Privacy Policy
Last Updated: 7 October 20261. Who We Are
Lyrīon Atelier and the website lyrionatelier.com ("Site") are operated by LYRION LTD, company number 16904877, registered in England and Wales. Registered office: Flat 9 Centro, 399 South Row, Milton Keynes, MK9 2PG. LYRION LTD is the controller of the personal data described in this policy. For questions about this policy, contact us at admin@lyrionatelier.com.
2. Information We Collect
Information You Provide Directly: When you place an order, contact us, or request an oracle reading, we collect your name, email address, billing and shipping information, order details, communication history, and any information you share to personalise your reading (such as birth date, time, and location).
Information Collected Automatically: We collect device information, IP address, browser type, operating system, referring URLs, and on-site activity through cookies and similar tracking technologies to improve performance and security. Analytics data is collected only after you give consent (see Section 6).
3. Legal Basis for Processing (UK GDPR Article 6)
- Article 6(1)(b) - Contract: Processing your name, address, and payment details to fulfil orders you place with us.
- Article 6(1)(a) - Consent: Setting analytics and advertising cookies and processing the data they generate. This consent is collected through our cookie banner. You may withdraw consent at any time by clearing cookies and rejecting on next visit.
- Article 6(1)(c) - Legal obligation: Retaining transaction records for tax and accounting purposes.
- Article 6(1)(f) - Legitimate interests: Fraud prevention, site security, and communicating about your existing orders.
Cookies specifically: We comply with the Privacy and Electronic Communications Regulations 2003 (PECR) Regulation 6. No non-essential cookies are set until you click "Accept" on our cookie banner. Clicking "Reject" genuinely prevents those cookies from being set.
4. Cookies We Use
| Cookie Name | Purpose | Type | Expiry |
|---|---|---|---|
| la_consent | Stores your cookie consent choice | Essential (localStorage) | Persistent |
| cart | Stores items in your shopping bag | Essential (localStorage) | Persistent |
| _ga, _ga_* | Google Analytics 4 - measures how visitors use the site | Analytics (consent required) | 2 years |
| _gcl_* | Google Ads conversion tracking | Advertising (consent required) | 90 days |
Analytics and advertising cookies are only set after you click "Accept" on our banner. "Reject" prevents them entirely.
5. How We Use Your Information
- Process and fulfil orders, including payment, shipping, and customer support.
- Deliver oracle readings and related services you request.
- Communicate about purchases, account updates, and support inquiries.
- Analyse and improve website performance, user experience, and product offerings (with your consent).
- Protect against fraud, abuse, and security threats.
- Comply with legal, regulatory, and tax obligations.
6. How We Share Your Information
Service Providers: We share information only as needed with providers who act on our instructions: Stripe (payment processing), Printful (printing and delivering physical orders, including your delivery address and any gift note), Resend (sending emails), Supabase (our database and order processing), Anthropic (drafting the text of readings and certificates from the names and birth details you give; we read every draft before it is sent), and GitHub (hosting the Site).
Google: If you consent to analytics cookies, anonymised usage data is shared with Google LLC under their Data Processing Terms, with IP anonymisation enabled.
Legal Requirements: We may disclose information to comply with applicable law or to protect our rights, property, and safety.
We do not sell personal information.
The Birthday Book
If you use the Birthday Book, we keep your email address and first name, and for each person you add their name, the day and month of their birthday, the year if you give it, and how they are related to you. We use this only to email you a reminder 21 days before each birthday. We never contact the people in your book.
- Legal basis: your consent (UK GDPR Article 6(1)(a)), given by ticking the box on the Birthday Book page and confirmed through the link we email you. Nothing is sent until you confirm.
- Other people's details: please add only people who would expect you to remember their birthday. We use their details for nothing else.
- Withdrawing consent: every reminder has a one-click unsubscribe link, and the page it opens lets you delete the whole book.
- Retention: until you unsubscribe or delete the book. Unsubscribed entries are deleted when you ask, or after 12 months.
Partner and contact enquiries
Messages sent through the contact or Partners forms are stored in our database and emailed to us so that we can reply. They are kept for 3 years from last contact.
7. Data Retention
- Order and transaction records: 7 years (UK tax/accounting obligation).
- Reading and certificate content, and the birth details used to write it: deleted 12 months after delivery unless you ask us to keep it.
- Analytics data: 14 months (Google Analytics default, then aggregated).
- Support correspondence: 3 years from last contact.
8. Your Rights (UK GDPR)
- Access: Request a copy of your personal data.
- Rectification: Ask us to correct inaccurate data.
- Erasure: Ask us to delete your data where there is no overriding legal basis.
- Restriction: Ask us to limit how we process your data.
- Portability: Receive your data in a structured, machine-readable format.
- Objection: Object to processing based on legitimate interests.
- Withdraw consent: Withdraw analytics/advertising consent at any time without affecting prior lawful processing.
To exercise these rights, email admin@lyrionatelier.com. We will respond within 30 days.
9. Complaints and the ICO
If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):
- Website: ico.org.uk/make-a-complaint/
- Telephone: 0303 123 1113
We would appreciate the chance to resolve any concern before you contact the ICO, so please reach out to us first.
10. Data Security
We use SSL/TLS encryption for data in transit, secure storage practices, and restrict employee access to personal information. While we work to safeguard your information, no method of transmission or storage is completely secure.
11. International Data Transfers
Some of our service providers operate outside the UK. Where transfers occur, we ensure appropriate safeguards are in place (such as the UK International Data Transfer Agreement or adequacy decisions).
12. Changes to This Policy
We may update this Privacy Policy periodically. We will post the new effective date at the top of the policy. Material changes will be communicated via the Site or by email where appropriate.
13. Contact Us
LYRION LTD, company number 16904877, registered in England and Wales. Registered office: Flat 9 Centro, 399 South Row, Milton Keynes, MK9 2PG.
Email: admin@lyrionatelier.com
We respond to privacy inquiries within 30 days.