Your privacy

Privacy Policy

Last updated September 2026

This policy explains what personal information Leaf & Loom Tea Co. collects, why we collect it, who else receives it, and how long we keep it. If anything here is unclear, email us at enquiries@u26s2250.iedev.org.

What we collect, and why

When	What	Why
Creating an account	First and last name, email address, phone number, password	To identify you when you sign in and to contact you about your orders. A phone number is required so that we or our delivery partner can reach you about a delivery. Your password is stored only as a secure hash, and we never see it.
Creating an account (optional)	Date of birth	Only used to send birthday offers and seasonal discounts. You can leave it blank, and you can remove it later from your account page.
Placing an order	Name, email address, delivery address, the items you ordered and the amounts paid	To take payment, deliver your order, and keep the accounting records the law requires.
Sending an enquiry	Name, email address, phone number and your message	To answer you.
Using the site	Your IP address and records of sign-in attempts and errors	To keep accounts secure, for example by stopping repeated password guessing.

We never see your card details. Card payments are handled entirely by Stripe on their own payment page. We only receive whether the payment succeeded.

Cookies

We use two cookies, both necessary for the site to work: one keeps you signed in and remembers your basket, and one protects forms against cross-site request forgery. We do not use advertising or analytics cookies, and we do not track you across other websites.

Who else receives your information

Stripe processes card payments. Stripe receives your email address, the names of the items you ordered and the amounts, and handles your card details directly.
Cloudflare Turnstile provides the "verify you are human" check on our sign-in, registration, password reset and contact forms. Cloudflare receives your IP address and a token from your browser.
Our email provider delivers order confirmations, order status updates, password reset links and replies to enquiries.

We do not sell your personal information, and we do not share it for anyone else's marketing.

How long we keep it

Account details: until you delete your account.
Order records: 7 years from the date of the order. Tax and accounting rules require us to keep records of sales, and this remains true after an account is deleted, so a past order keeps the name, email address and delivery address it was placed with.
Enquiries: 2 years after the enquiry is resolved.
Security logs: 12 months.
Password reset links: 1 hour, after which the link stops working.

Your choices

See and correct your details: from your account page, at any time.
Change your password: from your account page. We ask for your current password first.
Delete your account: from your account page. This removes your account and basket. Past orders are kept for the period above, as explained.
Ask us a question, or ask for a copy of your information: email enquiries@u26s2250.iedev.org.

Keeping your information safe

Passwords are stored as secure hashes, the site is served over HTTPS, and administrative pages are limited to staff accounts. Repeated sign-in and password reset attempts are rate limited, and security events are logged. No system is perfectly secure, but we take these measures to reduce the risk.

Contact us

Questions about this policy, or about the information we hold about you: enquiries@u26s2250.iedev.org.