Privacy policy

Blush & Brush is a trading name of [TO CONFIRM: your full name — you trade as a sole trader]. Our postal address is [TO CONFIRM: postal address for correspondence], and you can reach us at [TO CONFIRM: e.g. hello@blushbrush.co.uk].

We are the data controller for the information described here, which means we decide why and how it is used.

When you buy a box: the name, email address and delivery address you give at checkout, and what you ordered.

When you book a paint night: your name, email address, phone number if you give one, how many seats you booked, and whether you agreed to hear from us about future events.

On the night: our venue staff note who attended and any drinks ordered, so the evening can be run and paid for.

If you work with us: the name, email address and password needed for a staff account.

We never see your card details. Payments are handled entirely by Stripe. Your card number is given to them, not to us, and never touches our systems.

To give you what you paid for. We cannot post a box or hold a seat without knowing who you are and how to reach you. The legal basis is performance of our contract with you.

To email you about future nights. Only if you ticked the box. The legal basis is your consent, and you can withdraw it at any time — see below.

To keep proper business records. Tax law requires us to keep records of what we sold and to whom. The legal basis is our legal obligation.

To run and protect the business. Understanding which nights sell, and preventing fraudulent orders. The legal basis is our legitimate interests, and we keep this to what is reasonably necessary.

We do not sell your information, and we do not share it for anyone else’s marketing. We use a small number of suppliers to run the business, each of which handles data on our instructions:

• Stripe — takes payments and issues receipts.
• Vercel — hosts the website.
• Neon — hosts the database your booking is stored in.
• Our delivery partner — receives the name and address needed to deliver a box.
• The venue hosting a paint night — sees the guest list for that night so they can run it.

Some of these suppliers operate outside the UK. Where information is transferred abroad, it is protected by the safeguards UK data protection law requires, such as standard contractual clauses.

Order and booking records are kept for six years after the transaction, which is the period tax law requires.

If you have agreed to marketing emails, we keep your details until you unsubscribe or ask us to stop.

Staff accounts are removed when someone stops working with us.

We use a small number of strictly necessary cookies. One keeps you signed in if you have a staff account; another remembers what is in your basket. Without these the site cannot work, so they are not optional and we do not ask for consent to set them.

Stripe sets cookies on its own payment pages to prevent fraud.

We use Vercel Web Analytics to count page views. It does not use cookies, does not follow you between websites, and does not build a profile of you.

We do not use advertising or tracking cookies.

You can ask us to:

• give you a copy of the information we hold about you
• correct anything that is wrong
• delete your information, where we are not required to keep it
• stop or limit how we use it
• send it to you, or to someone else, in a portable format
• stop emailing you, at any time and for any reason

Email [TO CONFIRM: e.g. hello@blushbrush.co.uk] and we will respond within one month. There is no charge.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner’s Office at ico.org.uk, or by calling 0303 123 1113. We would rather you came to us first so we can put it right.

Tickets are refundable up to 72 hours before an event and can be moved to another night up to 48 hours before. The full terms are on our terms page.

If we change how we use your information we will update this page and change the date at the top. If the change is significant we will tell you directly.