Privacy Policy

THRIFTWORX is operated by Darren Millar, trading as THRIFTWORX, based in France and shipping to the United States. For the purposes of data protection law, THRIFTWORX is the data controller for the personal data described in this policy.

Data protection contact: hello@thriftworx.com

• Alert sign-ups: first name, email address, mobile phone number and Whatnot username (where you provide them).
• Shop orders: name, email address, delivery address, phone number, order contents and order history. Card details are handled by Stripe and never reach our servers.
• Consultancy bookings: name, email address, phone number, requested date and time, and any notes you send us.
• Contact messages: name, email address and message content.
• Account data: if you are an administrator, your email address and authentication data.
• Technical data: basic server logs and error reports needed to keep the site secure and working.

• Consent — sending you marketing emails and SMS alerts about live shows, new arrivals and pop-up events. You can withdraw consent at any time.
• Contract — processing and shipping shop orders, taking payment, and arranging consultancy appointments you have booked.
• Legitimate interests — replying to your messages, preventing fraud and abuse, and keeping the site secure and reliable.
• Legal obligation — retaining sales and tax records where the law requires it.

We do not use your data for automated decision-making or profiling.

We only share data with the service providers we need to run THRIFTWORX. Each acts as a processor under contract and may not use your data for their own purposes:

• Stripe — payment processing for shop orders and consultancy fees.
• TextMagic — sending SMS alerts and managing SMS subscriber lists.
• Resend — sending transactional and marketing email.
• Supabase / Lovable — database, authentication and application hosting.
• Google — generating video meeting links for booked consultations.

We never sell your personal data. Some providers are based in the United States; those transfers rely on Standard Contractual Clauses or equivalent safeguards.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. Mobile numbers are used only to deliver the SMS messages you have consented to, and are processed solely by our SMS provider (TextMagic) on our behalf.

• Marketing lists: until you unsubscribe or opt out, then we keep a minimal suppression record so we do not contact you again by mistake.
• Orders and payments: up to 7 years, to meet accounting and tax duties.
• Consultancy bookings: up to 2 years after the appointment.
• Contact messages: up to 2 years after our last exchange.
• Technical logs: a short rolling window, typically 30–90 days.

Under GDPR you have the right to:

• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased where there is no overriding reason to keep it;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent to marketing at any time;
• lodge a complaint with your data protection authority (in France, the CNIL).

To exercise any of these rights, email hello@thriftworx.com. We respond within 30 days.

THRIFTWORX does not run advertising or third-party tracking cookies. We use strictly necessary browser storage to keep your shopping cart and, for administrators, your signed-in session. Stripe may set its own cookies during checkout to prevent fraud.

Data is stored on managed, access-controlled infrastructure and transmitted over encrypted connections. Access to subscriber and order data is limited to THRIFTWORX administrators. The site is not directed at children under 16, and we do not knowingly collect their data.

If we make material changes, we will update the date at the top of this page and, where appropriate, notify subscribers by email.

Text message specifics — consent, frequency, opt-out and carrier terms — are set out in our SMS Policy.