Privacy policy

Who is responsible for your data

10ML, the operator of 10ml.com, is the controller of your personal data. For anything in this policy, or to use any of your rights, write to contact@10ml.com. Your email goes straight to the people who handle customer data.

What we collect and why

• When you order: your name, email address, delivery address, phone number (passed to the courier for delivery only), the items you buy and what you paid. We use this to take payment, pack and deliver your order, send your order emails, handle returns and keep the accounting records the law requires. The legal bases are the performance of our contract with you (Art. 6(1)(b) GDPR) and our legal obligations under tax and accounting law (Art. 6(1)(c)). We cannot deliver an order without these details.
• When you pay: Stripe handles the payment. We receive the result and limited card details such as the card brand and last four digits, never the full number. Stripe also screens each payment for fraud, using information such as your IP address and device. Legal bases: our contract with you, and the legitimate interest that we and Stripe share in preventing fraud (Art. 6(1)(f)).
• When you create an account: your name, email address, a password (stored only in scrambled, hashed form), saved addresses and your order history. If you sign in with Google or Facebook, we receive your name, email address and account ID from them. We never see your password for those services and we never post anything on your behalf. Legal basis: our contract with you.
• When you write to us: your email address and whatever your message contains, so that we can answer. Legal basis: our legitimate interest in answering you, or our contract where your message concerns an order.
• When you sign up for our newsletter: your email address, used to send you new arrivals and news from 10ML. We also use the address you give us, in the newsletter form or our sign-up window, to remind you about items left in your bag, and you can unsubscribe from any of these emails. Legal basis: your consent (Art. 6(1)(a)). Every newsletter has an unsubscribe link, and you can withdraw your consent at any time.
• When you browse: our servers process your IP address, browser type and the pages you request, which is what it takes to deliver a website and keep it secure. We also use your IP address to work out which country you are in, so the product page can show delivery information for it. Your browser remembers that country code for 24 hours; we do not store the IP address for this. Legal basis: our legitimate interest in running a secure, working shop (Art. 6(1)(f)).
• Where your visit came from: the first time you arrive, we note the page you landed on, the website that sent you, any campaign tags in the link (such as utm_source) and, if you came from an AI assistant such as ChatGPT, Perplexity, Gemini, Copilot or Claude, which one. If you arrive from a Google, Meta or TikTok ad, we also keep the ad click code from the link. Your browser keeps this in our own cookies, and it is attached to your order when you buy, so we can tell which channels bring customers. Legal basis: our legitimate interest in knowing which of our marketing works (Art. 6(1)(f)).
• Analytics with PostHog: PostHog records the pages you view and the main steps of shopping: viewing a product, adding it to your bag, opening your bag, starting checkout and placing an order (with its value and sizes, never your name, email or address). It also notes where on a page people click and how far they scroll, which we see as heatmaps. It sets no cookies. To tell one day’s visits apart, PostHog derives a one-way code from your IP address, browser details and our web address with a key that changes every day, then discards the IP address and browser details. When you place an order, our server sends the order to PostHog with the IP address and browser details from your checkout, so it lands on the same code. PostHog does not record your screen or sessions.
• Analytics with Google Analytics: Google Analytics 4 measures visits, where they came from, which products are viewed and added to the bag, and purchases. It uses cookies in your browser to do this. When you place an order, our server also reports the purchase to Google Analytics (its Measurement Protocol) with the order number, value, products and the visitor and visit codes from those cookies, so the purchase is counted even if your browser blocked the tag. No name, email or address goes to Google Analytics.
• Advertising with Google Ads: the Google Ads tag records visits, items added to the bag, checkouts started and purchases, so we can see which ads lead to sales and show our ads to people who visited the shop. On the order confirmation page it also receives your email address, phone number and name in one-way hashed form (enhanced conversions), which lets Google match the purchase to an ad click without receiving them in readable form.
• Advertising with Meta (Facebook and Instagram): the Meta Pixel records page views, product views, items added to the bag, checkouts started and purchases. Our server sends the same events to Meta through its Conversions API, with your IP address, browser details and the Meta cookie codes from your browser, so an event still counts when the pixel is blocked. For purchases, the pixel and the server also send your email address, phone number, name, city, postcode, country and customer number in one-way hashed form, plus the order value and products. Meta uses this to measure our ads and to show them to people likely to be interested.
• Legal basis for analytics and advertising: our legitimate interest in understanding how the shop is used, improving it and measuring and running our advertising (Art. 6(1)(f)). You can object at any time, and you can switch most of it off yourself (see “How to switch tracking off” below).
• Error monitoring: when something on the site breaks, Sentry receives a technical report: the error, the page address, and your browser and device type. It is set up not to collect your name or email address, and session recording is switched off. Legal basis: our legitimate interest in a working shop (Art. 6(1)(f)).

Who we share it with

We do not sell or rent personal data. These service providers process data on our behalf, under data processing agreements and only on our instructions:

• Vercel hosts the website.
• Render hosts the system that runs our orders and accounts, on servers in the EU.
• Supabase runs our database, on servers in the EU.
• Stripe processes payments. For fraud prevention and its duties under financial regulation, Stripe acts as a separate controller under its own privacy policy.
• Resend sends our order and account emails.
• Google Workspace hosts our mailbox, where your emails to us arrive.
• PostHog provides the cookieless analytics described above, from servers in the EU.
• Google provides Google Analytics and Google Ads, as described above.
• Meta provides the Meta Pixel and the Conversions API, as described above.
• Sentry provides error monitoring, from servers in the EU.
• Cloudflare stores and delivers the images on our site.

We also share data with:

• Google and Meta, which also use the measurement data they receive for their own purposes, such as running and improving their advertising systems. For those purposes they act as separate controllers under their own privacy policies;
• our warehouse and delivery partners, who receive your name, delivery address, phone number and the contents of your order so they can pack and deliver it;
• Google or Facebook, only if you choose to sign in with them; they act as separate controllers under their own privacy policies;
• authorities, courts and professional advisers, where the law requires it or where it is needed to establish or defend legal claims.

Transfers outside the EU

Our database, order system, PostHog analytics and error monitoring are hosted in the EU. Some of the providers above, including Vercel, Stripe, Resend, Google, Meta and Cloudflare, are based in the United States or may process data there. Those transfers rely on the EU–US Data Privacy Framework for certified providers, or on the European Commission’s Standard Contractual Clauses.

How long we keep it

• Orders and invoices: as long as tax and accounting law requires, which can be up to ten years.
• Your account: until you close it. We then delete your account data, except the order records we must keep.
• Emails with us: as long as we need them to deal with your request, and no longer than three years after it is resolved.
• Newsletter: until you unsubscribe.
• Your bag: your browser stays linked to it for 30 days after your last change to it.
• Where your visit came from: the record of your first visit lasts up to 365 days, ad click codes 90 days, and an AI-assistant referral counts for 30 days. When you order, the order keeps a copy for as long as the order records.
• Analytics: Google Analytics keeps visit and event data for no more than 14 months. PostHog keeps analytics events for one to seven years, depending on our PostHog plan, and never with your IP address.
• Advertising: what Google Ads and Meta receive is kept under their own retention rules; we hold no separate copy beyond the order record.
• Server logs and error reports: a short period, after which they are deleted automatically; error reports are kept for no more than 90 days.

Your rights

Under the GDPR you have the right to:

• get a copy of the personal data we hold about you (access);
• have inaccurate data corrected;
• have your data deleted, where we have no legal reason to keep it;
• restrict how we use your data while a question about it is resolved;
• receive the data you gave us in a portable, machine-readable format;
• object to any use of your data based on our legitimate interests, including analytics and advertising measurement;
• withdraw your consent at any time, where we rely on it, without affecting what we did before.

Write to contact@10ml.com and we will reply within one month. We may ask you to confirm your identity first. You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live or work.

How to delete your data

To have your account and the personal data linked to it deleted, write to contact@10ml.com from the email address on your account and ask us to delete your data. We delete it within one month, except the order records that tax and accounting law requires us to keep.

If you signed in with Facebook, you can also remove 10ML from your Facebook account: in your Facebook settings, open “Apps and websites”, choose 10ML and select Remove. Facebook then stops sharing your details with us. To delete what we already hold, write to us as above.

How to switch tracking off

• In your browser: block or delete cookies in your browser settings, or use a private window, and the Google and Meta cookies go with them. A content blocker stops the Google Analytics, Google Ads and Meta tags from loading at all. Blocking cookies does not stop the shop working, but your bag will not be remembered between visits.
• Google Analytics: Google’s opt-out browser add-on stops it on every site.
• Google ads: turn off personalised ads in My Ad Center.
• Meta ads: in your Facebook or Instagram settings, under Accounts Centre, open “Your activity off Meta technologies” to disconnect or clear what shops send to Meta.
• Anything else: write to contact@10ml.com to object to analytics or advertising measurement, or to ask us to delete the analytics data linked to your orders. We reply within one month.

Automated decisions

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Stripe’s fraud screening may automatically decline a payment it judges high-risk. If that happens to you, write to us and a person will look at it.

Cookies

We use cookies and browser storage for three things: to make the shop work (your bag, signing in, checkout), to remember where your visit came from, and for the Google Analytics, Google Ads and Meta tags described above. PostHog sets none.

Children

Our shop is not aimed at children under 16, and we do not knowingly collect their personal data.

Security

Every connection to our site is encrypted. Payment details stay with Stripe, and access to customer data is limited to the people who need it for their work.

Changes to this policy

When our use of personal data changes, we update this policy and the date at the top of it. For significant changes, we will also tell customers by email.