Privacy Policy

Last updated: August 2026

This is a detailed draft, not a substitute for a solicitor. It's written to describe this specific site as it actually works today, rather than a generic template. Some of what it describes as not yet existing — real accounts, real payment processing, analytics — will be added as the business grows; when that happens, this policy needs updating to match, and a solicitor (or a service like Rocket Lawyer / Citizens Advice) should check the update before it goes live.

Nyrox Accessories ("we", "us", "our") explains below what actually happens to your information when you visit this site or contact us. For data protection purposes we are the "controller" of that information. We are a sole trader based at 16 Birch Lane, GU24 9QD, United Kingdom, and you can reach us using the details in section 13. We are not currently registered for VAT, so no VAT is charged on our prices and we cannot issue a VAT invoice; if that changes, our VAT number will be shown in our Terms & Conditions and prices will be shown inclusive of VAT.

1. Information We Collect

1.1 Information you provide. The custom design form and the feedback form ask for your name and email address, and whatever you choose to write. That reaches us as an email so we can reply. This site does not sell anything yet, so there is no order or address form and no card details are asked for anywhere — see section 6.

1.1a Custom design requests. The "Got a design in mind?" form is different, and it does really send: your name, email address, optionally your phone model and preferred case type, and whatever you write in the message box are emailed to us at nyroxaccessories@gmail.com. They go from our web host straight to that inbox — nothing is written to a database, and no third-party form service sits in between. We keep that email for as long as we need it to answer you and to keep a record of what was agreed, and you can ask us to delete it at any time using the contact details in section 13.

1.2 Automatically collected information. This site has no analytics, no advertising trackers and no third-party scripts of any kind. Three things are still handled automatically, and we would rather spell them out than claim nothing happens:

  • Web server logs. Our host, IONOS, records the usual server log entries for every request — your IP address, the page requested, the time, and your browser's user-agent string. This is standard for all web hosting and we do not read these logs routinely; they exist so faults and attacks can be investigated.
  • Anti-spam limits on the forms. When you submit a form, our handler counts recent submissions from your connection so nobody can flood our inbox. Your IP address is scrambled first (a one-way hash), and only that scrambled value plus the times of your submissions are stored, in the server's temporary folder. It is deleted automatically after 24 hours and cannot be read from the web.
  • Marketing link tags. If you arrive from a link carrying tracking tags such as utm_source, and only if you chose "Accept all" in the cookie banner, that tag is remembered on your own device. Nothing is sent to us. See section 4.

If a form submission fails to send, our handler writes one line to an error file recording the time and the email address that could not be reached, so we can follow it up rather than silently lose your message. Nothing else from your message is written down.

1.3 Order information. This site keeps no database at all. Anything you send through a form reaches us as an email and lives in our inbox; nothing is written to the web server.

2. How We Use Your Information

If you contact us directly (by email or phone), or send a custom design request through the form on this site, we use whatever you tell us to answer you and to work up the design you asked about — nothing else. We do not sell your personal information, and we do not use it to make any automated decision about you.

3. Our Lawful Basis for Each of Those Things

UK data protection law requires us to have a specific, stated reason ("lawful basis") for every use of your information. Ours are:

  • Answering a custom design request or an email from you — because you asked us to, as a step towards a possible contract between us (in the law's terms, Article 6(1)(b)).
  • Answering site feedback — our legitimate interest in running and improving the site (Article 6(1)(f)). You are free to leave feedback without giving your name.
  • Server logs and the anti-spam limits described in 1.2 — our legitimate interest in keeping the site and our inbox secure and available (Article 6(1)(f)). We consider this proportionate because the address is scrambled, nothing is read routinely, and it is deleted quickly.
  • Remembering a marketing link's tags — your consent, given through the cookie banner, and withdrawable at any time (Article 6(1)(a)).
  • Keeping records of completed sales, once real orders begin — our legal obligation to keep business and tax records (Article 6(1)(c)).

Giving us your information is never a statutory requirement. It is simply that we cannot answer a design request without an email address to reply to.

4. Cookies & Local Storage

This site uses no tracking cookies, no analytics and no advertising technology. Two kinds of storage are used, and this is the complete list.

Your browser's local storage — stays on your own device and is never sent to us or to anyone else:

  • nyrox_theme — whether you chose light or dark mode. Strictly necessary to honour your own choice.
  • nyrox_cookie_consent — which button you pressed on the cookie banner, so we don't ask again. Strictly necessary, and required in order to respect your answer.
  • nyrox_utm — optional. Which marketing link brought you here. Only written if you chose "Accept all", and deleted immediately if you choose "Necessary only".

One cookie, set only at the moment you submit a form: PHPSESSID, a standard session cookie our web host uses to stop the same browser sending dozens of messages in a row. It holds no information about you, is not used for tracking, and your browser discards it when you close it. Because it exists purely to deliver a service you asked for, it does not require consent — but we would rather list it than let you find it and wonder.

You can change your banner choice at any time via "Cookie settings" in the footer, or clear all of the above through your browser's settings.

5. Accounts

This site does not currently have accounts or sign-in of any kind — there is no login form and no server-side account storage, real or otherwise. If account creation is added in future (for example via a provider like Firebase, Supabase, or Clerk), this section will be rewritten to describe exactly how sign-in and password storage work at that point.

6. Payment Processing

This site does not take payments. There is no checkout, no card form and no payment provider connected to it, so no payment information of any kind reaches this website. When ordering opens, we will name the payment provider here before it goes live.

7. Who Else Handles Your Information

We do not sell, rent or share your information with advertisers, and design requests are not passed to anyone. Three companies nevertheless handle it on our behalf, because they run the plumbing this business sits on:

  • IONOS (our web host, Germany/UK) — runs the server the site is served from and passes form submissions to email. Their servers hold the logs described in 1.2.
  • Google (Gmail, United States) — our business inbox. Every design request and every feedback message you send arrives there and is stored there while we deal with it.
  • Google Fonts (United States) — the two typefaces the site uses are currently loaded from Google's servers, which means Google receives your IP address when a page loads. We intend to remove this by hosting the fonts ourselves; until we do, it is the one external connection this site makes.

Once the site takes real orders we expect to add Printify (production and shipping) and a payment provider, and we will name them here at that point.

8. Where Your Information Is Held

Gmail and Google Fonts are operated by a company in the United States, so information reaching them may be processed outside the UK. Google states that these transfers are covered by the UK Extension to the EU–US Data Privacy Framework and by the International Data Transfer Addendum to the standard contractual clauses — the two mechanisms UK law recognises for this. Everything else stays with our host in the UK or the EU.

9. How Long We Keep Things

  • Design requests and feedback emails — while we're dealing with them, and then up to 24 months, so we can pick up a conversation you return to. Ask us sooner and we'll delete them.
  • Anti-spam records — deleted automatically after 24 hours.
  • Failed-send error entries — kept only until we've followed up the message that didn't arrive.
  • Web server logs — kept by IONOS to their own schedule, typically a few weeks.
  • Records of completed sales, once real orders begin — six years, because HMRC requires business records to be kept for that long.
  • Anything in your browser's local storage — until you clear it. We cannot see it and cannot delete it for you.

10. Data Security

This site is served over an encrypted (HTTPS) connection, and the browser is instructed to refuse an unencrypted one. The forms refuse to accept a submission that did not arrive over that encrypted connection, and will only accept submissions sent from our own pages.

The only thing you send that reaches a server is a form submission, which our web host turns straight into an email to us. The message itself is never written to disk — only the short-lived anti-spam record described in 1.2, which holds no readable address and is kept outside the public part of the server so it cannot be downloaded. There is no database, no accounts, no passwords and no card data anywhere in this system, which means there is very little here for anyone to steal. That will change when real payments are added, and this section will be rewritten then.

If you find a security problem with this site, there are instructions for reporting it at /.well-known/security.txt. No online service is ever completely secure, and we won't pretend otherwise — but we will tell you promptly if something happens that affects you, and notify the Information Commissioner's Office where the law requires it.

11. Your Rights

Under UK data protection law you have the right to:

  • Be told what we hold about you and why — that is what this page is for.
  • Get a copy of it (a "subject access request"). Free, and we'll respond within one month.
  • Have it corrected if it's wrong.
  • Have it deleted, where we have no continuing reason to keep it.
  • Restrict what we do with it while a dispute about its accuracy is sorted out.
  • Object to any use we've justified by legitimate interests — the anti-spam limits and server logs above.
  • Take it with you in a portable format, where the use rests on consent or on a contract.
  • Withdraw consent at any time, for the one thing that relies on it — the marketing-link tag. Use "Cookie settings" in the footer. Withdrawing doesn't undo anything done before you withdrew.

What we actually hold is short: whatever is in our inbox from you. Ask us using the details in section 13 and we'll deal with it. We may ask a question to confirm it's really you before sending personal information anywhere.

12. Complaining to the Regulator

If you think we've mishandled your information, please tell us first — we'd rather fix it. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office, at any time and without asking us first:

ico.org.uk/make-a-complaint · Helpline 0303 123 1113 · Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

13. Children's Privacy

This site is not intended for children, and we do not knowingly collect information from anyone under 13. If you believe a child has sent us their details, contact us and we'll delete them.

14. Changes to This Policy

We'll update this Privacy Policy as the site changes — most importantly, as real accounts, payments, and analytics (if any) are added. The "Last updated" date will always reflect the most recent version.

15. Contact Us

If you have questions about this Privacy Policy or your data, contact us at:

Nyrox Accessories
16 Birch Lane
GU24 9QD
United Kingdom
Email: nyroxaccessories@gmail.com
Phone: 07355 041126

Email us Call us Read the FAQ Tell us what to fix