Privacy
What happens to your information when you visit this site, send me an email, or order something. It is short, because this is a one-person art shop and there is genuinely not much to tell.
Last updated:
The short version
- This website has no forms, no accounts, no shopping cart, and no cookies. It does not track you.
- There is no analytics on this site. I do not know who you are or how many of you there are.
- Buying happens on Etsy (and, in time, other shops). They take your payment and hold your details, not me. I never see your card details.
- If you order a commission, I get your pet's photo and — for a physical print — your name and delivery address. That is the lot.
- Your pet's photo is worked on on my own computer. It is not uploaded to any third-party AI service.
- You can ask me what I hold and ask me to delete it: [email protected].
Who I am
I am Nathan Graves, a sole trader working as With Nate, based in New Holland, Lincolnshire, United Kingdom. For data protection law I am the “controller” of the information described here, which means I am the one responsible for it and the one you complain to first.
- General enquiries: [email protected]
- Anything about your data or this policy: [email protected]
I have no postal address for customer correspondence — this is a home-based one-person business, so email is the way to reach me. If you need a postal address in order to exercise a legal right, email me and I will give you one.
What this website collects: nothing
This is worth being specific about, because most privacy policies say a version of this and then quietly mean the opposite. On withnate.co.uk there is:
- no contact form, newsletter form, or form of any kind;
- no account to create and no password to store;
- no shopping cart or payment processing;
- no cookies, and nothing stored in your browser;
- no analytics, no tracking pixels, no session recording, no advertising tags;
- no JavaScript on this site that sends anything anywhere. The only scripts are the moving background and the picture gallery, and they talk to nobody.
That is also why there is no cookie banner. There is nothing to consent to.
What happens anyway, because the site has to be hosted
The site is hosted by Cloudflare. Like any web host, their servers record technical details of each request so the site can be delivered and protected from attacks: your IP address, your browser and device type, the page you asked for, and the time you asked for it. I do not use this to build any picture of you, and I have no way of linking it to your name.
Two smaller things, mentioned because they are true rather than because they matter much:
- If your browser fails to load part of the site, Cloudflare may ask it to report that failure back to them so the fault can be found. Successful visits are never reported this way.
- Cloudflare automatically scrambles the email addresses shown on these pages so that spammers cannot harvest them, which involves a small script of theirs running on the page.
Cloudflare acts as my processor for hosting. Their privacy policy is at cloudflare.com/privacypolicy.
If you email me
Email to withnate.co.uk addresses is forwarded by Cloudflare Email Routing into a Google (Gmail) mailbox, so both Cloudflare and Google handle it on the way. I keep correspondence for as long as it is useful — an enquiry that goes nowhere is deleted within about a year, and anything attached to a real order is kept with that order.
If you buy something
I do not sell anything directly from this website. Sales happen on Etsy, and I also have shops on Gumroad and itch.io which I use as I add products to them.
Those shops are separate data controllers in their own right. They take your payment, they hold your account and your payment details, and how they use your information is governed by their own privacy policies, not this one. I would encourage you to read whichever one you are buying through.
What reaches me from a sale is limited:
- your name, or whatever name you shop under;
- your delivery address — only if you have bought something physical that has to be posted;
- the order number and what you bought;
- any messages you send me through the shop.
I never see your card or payment details. Those never reach me at any point.
Commissions, and your pet's photo
If you order a custom portrait you send me a photo, either through Etsy's messages or by email. This is the only part of the business where I handle something genuinely personal to you, so it gets its own section.
- What I use it for: making your portrait, and nothing else.
- Where it is worked on: on my own computer, here in the UK. The AI image tools I use run on my own hardware. Your photo is not uploaded to ChatGPT, Midjourney, or any other third-party AI service, and it is not used to train anything.
- How long I keep it: up to 12 months after your order is finished, so that I can do reprints, fix a problem, or make you another size without having to ask you for the photo again. After that I delete it. You can ask me to delete it sooner and I will.
- Showing your portrait: I will not use your finished portrait as an example in my shop or on social media unless you say I can.
Two honest warnings. First, photos taken on a phone often carry hidden information including where the photo was taken; if that bothers you, most phones can strip it before sending. Second, please do not send me photos with other people in them — friends, family, children — unless they are happy for you to. It is their information as much as yours, and I would rather not hold it.
Physical orders and printing
Prints are made to order by a print partner rather than by me, so if you order something physical your name and delivery address are passed to whoever is making and posting it — currently Printify and its UK print providers, including Prodigi. They receive only what is needed to print your order and put it in the post.
Why I am allowed to use your information
Data protection law requires me to have a specific reason, called a lawful basis, for each thing I do. Mine are:
- Making and sending your order — your name, delivery address, order details and your pet's photo. Basis: performance of a contract, because you have asked me to make you something.
- Replying to your email — your address and whatever you wrote. Basis: legitimate interests, namely answering someone who has contacted me.
- Keeping business and tax records — records of what was sold and to whom. Basis: legal obligation, because HMRC requires it.
- Keeping the site online and secure — the hosting records described above. Basis: legitimate interests, namely running a website that works and is not being attacked.
How long I keep things
- Your pet's photo: up to 12 months after the order is finished.
- Order and correspondence records: kept with the order.
- Enquiries that do not become orders: about a year.
- Records I need for tax: kept as long as HMRC requires, which for a sole trader is currently at least five years after the relevant filing deadline.
- Hosting records: held by Cloudflare on their own schedule, not mine.
Information going outside the UK
Cloudflare, Google, Etsy, Gumroad, itch.io and Printify are international companies, so some of the information described here is handled outside the United Kingdom. Where that happens it is covered by the safeguards UK data protection law provides for international transfers, such as the UK Addendum to the standard contractual clauses, or by the country in question being formally recognised as having adequate protection.
Your rights
You have the right to:
- ask what information I hold about you, and get a copy;
- have anything wrong corrected;
- have your information deleted;
- ask me to stop or limit what I am doing with it;
- object to my using it on the basis of legitimate interests;
- receive it in a portable format.
Email [email protected] and I will answer within one month. It is free. I may ask you something to confirm you are who you say you are, so I do not hand your details to somebody else.
Note that for anything you did on Etsy, Gumroad or itch.io, those requests are usually better made to them, since they hold far more about your purchase than I do. I will point you in the right direction if you are not sure.
Automated decisions
I do not use automated decision-making or profiling. Nothing here decides anything about you. AI tools are used to make artwork, under my direction and checked by me — that is a paintbrush, not a decision about you.
Children
This shop is meant for adults and I do not knowingly collect information about children. If you think a child has sent me something, email me and I will delete it.
Complaints
If I have got something wrong, please tell me first — email [email protected] and I will try to put it right. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office, at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to come to me first.
Changes to this policy
If what I do with your information changes, I will update this page and change the date at the top. There is no mailing list to notify, so the date is the honest signal.