Privacy policy

What this site collects, who else sees it, and what happens to it.

This is what Patchwork Atlas collects and what happens to it. Card details never reach us. Everything below describes what the site does today.

What we collect

Searching runs in your own browser against a file it has already downloaded. The words you search for are sent to Google Analytics, and when a search finds NOTHING we also keep them ourselves. Both are described under visitor measurement.

When you order, we collect the name, delivery address and email address needed to make and send your print, and nothing beyond them. Your card details go straight to the payment processor and never reach us.

What your browser stores

Two things, both kept on your own device and neither readable by us:

• Your basket. Which maps, sizes and palettes you have added, so the basket survives a page reload. The basket itself never leaves your browser. What does leave is the count described under visitor measurement, which is the map and never the person.
• Your light or dark preference, so the site opens the way you left it rather than flashing the wrong one.

Clearing your browser data removes both. Neither is a cookie sent to a server, and neither identifies you. Google Analytics and the Meta pixel, both described below, set cookies of their own, and those are Google's and Meta's rather than ours.

Visitor measurement

We use Google Analytics to count visits and see which pages people actually read. It sets a cookie, and it tells us roughly which country you arrived from and which page you landed on. It runs on every page of this shop.

It also follows the shape of a sale: something added to a basket, a checkout started, an order finished. So it is told which map, size and finish went into the basket and what the order came to. It is never told your name or your address. We use it to answer "is anyone finding the shop, and do baskets turn into orders", not to follow a person.

When you use the search box, the words you type are sent to Google Analytics along with how many maps matched them. It is the search term on its own, with nothing attached that says who typed it.

Visitors in the European Economic Area are treated as having refused, by default and without being asked, so no Google Analytics cookie is set for them and Google estimates that traffic instead.

We also count page views ourselves with Umami, which runs on a server we rent and manage ourselves. It records the page you opened, the site that sent you here, your browser, device and screen size, your language, and roughly where you are, down to the city. It sets no cookie and stores nothing in your browser. Your IP address is used to work out that location and to tell one visit from another, and it is not saved. Page addresses are recorded without anything after a question mark, so the words in a search are not kept this way.

We also count baskets, ourselves, described next.

We keep our own count of what goes into baskets, on our own server rather than anyone else's: which map, which size and palette, what it costs and how many. It sets no cookie and carries nothing that says who you are. We keep it for three months and then it is gone. It tells us which maps people actually want, which is a different question from which ones they look at.

When a search finds nothing, we also keep the words you typed, on our own server, so we can see what people come looking for and we do not sell. Searches that DO find something are not kept this way. It is the words on their own, with nothing attached that says who typed them, and it is gone after three months.

Meta advertising

We run the Meta pixel, from the company behind Facebook and Instagram. It is told which pages you open, which map you look at, what went into your basket and when a checkout started, and it sets cookies to do it.

If you are in the European Economic Area it does not load at all. Not a cookie, not a request. Meta has no way to run without storing something in your browser, and we would rather leave it off than put a consent banner in front of you.

When an order completes, our own server tells Meta what it was worth. That happens after you have paid, from the order we recorded, rather than from your browser. What goes with it is a scrambled version of your email address and your country, the two Meta cookies, your browser's name, the order reference and the amount. Not your name, not your address, not which maps you bought, and not your IP address.

Meta uses this to show our maps to you again as adverts elsewhere, and to work out whether an advert we paid for led to a sale. This is advertising, not just measurement, and it is worth saying plainly.

Blocking it changes nothing about how this shop works. Your own controls are in Meta's ad preferences, and most tracker-blocking extensions stop it outright.

The review invitation

On the page you land on after paying, we offer you the chance to be sent a review survey by Google. Taking it is entirely your choice and nothing happens unless you opt in on that page.

To make the offer at all, that page sends Google your email address, order reference, delivery country and the date we expect it to arrive. Nothing else goes with it: not your name, not your street address and not which map you bought. If you opt in, Google emails you later and any rating you give is about us as a shop, not about a specific map.

The email list

There is a signup box at the bottom of every page. It is the only way onto our list, and it is worth saying what that means: giving us an address at checkout does not put you on it, and neither does buying something. Nothing else on this site collects an address for marketing.

Signing up does not subscribe you either. It records your address as waiting and sends you one email with a link in it. You are on the list only once you click that link, and if you never do, nothing further is ever sent.

We keep the date you confirmed, because that record is what proves you asked. Every email carries a one-click unsubscribe, and unsubscribing keeps the row rather than deleting it, so we have a record that you asked to stop. Ask us and we will erase that too.

The signup box runs a check that you are not a machine, handled by Cloudflare, who host this site. Almost every time it decides on its own and you see nothing at all. When it cannot tell, it shows you one box to tick. It sets no cookie, it does not follow you anywhere else, and nothing it collects goes to an advertiser. It is there because typing an address into that box makes us send an email, and without it somebody could point that at a stranger.

If you leave without paying

If you start checkout, give an email address and then close the tab, the payment processor tells us the attempt expired. We record that, with the address you typed and what was in the basket, so we can ask whether something went wrong.

Two things follow from that, and both are limits rather than promises. An address given at checkout is used to reach you about that order and nothing else: it is not a mailing list, it is not added to one, and nothing you did not ask for will be sent to it. And if you never type an address, there is nothing to record and we have no idea who you were.

Who else handles your order

Prints are made and posted by a fulfilment partner, who needs your name and delivery address to do it and receives nothing else. A payment processor handles the card details, which never reach us.

Asking a question

The round button in the bottom corner of every page opens a box for questions about this shop. What you type there, and the earlier questions and answers in that same conversation, go to our server and to an AI model run by Cloudflare, who host this site, so it can write an answer from this shop's own pages. The answer comes from that model rather than a person, and it can be wrong.

We keep no copy of the conversation, and nothing about it is saved in your browser: it is gone when you leave the page. What we keep is a count of questions asked and of the ones it could not answer, with nothing attached that says who asked, for three months.

When it cannot answer, you can leave your question with your email address so a person can reply. We keep that question and address for 90 days and then delete them. The address is used to answer you and nothing else: it is not the email list and it is never added to it. The box runs the same check that you are not a machine as the signup box, handled by Cloudflare.

What we do not do

We do not sell or rent personal information, and we share it only as this page describes. We do not build a profile of you ourselves, and we do not send marketing email unless you have asked for it and confirmed it by clicking a link we sent you.

How long we keep it

Order records are kept for as long as tax law requires, which is several years, and then deleted. Emails are kept while they are useful to answer.

Your rights

You can ask what we hold about you, ask for it to be corrected, or ask for it to be deleted, and we will do it. If you have never ordered and never joined the list, the answer to the first question is nothing that can be tied to you. What we count ourselves about someone who only reads, described under visitor measurement, holds nothing that says who they are. What Google and Meta hold is theirs, and Meta's own controls are linked above.

Contact

Email hello@patchworkatlas.com with anything on this page. If you write to us we keep the message, so we can answer it and so we have the history if you write again.