up for marketing. The shop does not add analytics or advertising trackers.

The sections below explain what we use, why we use it and your rights.

Information we use

Orders contain your email, name, delivery recipient and address, chosen items, quantities, price, payment and refund status, payment references, delivery tracking and relevant support notes. Stripe collects your payment information in its checkout and sends us the order, contact and payment-status information. Mepoku does not collect or store your full card number or card security code.

Optional accounts use your email, a verified sign-in session, a saved basket and order history. When you verify your email, earlier guest purchases made with that email can be linked to your account. You can order without creating an account.

We also use messages you send us, copies of order emails (including their delivery address), email delivery/failure records and limited security information. This includes identifiers for guest visits and security identifiers derived from email addresses or network information to limit repeated requests and prevent abuse. Hosting and security providers process technical information such as IP addresses, requests, browser/device information and security-check results.

We use technical error reports to find and fix website problems. These reports contain error types and code locations. Our error reporting is configured to remove error messages, customer details, request contents, cookies and URL query parameters. We do not use session recordings.

Why we use it

• To take steps you request before ordering and fulfil our contract: take payment, manage your order, deliver it, send order updates and handle cancellations, returns and refunds.
• To provide the account and saved basket you request, and answer purchase enquiries.
• To meet legal obligations, including keeping necessary tax records and handling applicable consumer and data-protection rights.
• For our legitimate interests in operating a secure shop, preventing fraud and abuse, investigating website and delivery/email failures, responding to general enquiries and establishing or defending legal claims.

We need checkout contact, delivery and payment information to fulfil an order. Without it we cannot complete the purchase. An account is optional. We do not currently offer marketing email subscriptions. Placing an order or signing in does not subscribe you to marketing emails. We do not use your information for advertising or make decisions with legal or similarly significant effects based solely on automated profiling. Automated security checks may temporarily block suspicious requests.

Who receives information

• Supabase stores shop and account records and provides sign-in.
• Vercel hosts the website and keeps technical records of website requests and errors.
• Sentry receives limited technical error reports to help us fix website problems.
• Stripe processes payments and refunds, with its own fraud-prevention and legal responsibilities.
• Resend sends sign-in and order emails and processes delivery results.
• Cloudflare Turnstile checks sign-in requests for automated abuse.
• Porkbun forwards support email to our Google Gmail inbox; replies to order emails also reach that inbox.
• Royal Mail receives the delivery details needed to post and deliver your order.

We buy garments from suppliers using design, colour, size and quantity summaries, without giving them customer details. We may also disclose necessary records to professional advisers or public authorities when needed for legal obligations or claims. Providers may process some information for their own legal and security purposes, as described in their notices above.

International processing

Our shop database is hosted in London. That does not mean all processing stays in the UK: providers and their service partners may process information in other countries, including the United States. Their published terms describe the legal protections for these transfers. Depending on the provider, these may include approved arrangements such as adequacy decisions, the UK Extension to the EU–US Data Privacy Framework, or standard contractual clauses with the UK Addendum.

See the Supabase, Vercel and Resend data-processing terms and the provider notices above for their arrangements. Contact us for information about the safeguards relevant to your data or how to obtain a copy.

Cookies and browser storage

Cookies and browser storage help us remember your basket, keep you signed in, match a payment to your checkout and protect the shop.

• A guest cookie recognises your browser for up to 90 days.
• Your basket and records used to prevent duplicate basket updates are kept in your browser’s local storage. This storage does not automatically expire.
• A reference for a checkout attempt is kept in session storage, which normally clears when you close that tab.
• Account cookies last for your sign-in session and may be renewed while you use the account.
• Turnstile uses browser and security information to check for automated abuse.

You can clear cookies and site storage in your browser; this may sign you out, remove the saved device basket or affect checkout recovery. Clearing browser storage does not erase server-side order or account records. The shop does not add analytics or advertising trackers.

How long we keep information

We retain necessary order, payment and accounting records for tax obligations and to deal with returns, disputes or legal claims. For relevant sole-trader tax records, HMRC requires at least five years after the 31 January submission deadline for the relevant tax year. An open claim, investigation or other legal requirement may require longer retention.

Account and basket records support the account you choose to keep. We review support messages, abandoned checkout records, email copies and delivery or security records to decide whether we still need them. We consider whether a record is needed to complete an order, check a payment, answer a request, investigate a failure or prevent abuse. These records do not all need to be kept as long as tax records. We may keep a record of email addresses where delivery failed or someone reported an email as spam, so we can avoid sending further emails to them.

We review these records and remove or anonymise them manually. They are not automatically deleted after a fixed number of days. Our providers also have their own rules for keeping records and backups. Contact us about a particular record or to request deletion; we will explain any information we need to retain and why.

Your information rights

Depending on the circumstances, you can ask to access or correct your information, delete it, limit its use, or receive a copy in a format you can transfer to another service. Email orders@mepoku.com. We may need to check your identity, using only the information needed for your request. We normally respond within one month; if a lawful extension applies, we will explain it. We will also explain any lawful reason a request cannot be fulfilled in full. Deleting an account does not necessarily erase records we must retain for tax or legal claims.

Your right to object

You can object to processing based on our legitimate interests for reasons relating to your situation. Contact us and we will consider your objection and explain the outcome.

Questions, complaints and changes

You have the right to complain to us about how we handle your personal information. Email orders@mepoku.com and tell us your concern. We’ll acknowledge your complaint within 30 days of receiving it, investigate it and keep you informed. We’ll explain the outcome and any action we take without undue delay.

You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.

We will update this notice when our processing changes and show the publication date and version above.