Privacy

What we collect when you order, why, and what we do with it. Short, because we don't do much with it. Last updated 1 October 2026.

Who's responsible

Seriously Rare is the trading name of Nic Sunde, sole trader, Seriously Rare, Suite 151, Unit 7 Ladywood Works, Lutterworth LE17 4HD, and is the data controller, registered with the Information Commissioner's Office under registration number ZC260971 (see the entry on the ICO register). Contact [email protected] about anything to do with your data.

What we collect and why

When you order: your name, delivery address, email address and, if you give it, phone number, plus what you bought and what you paid. We use these to take payment, pack and post your order, email you the confirmation and tracking, and deal with any return or problem. The legal basis is that we need them to carry out the contract with you. Your card details go straight to Stripe over an encrypted connection; we never see or store them.

If you create an account: your email address and password (which is stored only as a one-way hash, so nobody here can read it), the name you choose to show, any delivery addresses you save, an optional birthday day and month if you give one, your loyalty tier, and a record of which version of these terms and this notice you agreed to and when. If you sign in with Google we receive your name, email address and Google account id, and nothing else. An account is optional — you can order as a guest. The legal basis is the contract with you, and our legitimate interest in keeping your order history in one place. Your account and everything in it are yours to export or delete at any time from your settings.

Your wishlist and your collection: if you press the heart on an item, we store which item it is, any target price you set, and the date. If you tick cards off in the set tracker, we store which cards you have said you own — nothing else about them, and nobody but you can see either list. We use the wishlist to email you at most one summary a day when something on it comes back in stock or drops below your price, and the collection to work out which cards you are missing and whether we have them. The legal basis is our legitimate interest in providing the service you asked for by saving the item; because you asked for it, these alerts are sent whether or not you have opted in to marketing. Every one of them carries a one-click unsubscribe, and stopping them stops only these — your order confirmations are unaffected. If you are not signed in, your hearts are kept in your own browser and never reach us until you create an account. Both lists are deleted with your account, and both are in your data export.

Marketing email: only if you tick the box, which is never ticked for you. We record the date, the version of this notice and your choice each time it changes, because the law requires us to show that consent was given. You can withdraw it at any time in your settings or from any email we send.

For our records: we keep order and payment records for six years because HM Revenue & Customs requires it. That's a legal obligation.

Security and fraud: Stripe and our hosting provider (Cloudflare) record technical information such as your IP address to keep the checkout and website secure and to spot fraud. We also keep a little ourselves, only to stop one person from taking several places in a free draw or several units of a limited item, and to stop automated sign-ups: when you create an account, sign in, enter a draw or start a checkout we record the network you connected from (the first three parts of an IPv4 address, or the first three blocks of an IPv6 one — never your full address), the network operator and country Cloudflare reports for it, and a one-way hash of your browser's user-agent. These are deleted after 90 days. From the email address, delivery address and card fingerprint we already hold to fulfil orders we work out one-way keys (the email address without dots or +tags, the postcode with the house number and flat) to notice when two accounts look like the same person or household, and a trust score from these signals. A score never refuses anybody on its own: it only sends a draw entry or an order to a person to check, and you can always ask us to look again at [email protected]. The legal basis is our legitimate interest in preventing fraud and keeping draws fair (UK GDPR Article 6(1)(f); Recital 47 names fraud prevention as one). We have written down the balancing test, and you can ask us for it. We never use any of this for marketing.

When you email us: we keep the conversation for as long as it takes to sort out your query and for two years after, in case it comes up again.

We only send marketing email to people who have asked for it, and every one carries an unsubscribe link.

Who we share it with

Only the people needed to get your order to you: Stripe (payments; Stripe processes some data in the United States under the UK–US data bridge and standard contractual safeguards), Revolut (only if you choose to pay with Revolut Pay at checkout, under Revolut's own privacy notice), PayPal (only if you choose to pay with PayPal at checkout, under PayPal's own privacy notice), Royal Mail (name and address on the label), Resend (which delivers our emails, including sign-in and confirmation emails), Supabase (which hosts the database and runs the sign-in system, in the EU/UK), Cloudflare (which hosts and protects the website, provides the "are you human" check on the sign-in forms, draw entry and checkout for limited items, and gives us simple visitor counts through Cloudflare Web Analytics, which uses no cookies, no browser fingerprinting and no identifier of any kind — it tells us how many people visited which pages, not who), Google (only if you choose to sign in with Google, or when Google delivers an email to a Gmail address), and our accountant. We'll disclose data if the law requires it. We don't sell or rent your details to anyone.

Cookies and browser storage

This site sets no advertising or analytics cookies and doesn't track you across the web (our visitor counts come from Cloudflare Web Analytics, which works without cookies or identifiers). It stores a few small things in your browser, all needed for the site to work as you've asked: your bag (so it survives a page refresh), any items you have hearted before signing in (moved to your account, and cleared from the browser, the first time you sign in), your light-or-dark-mode choice if you've pressed the button, your sign-in if you have an account (two cookies the website itself cannot read, plus one holding only the name you chose, so the header can say "Account"), a random browser id (sr_dev, one year) used only to notice the same browser signing up for its own referral bonus or entering a draw twice — never for analytics or marketing, which is what makes it strictly necessary — and — only if you are us — the admin sign-in. Stripe's checkout page sets its own security cookies, and Cloudflare's "are you human" check (Turnstile, on the sign-in forms, draw entry, and checkout for limited items) sets its own. Because all of these are strictly necessary, there's no cookie banner. You can clear them at any time in your browser settings.

Deleting your account

You can close your account yourself in your settings. That deletes your sign-in, your profile, your saved addresses, your wishlist and your collection tracker, and removes your card details from Stripe. Your past orders stay in our books for six years because HM Revenue & Customs requires it, but your name, email address and delivery address are stripped from them, so they are no longer about an identifiable person. We can't close an account while an order is still on its way — email us and we'll do it as soon as it has been posted.

Your rights

You can ask us for a copy of the data we hold about you, ask us to correct or delete it, restrict or object to how we use it, or ask for it in a portable format. Email us and we'll respond within a month; we can't delete order records we're required to keep for tax, but we'll tell you if that applies. If you're unhappy with how we've handled your data, tell us first and we'll reply within 30 days. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.