Privacy notice

Nyoki Limited (trading as Nyoki Handmade) is responsible for your personal information - in the law's words, the "controller". To ask us anything about it, use our Contact page or email support@nyoki.co.uk, or write to us at Unit 302, 3A Howick Place, London SW1P 1WG.

• When you order: your name, email address, phone number if you give one, and delivery address; for a gift, the name and address of the person it's for and your note; the words for anything personalised; and what you bought and paid. We use them to make, send and look after your order, and to answer you about it, because that is our contract with you.
• When you pay: your card details go straight to Stripe, who handle our payments. We see that you've paid, and perhaps the type of card and its last four digits - never the whole number. Stripe also checks payments for fraud, which is in both our interests.
• If you open an account: your name, email address and password (kept only in a scrambled form that can't be read back), the addresses you save, the pieces you save with a heart, and your basket. We keep them to give you the account you asked for.
• When you ask a question: your name, email address, your question and the piece it's about, so we can answer you. That is our legitimate interest, and yours.
• When you write a review: the stars and words you give a piece, the name you choose to show with them, your account, and whether you bought the piece from us. Once we've read it, we publish the name, the stars, the words, the date and whether it's a verified purchase - never your email address. That is our legitimate interest, and other shoppers': honest reviews help people choose.
• Records the law asks for: we keep order and payment records for our accounts and for tax, because the law requires it.
• Visiting the site: the company that hosts our website keeps a short record of visits, such as internet addresses and browsers, to keep the site running and safe. The shop itself also counts attempts to sign in, open an account, send a question, write a review or use a promo code, by a scrambled form of the email given or of your internet address that can't be turned back into either, so that nobody can try again and again. That is our legitimate interest in a shop that works and can't be attacked.

You don't have to give us anything, but we can't take an order without a name, an email address and somewhere to send it.

If you give us someone else's details - the person a gift is for, or a name to go on a piece - we use them only for your order. Please give them only if you believe they'd be happy for you to. Our shop is for adults; a child's name for a piece is used only to make it.

We don't send marketing emails. If we ever do, it will only be to people who have asked for them, or to customers about pieces like the ones they've bought, always with a simple way to stop them. We make no decisions about you by automated means.

Only the companies that help us run the shop, each only with what it needs, and each bound to keep it safe:

• Stripe, who take card payments;
• Royal Mail, who deliver: your name and address, and your email or phone number if they need it to tell you about your parcel;
• Vercel, who host our website and the photos on it;
• Neon, who host the database our orders and accounts are kept in;
• our email provider, when we write to you;
• our accountant, and HMRC, as the law requires.

We would share it with the police or a court only if the law required us to. We never sell your information, or share it for anyone else's marketing.

Vercel and Neon are American companies and Stripe works worldwide, so your information may be stored or handled outside the UK, including in the US and the EU. Where it is, it's protected as UK law requires: by the UK's rulings that a country protects data adequately (the UK-US data bridge among them), or by the contract terms approved for UK data protection.

• Orders and payments: six years after the end of the financial year they belong to, as tax and company law require.
• An order you start but don't pay for: until it's clear you won't come back to it, and six months at most.
• Your account: for as long as it's open. Ask us to close it and we delete your password, saved addresses, saved pieces, reviews and basket, keeping only your past orders, for the time above.
• Questions: until they're answered and no longer needed, and a year at most.
• Reviews: until you delete yours, or ask us to.
• Visit records at our host: a few days.
• Counts of attempts to sign in, open an account, send a question, write a review or use a code: a day.

The site is only ever reached over a secure connection. Passwords are kept scrambled, the cookies that keep you signed in can't be read by other scripts on the page, and only the people who run the shop can see orders.

You can ask us:

• for a copy of the information we hold about you;
• to correct anything that's wrong;
• to delete it, where we don't need to keep it;
• to stop or limit how we use it, or object to our using it;
• for your information in a form you can take elsewhere.

Ask through our Contact page or by email to support@nyoki.co.uk. It's free, and we'll answer within one month. We may ask you to show it's you first.

If you're unhappy with how we've handled your information, please tell us first, through our Contact page: we'll acknowledge it within 30 days and tell you what we've done. You can also complain to the Information Commission, the UK's data protection regulator, which took over from the ICO in 2026, at ico.org.uk/make-a-complaint.

The shop uses two small cookies it can't work without, and nothing that tracks you. Our Cookies page lists them.

If we change how we use your information, we'll update this notice and the date at the top.