Privacy notice

Who we are

Phantasm Ltd (company number 16597243), trading as Drawdroid, is a private limited company registered in England and Wales. Registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. We are the data controller for drawdroid.com.

Privacy questions: contact form or phantasmltd@gmail.com.

What we collect

We only collect what we need to run the shop, draw your order, and keep the site secure.

Orders

When you check out we receive your name, email, delivery address, order contents, and a payment reference from Stripe. We do not store card numbers. Stripe processes the card on its own pages.

Originals

We record which one-of-one drawing you bought so we can draw it, ship it, and mark it sold.

Design your own

We receive the style, settings, colours, orientation, and a copy of the design needed to plot the sheet.

Blueprints

We receive the photos you upload, plus make, model, and year if you give them, solely to compose and plot the drawing. Photos of vehicles, boats, aircraft, or firearms are used for that order only. We do not need the object itself — only photographs.

Contact, newsletter, and authentication

The contact form collects name, email, and message. Newsletter signup collects email, with your consent. The authentication page collects the 6-digit code on your drawing and an email so we can reply.

Reviews

If you leave a review we may publish a first name, country, star rating, and the text you wrote. Do not include information you do not want shown.

Promotions

If you enter a giveaway we may collect a social username, comments, a winner-verification PIN, and a delivery address so we can check the entry and ship a prize.

Technical data

Our servers and security tools may process IP address, browser type, and basic request logs. Forms are protected by Google reCAPTCHA.

Lawful bases

UK GDPR requires a lawful basis:

• Contract — taking payment, drawing, shipping, customer service, and authenticity checks on a drawing you bought.
• Legitimate interests — running the shop, preventing fraud and spam, keeping limited records, and improving the site in ways that do not override your interests.
• Consent — newsletter emails, and Google Analytics cookies. You can withdraw consent at any time.
• Legal obligation — tax, accounting, and answering a lawful request from an authority.

We do not sell personal data. We do not use it for automated decisions that produce legal effects.

Who we share with

We share data with processors who help us run the shop, only as needed:

• Stripe — payments, receipts, and refunds. See the Stripe privacy policy.
• Couriers — name, address, and phone if required, to deliver the parcel.
• Google — reCAPTCHA on forms, and GA4 analytics only if you accept analytics cookies. See the Google privacy policy.
• Email — we use email to send order and newsletter messages. Newsletter notices may be processed through Gmail on our business account.

Some of those providers are in the United States or other countries. Where we transfer data outside the UK we rely on the provider’s appropriate safeguards (such as the UK Addendum to the EU standard contractual clauses, or a UK adequacy regulation).

We may also disclose data if the law requires it, or to protect Drawdroid, our customers, or others from crime or serious harm.

Where we keep it

Order data is stored on our private servers and on the computer we use to fulfil drawings. It is not a public catalogue of customers. Photo uploads for blueprints are kept only to produce that order.

How long we keep it

• Paid orders and invoices — as long as UK tax and company law require (typically up to six years after the end of the relevant accounting year), then we delete or irreversibly anonymise what we no longer need.
• Working files on the fulfilment computer (including plot files and blueprint photos) — until the order is complete and any reasonable dispute window has passed, then we delete them unless we must keep a copy for tax or a dispute.
• Newsletter emails — until you unsubscribe or we close the list.
• Contact messages — as long as needed to deal with the enquiry, then a short archive for security.
• Promotion entries — as long as needed to run the promotion and show we ran it honestly.

Marketing

Checkout does not sign you up to marketing. The footer newsletter is optional and consent-based. Each newsletter mail will include a way to unsubscribe. We do not buy or sell mailing lists.

Children

The shop is aimed at adults. We do not knowingly collect data from children under 16. Firearm blueprint orders are for adults who lawfully hold the item they photograph.

Your rights

You may ask us for access, correction, erasure, restriction, portability, or to object to processing based on legitimate interests. You may withdraw consent for analytics or the newsletter. You may complain to the Information Commissioner’s Office at ico.org.uk.

Use the contact form or email phantasmltd@gmail.com. We may need to verify it is you.

Cookies and similar storage

We use essential storage to make the shop work. We only use analytics if you accept it on the cookie banner. We do not use advertising cookies.

Stripe and Google reCAPTCHA may set their own cookies on their domains when you pay or submit a form. We do not control those cookies. See their policies linked above.

You can refuse analytics, or later withdraw consent by clearing site data for drawdroid.com in your browser. Essential storage is needed for the cart and checkout.

Changes

We may update this notice when the shop changes. The date at the top is the current version. Continued use of the site after a change means you have seen the new notice.