Privacy policy

Hoop & Ink is a UK business. You can reach us at support@hoopandink.com.

We have two roles. For your account (the people who sign up and use Hoop & Ink) we decide how data is used, so we’re the controller. For your customers’ details that a shop puts into Hoop & Ink (names, contacts, orders, artwork), the shop is the controller and we’re its processor: we only use that data to run the service for the shop. Our terms set out how we look after it.

• Account details: your name, email address and password (stored only as a secure hash), or your Google profile name and email if you sign in with Google. For admins, the two-step sign-in (authenticator app) settings.
• Your shop: its name, contact details, address, logo, VAT details, price tables, garments, team members and settings.
• What you put in for your customers: customer names, contact names, emails, phone numbers and addresses, notes, quotes, jobs, artwork, mockups, names-and-numbers lists, and supplier orders.
• When a customer replies to a quote link: the name they type to approve, the time, their IP address (kept as a record of the approval), any change requests and photos they send.
• Billing: your plan, trial dates and whether payments succeeded. Card details go straight to Paddle, our reseller; we never see or store them.
• Website forms: your email if you ask for the price guide, and your shop name, email, message and price list if you ask us to set up your tables.
• How you use Hoop & Ink: how far you’ve got with setting up, and which features you use (for example quotes sent, proofs, reorders, exports and PDF downloads). It’s worked out on our own servers from your account; nothing is stored in your browser for it.
• Website visits: how many people visit our website and sign-up pages, which pages, and where they came from (for example a search engine). It’s counted without cookies and doesn’t identify you or follow you to other sites.
• Technical records: server error logs (the page and time, not what you typed), failed email deliveries, and short-lived IP-based counters that stop people hammering the sign-in and quote-link forms.
• Support: emails you send us, and a log of any time our support team views your account (see section 8).

• To provide the service you signed up for (contract): your account, your shop, sending the quotes, proofs, reminders and orders you ask us to send, and your free month and billing.
• To keep it secure and working (legitimate interests): sign-in protection, stopping abuse, fixing errors, backups, and support.
• To improve Hoop & Ink (legitimate interests): seeing where shops get stuck and which features they use, and counting website visits, so we know what to fix and build next. We look at this as totals across all shops wherever we can, and we never use your customers’ details for it.
• To tell you about your account (contract): for example the email 3 days before your first charge. We don’t send marketing to shops unless you’ve asked for it.
• The price guide emails (consent): one email now and one when the next edition is out. Reply “stop” and we’ll stop.
• Tax and accounting (legal obligation): Paddle keeps the records the law requires for your subscription payments.

We use a small number of trusted providers. They only use the data to provide their service to us, under contracts that require them to protect it.

• Supabase: database, file storage and sign-in. Your data is stored in London (UK).
• Vercel: hosting, and the cookie-free count of website visits. The app runs in London; pages are delivered through Vercel’s worldwide network.
• Resend: sends the emails (quotes, proofs, reminders, sign-in links).
• Paddle: our reseller and merchant of record for subscriptions. Paddle takes the payment, handles VAT and sends invoices, under its own privacy policy.
• Google: only if you choose “Continue with Google” to sign in.
• Porkbun: forwards email sent to support@hoopandink.com to our inbox.

We don’t sell personal data, and we don’t share it with advertisers. We’d only share it otherwise if the law required us to.

Your stored data stays in the UK. Some providers above (for example the email service) may handle data in the EU or the US while doing their job. When that happens we rely on the safeguards UK law allows, such as the UK’s adequacy regulations or the International Data Transfer Agreement and its addendum.

• Your account and shop data: for as long as your account exists. If your plan ends or a payment fails we keep it (read-only) so you can export it or carry on. Ask us to delete your account and we’ll delete it within 30 days; backups roll over within a further 30 days.
• Customer approvals and replies: as part of the shop’s quote records, for as long as the shop keeps them.
• Records of which features you use: while your account exists; after that only as anonymous totals.
• Error and email-delivery logs: 30 days. Sign-in and form abuse counters: 1 day.
• Website form requests: until you ask us to delete them, and no more than 2 years after we last heard from you.
• Support and security records (including support access to accounts): up to 2 years.
• Payment records: Paddle keeps these for as long as tax law requires.

We only use what the site needs to work: cookies that keep you signed in, and your light or dark theme choice saved in your browser. There are no advertising or tracking cookies, and our count of website visits doesn’t use cookies at all, so there’s nothing to accept or decline.

When you pay, Paddle’s checkout sets its own cookies to work.

If you ask for help, or to keep the service safe, our support team may open your account read-only: they can see it as you do but can’t change or send anything. Only named Hoop & Ink staff can do this, with two-step sign-in, and every visit is listed for you in Settings → Plan and billing.

Everything travels encrypted (HTTPS). Each shop’s data is walled off from every other shop’s at the database level, artwork is kept in private storage reached only through short-lived links, and staff access needs two-step sign-in. No system is perfectly secure; if something goes wrong that affects your data, we’ll tell you and the ICO as the law requires.

Under UK data protection law you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct anything that's wrong;
• delete it, or stop or limit how we use it;
• give it to you in a format you can take elsewhere (you can also export your shop data yourself, any time, from Export);
• stop using it where we rely on legitimate interests, or withdraw your consent.

Email support@hoopandink.com. We’ll reply within a month. If your request is about a shop’s customer records (for example, you’re one of their customers), we’ll pass it to the shop, which decides.

If you’re unhappy with how we’ve handled your data you can complain to the Information Commissioner’s Office at ico.org.uk, though we’d like the chance to put it right first.

Hoop & Ink is for businesses and isn’t meant for anyone under 18.

When we change this page we update the date at the top. If a change matters to how your data is used, we’ll email account owners before it takes effect.