This Privacy Policy explains how I (Crafts by Jon) collect, use, store, and protect personal information when you interact with me — including through my website (craftsbyjon.co.uk), my Facebook Page, my Instagram account, and any automated services I operate using the Meta Platform APIs.
I am committed to handling all data responsibly and in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and Meta's Platform Terms and Developer Policies.
Crafts by Jon is a small handmade goods business based in Deal, Kent, UK, selling acrylic bookmarks and keyrings, plus print-on-demand items such as mugs, coasters, t-shirts and prints. The data controller for the purposes of UK GDPR is Jon (the sole owner). Contact: jon@craftsbyjon.co.uk.
I use cookies for website analytics and for the Pinterest tag, with your consent. When you first visit the store, a banner lets you Accept or Decline. If you decline, none of these tools load and none of these cookies are set: only basic server access logs (see below) are collected. I also keep simple counts of store activity (for example, that a product was viewed or a checkout was started, from which link, and on what type of device) which use no cookies and store nothing on your device. If you accept, I use:
Google Analytics and Microsoft Clarity are used only to understand and improve the store, not for advertising. The Pinterest tag is different: it is advertising-related, which is why it is described separately above and is covered by the same Accept or Decline choice. I do not sell your data. You can change your cookie choice at any time using the "Manage cookie preferences" link in the site footer.
I also collect basic server access logs (IP address, page requested, timestamp) for security and performance purposes. These logs are retained for a maximum of 30 days and are not used to identify individuals.
If you email me at jon@craftsbyjon.co.uk, I collect your email address and the content of your message in order to respond to your enquiry. This data is retained for up to 12 months and is not shared with third parties.
I use the Meta pages_messaging permission to receive and respond to direct messages sent to my Facebook Page. When you message my Page:
You can stop receiving automated replies at any time by sending "STOP" or by adjusting your Facebook Messenger settings. I comply fully with Meta's Messenger Platform policies, including responding only within the standard messaging window.
I use the instagram_manage_messages permission to receive and respond to direct messages sent to my Instagram Business account. The same principles as Section 3.3 apply:
I use the read_insights permission to access aggregated analytics for my Facebook Page, such as reach, impressions, post engagement, and follower counts. This data:
I use the instagram_manage_insights permission to access aggregated analytics for my Instagram Business account (reach, impressions, follower activity, etc.). The same principles as Section 3.5 apply — data is aggregated, anonymised, and used only for internal performance review.
I use the instagram_content_publish permission to publish posts (images and captions) to my own Instagram Business account automatically, as part of my content scheduling. This permission is used to post content about my own products only. No user data is collected or used as part of this process.
I use the catalog_management permission to manage my own product catalogue on Facebook/Instagram. This involves uploading and updating product information (names, prices, images, descriptions) that I own. No personal data belonging to users or customers is collected or processed as part of catalogue management.
When you place an order through my store, I collect your name, email address, delivery address, and order details (items purchased, and personalisation text or delivery notes where applicable) in order to fulfil and dispatch your order. Payment itself is processed directly by Stripe — I do not see or store your full card details; Stripe provides me with a payment reference to confirm your transaction (see Section 8, Third-Party Services).
Handmade items are packed and posted by me, using Royal Mail. Print-on-demand items (such as mugs, coasters, t-shirts and prints) are made and posted by my print partners, so for those orders I pass your name, delivery address and order details to them, and they pass your name and delivery address to the carrier that delivers your parcel. My print partners are Gelato (Gelato ASA, Oslo, Norway) and Inkthreadable (Hyper Merch Limited, Blackburn, UK), and the carriers are Evri and Royal Mail. I only share the details needed to make and deliver your order (see Section 8, Third-Party Services).
Order and transaction data is retained for a minimum of 6 years to meet UK tax and accounting record-keeping requirements. Data not required for those financial obligations — such as delivery notes or personalisation preferences no longer needed once an order is complete — is removed once it is no longer necessary for any other legitimate purpose.
When you check out, there is a box you can tick if you would like an email from me when I add new products. It is not ticked unless you tick it, and ticking it is entirely optional: you can buy without it. If you tick it, I keep your email address, the date, and the wording you agreed to, so I can send you emails about new products and nothing else. My lawful basis is your consent. Every email includes an unsubscribe link, and you can also ask me to remove you at any time at jon@craftsbyjon.co.uk. After you unsubscribe I keep a record that you did so, so that I do not email you again, but I will not send you anything further. I do not pass this list to anyone else.
Some products, such as personalised photo mugs, ask you to upload a photo and, if you like, a name to print with it. I use your photo and name only to make the product you ordered. My lawful basis is that I need them to make your order (performance of a contract).
I access certain data via the Meta Platform APIs (Facebook Graph API) strictly as required to operate the features described above. In accordance with Meta's Platform Terms:
I retain different categories of data for different periods:
If you would like me to delete any personal data I hold about you, please contact me at jon@craftsbyjon.co.uk and I will action your request within 30 days.
Under UK GDPR, you have the right to:
To exercise any of these rights, contact me at jon@craftsbyjon.co.uk. If you believe I have not handled your data correctly, you have the right to complain to the Information Commissioner's Office (ICO).
I implement appropriate technical and organisational measures to protect personal data, including encrypted server storage, restricted access to API credentials, and HTTPS for all web traffic. No method of transmission over the internet is 100% secure, but I take my obligations seriously and review my security practices regularly.
My services make use of the following third parties. Each handles personal data under its own privacy policy:
I may update this policy from time to time. The "Last Updated" date at the top of this page will always reflect the most recent version. Continued use of my services after a change constitutes acceptance of the updated policy. For significant changes, I will post a notice on my website.
For any questions, data requests, or concerns about this Privacy Policy, please contact:
Jon — Crafts by Jon
📧 jon@craftsbyjon.co.uk
📍 Deal, Kent, United Kingdom