Privacy Policy

This explains what we do with your personal data, why, and what you can ask us to do about it.

Who is responsible

Reesmen Ltd is the data controller — the company that decides why and how your data is used. We are registered in England & Wales, company number 17263287, at Unit A, 13074, 6 Greatorex Street, London E1 5NF, United Kingdom.

For anything to do with your data, email [email protected].

What we collect, and why

If you buy something

• Your email address. To send your order and what you bought, and so you can find the order again afterwards.
• Your order. What you bought, what it cost, when, and whether it was delivered.
• Your confirmation that you wanted immediate delivery, with the date and time. This is the record that shows why your cancellation right ended, and we would need it if a payment were ever disputed.

Our lawful basis is performance of a contract — we cannot sell you something without it — and, for keeping the records afterwards, legal obligation and legitimate interests in being able to answer a dispute.

If you create an account

• Your name, email address and, if you give one, phone number.
• A cryptographic hash of your password. We never store your actual password, and cannot recover it — which is why a reset link is the only way back in.
• Your notification preferences.
• Sign-in activity, including failed attempts, so we can lock an account somebody is trying to break into.

Automatically

Our server keeps ordinary technical logs, and we set a small number of strictly necessary cookies — see our Cookie Policy. We do not use analytics, advertising or tracking cookies, and there is nothing on this site that follows you to another one.

Counting visits

If you allow it, we count visits so we can see which pages and which links actually work. It runs on our own servers; there is no analytics company involved and the figures are not shared with anyone.

Nothing is stored on your device for this. There is no analytics cookie. To tell one visit from another we compute a one-way fingerprint from your connection and browser, mixed with a secret only our server holds and with today’s date. It cannot be reversed and it changes at midnight, so it counts a day rather than following a person — the honest cost being that if you come back tomorrow, you are counted twice.

Each page you open records:

• That daily fingerprint, so two pages in one visit are not counted as two visitors.
• The page path — /products, not the query string after it. Our query strings can carry order numbers and reset links, and those have no business in a statistics table.
• The site that linked you to us, as a host name only — t.me, never the full address of the page you were on.
• The country the connection appeared to come from, when our network tells us. Often it does not, and the report then says Unknown rather than guessing.

We never store your IP address. It is used in passing to work out a country and is not written down.

Because nothing is kept on your device and nothing here identifies you, this needs no consent banner — but you can still opt out at any time on the cookie policy page. Opting out stops it immediately and deletes whatever was counted for you that day.

Cloudflare, which every request passes through

The site is served through Cloudflare. Every request reaches us through their network, so they handle the encrypted connection and see the address it came from. They also run the “are you human?” check on sign-in, registration and checkout, which is what keeps those pages usable rather than overrun.

Cloudflare also measures how quickly pages load for real visitors. That measurement is cookieless — nothing is stored on your device for it — and it reports speed and errors rather than anything about you. It runs on every page, including before you answer the banner below, which is why it is described here rather than listed as something you opt into: there is nothing kept on your device to opt out of, and we would rather name it than leave it unmentioned.

Google Analytics, if you accept it

Separately from the above, we offer Google Analytics. It is the only thing on this site that asks your permission, and it does nothing until you give it.

Our lawful basis is your consent, and nothing else — so you can withdraw it at any time, on the same cookie policy page, as easily as you gave it. Withdrawing does not affect anything we did while you had consented, and it stops anything further at once.

If you accept, Google sets two cookies and receives which pages you open, roughly where you are, and which site linked you here. We ask it for traffic measurement only: Google’s advertising features, signals and remarketing are switched off for this property and there is no setting on this site that turns them on. Google is in the United States, so this transfer leaves the UK — see the processor table below for the safeguard it relies on.

If you decline, no Google cookie is set and nothing identifying is sent. We strip the query string before the page address is reported either way, so an order number or a reset link never reaches Google.

What we do not do

• We do not sell your data. Not to anyone, for any price.
• We do not send marketing you did not ask for. If you buy without an account, you get your order and nothing else.
• We do not store the contents of messages we send you. We record that an email was sent, to which address and when — never what was in it. That is why what you bought exists in your inbox and nowhere else on our side, and why we can re-send it but never read it back to you.
• We do not store payment card details. We never see them.

Who else processes your data

These companies process data on our behalf, under contract, and only on our instructions:

Where a processor is outside the UK, the transfer is covered by the standard contractual clauses and the UK addendum.

How long we keep things

• Orders and delivery records: permanently. They are our accounting records and the evidence behind any dispute, and UK law requires company records to be kept for six years. We do not delete or edit an order once it is placed.
• Account details: until you close the account. After that we keep only what is attached to your orders.
• Sign-in and security records: 12 months.
• Visit counts: kept. Comparing this year with last year is most of what they are for. They are not a history of anybody: the daily fingerprint that groups them cannot be reversed and cannot be joined across days, so what remains is how many people opened which page, and when.

Your rights

You can ask us to:

• Give you a copy of the data we hold about you.
• Correct anything that is wrong.
• Delete your account and personal details. We will, but we cannot delete an order — it is an accounting record, and keeping it is a legal obligation rather than a choice.
• Stop sending you anything that is not about an order.
• Give you your data in a portable format.

Email [email protected] and we will respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk, though we would rather you told us first so we can put it right.

Keeping it safe

Everything travels over an encrypted connection. Passwords are stored as one-way hashes and session tokens only as digests, so a stolen copy of our database would yield neither. Everything we hold in stock — account details, keys and files alike — is encrypted at rest with a key held separately from the database, so the same is true of your purchases. Access to customer data is limited to the people who need it, and every time somebody reads one it is recorded.

Children

This service is not intended for anyone under 16, and we do not knowingly collect their data.

Changes

If we change this policy we will update the date at the bottom of this page, and tell account holders if the change is significant.