Privacy Notice

Version 1.1 · Last updated September 2026

This notice sets out how Storm's Eye collects, uses, stores and protects personal information, and the rights you hold over that information under the United Kingdom General Data Protection Regulation and the Data Protection Act 2018. We have written it to be read rather than skipped, and we have tried to say plainly what we do and, just as importantly, what we do not do.

01 Scope of this notice

This notice applies to this website, to the mailing list operated through it, and to the authentication features built into Storm's Eye garments. It applies to anyone who visits the site, joins the mailing list, or interacts with a garment label, whether or not they have ever purchased anything from us.

It does not cover third-party websites or services that we may link to. Where a link takes you elsewhere, for example to our Instagram profile, that destination operates under its own privacy notice, over which we have no control and for which we accept no responsibility. We would encourage you to read those notices separately.

02 Who is responsible

The data controller for the purposes of UK data protection law is Storm's Eye Ltd (registered in England and Wales, company number 17243691), trading as Storm's Eye, of 167–169 Great Portland Street, London, England, W1W 5PF. A data controller is the organisation that decides why and how personal information is processed; that responsibility rests with us, and it is not delegated to any third party.

We are not currently required to appoint a statutory Data Protection Officer, as our processing is limited in scope, does not involve large-scale monitoring, and does not involve special category data. All data protection enquiries are handled directly by us using the contact details in section 15.

03 Information we collect

We deliberately collect as little as possible. In practice this means three narrow categories of information.

Information you give us directly

If you choose to join our mailing list, we record the email address you enter and the date and time on which you entered it. The timestamp exists so that we can demonstrate, if we are ever asked to, when and how consent was given. We do not ask for your name, your address, your date of birth, your telephone number or any demographic information, and there is no facility on this site for you to provide them.

Information collected automatically

Like effectively every website, ours is served through infrastructure that records limited technical information for security and reliability purposes. This includes the Internet Protocol (IP) address of the connecting device, the date and time of the request, the page requested, and the browser's user-agent string. This information is generated by our hosting provider as part of protecting the site against attack and abuse. It is not used to build a profile of you, it is not combined with your email address, and it is not used for marketing or analytics of any kind.

Information arising from garment interactions

When a garment label is tapped, our systems verify the response and open a temporary session. Photographs, video and audio subsequently added are associated with that individual garment, as are any names or captions given to them. We also record counts against the garment itself: when it was first tapped, how many times it has been opened, and how many times it has been handed on.

If, and only if, the holder of a garment switches the feature on, the location recorded inside a photograph is stored alongside it. This is off unless it is chosen, and it is covered in section 12.

All of this is described in full in sections 11 and 12.

04 Why we process it, and our lawful basis

UK data protection law requires that every act of processing rests on a specified lawful basis. Ours are as follows.

• Mailing list, on consent. We process your email address on the basis of your consent, given freely and unambiguously when you submit the form. You are under no obligation to provide it, nothing is withheld from you if you decline, and withdrawal carries no consequence.
• Technical and security logging, on legitimate interests. We rely on our legitimate interest in keeping this website available, secure and free from abuse. We have considered whether this interest is overridden by your rights and freedoms and concluded that it is not, because the information is minimal, retained briefly, never used to identify or profile individuals, and generated only as a by-product of serving the page you requested.
• Garment location information, on consent. Where a garment holder switches on the storage of locations, we rely on their explicit consent, given through a prompt that explains what will be read, where it goes and who will be able to see it. It is off by default, it can be withdrawn at any moment, and withdrawing it erases the locations already held rather than merely stopping new ones.
• Garment authentication, on legitimate interests. We rely on our legitimate interest, and that of the people who buy our garments, in ensuring that a piece presented as ours genuinely is ours. Counterfeiting causes direct harm both to us and to purchasers, and the processing involved is limited to the garment rather than the person holding it.

05 Consent and withdrawal

Where we rely on consent, you may withdraw it at any time, and doing so is intended to be at least as easy as giving it. Withdrawal does not affect the lawfulness of anything we did before you withdrew, but it takes effect immediately going forward.

On withdrawal, your email address is deleted from our records. We do not transfer withdrawn addresses to a suppression list, because retaining an address in order to remember not to contact it is, in our view, a poor answer to somebody asking to be forgotten. The practical consequence is that if you later wish to rejoin, you will simply sign up again.

06 How long we keep information

We keep personal information only for as long as there is a reason to.

• Mailing list addresses are kept until you ask us to remove them, or until the mailing list is discontinued, whichever comes first.
• Technical logs are retained by our hosting provider for a short period, in the order of days, and then automatically discarded. We do not archive them.
• Garment archives persist for the working life of the garment, because that is their purpose. Any item within an archive can be deleted by whoever holds the garment at the time, at any time, and deletion is permanent and immediate.
• Garment locations are held only while the feature is switched on for that piece. Switching it off erases every location already stored, and preparing a garment for a new owner does the same automatically.
• Tap sessions expire sixty minutes after a label is tapped and are discarded thereafter.

07 Who else has access

We do not sell personal information. We do not rent it, trade it, or make it available to advertisers, data brokers, or any other commercial third party. We have never done so and have no intention of doing so.

This website, its database and its image storage are provided by Cloudflare, Inc., which acts as our data processor. A processor may only act on the documented instructions of the controller and may not use the information for its own purposes. Cloudflare's role is confined to hosting and protecting the service.

We may disclose information where we are legally obliged to do so, for example in response to a valid court order or a lawful request from a regulator or law enforcement body. Where we are permitted to tell you that such a request has been made, we will.

If we later engage a third-party service to deliver our mailing list emails, this notice will be amended to name that provider before any address is transferred to them.

08 International transfers

Our hosting provider operates a globally distributed network, and information may therefore be processed on servers located outside the United Kingdom. Where personal information is transferred outside the UK, it is protected by appropriate safeguards recognised under UK data protection law, which in this case are the International Data Transfer Addendum to the European Commission's Standard Contractual Clauses. These are contractual commitments that require the recipient to protect the information to a standard essentially equivalent to that required within the UK.

09 How we protect information

All connections to this website are encrypted in transit using Transport Layer Security. Access to the underlying database and storage is restricted to the operators of this site.

The authentication system is designed so that each garment interaction produces a response that cannot be reused. Sessions opened by a garment expire automatically after a limited period and cannot be extended remotely. Where an owner sets a passphrase on a garment album, it is never stored in a readable form; we retain only a salted cryptographic hash, which means that we ourselves cannot recover or read it.

No system is absolutely secure, and we would be misleading you if we claimed otherwise. What we can say is that we have deliberately kept the amount of personal information in our possession as small as possible, on the principle that information never collected cannot be lost.

10 Cookies, analytics and tracking

This website sets no cookies. There is no cookie banner because there is nothing to consent to.

We use no analytics platform. We do not know how many people visit, which pages they read, how long they stay, or where they came from. We use no advertising pixels, no conversion tracking, no session recording, no heat mapping, and no social media tracking scripts of any kind.

Typefaces used on this site are served from our own domain rather than from a third-party font service. This is a deliberate decision: embedding fonts from an external provider would transmit your IP address to that provider every time you loaded a page, which we consider an unnecessary disclosure.

The one exception is the authentication system described below, which sets a single strictly necessary session cookie when a garment label is tapped. Its sole function is to keep that session open for its limited duration. It carries no identifier connected to you, performs no tracking, and expires automatically.

11 Garment authentication and archives

Each Storm's Eye garment carries a label that can be read by a mobile telephone. Doing so confirms the garment's authenticity and opens a private archive belonging to that garment.

Two points are worth stating clearly. First, tapping a label does not identify you to us. There is no account, no registration and no sign-in. We learn that a particular garment has been presented; we do not learn who presented it. Second, the archive belongs to the garment and not to the person. If a piece changes hands, the archive travels with it, and the new holder inherits its contents.

What an archive can hold

Photographs, video and audio, together with any album names, item names and captions written by the holder. These are stored by us on behalf of whoever holds the garment. They are not published, not indexed by search engines, and not visible to anyone who is not physically in possession of the piece. We do not analyse them, apply facial recognition to them, or use them for any purpose of our own, including marketing.

Every file is served only to a verified session, and that check is repeated on each individual request rather than once at the beginning. There is no public address for any file.

Information about the garment itself

We record the number of times a piece has been opened, the date it was first opened, and the number of times it has been handed on. This information concerns the object rather than any individual, and it is what allows a garment to carry a verifiable history.

The optional passphrase

A holder may set a passphrase, after which the archive will not open on a tap alone. It is stored only as a salted cryptographic hash, which means we cannot read it, cannot recover it and cannot tell you what it was. The only route past a forgotten passphrase erases the contents of the archive, because a recovery that returned the contents would defeat the purpose of setting one.

Passing a garment on

The passport provides a step for handing a piece to somebody else. It removes the passphrase, so that the new holder is not locked out; it erases every stored location; and it closes any session left open elsewhere. Whether the archive itself travels with the garment is the seller's choice, and keeping it is the default.

What you should consider before adding

Because an archive transfers with the garment, something you add today may be visible to a future owner. If you would not wish that, do not add it. Any item can be deleted permanently at any time by whoever holds the piece, and the whole archive can be erased at the point of handing it on.

12 Location information

Photographs taken on a mobile telephone usually record the place at which they were taken. This information sits inside the photograph file itself and is invisible unless something reads it.

We ignore it unless you ask us not to. Storing locations is switched off for every garment until the holder switches it on, and switching it on shows a prompt setting out plainly what will be read, where it is sent, who will be able to see it, and what happens if it is later switched off.

Where the feature is on, the coordinates are read on your own device, from the original file, and sent to us with it. They are shown on a globe drawn inside the page. We do not use a third-party mapping service for this, which means no outside company receives your address or learns which garment is being viewed. Opening a location in a mapping application is a separate action that you choose to take.

Switching the feature off erases every location already stored against that garment. The photographs themselves are untouched. Preparing a garment for a new owner erases them automatically, whether or not the feature was switched off first.

Location information is visible to anybody who taps that garment's label and gets past any passphrase set on it, which includes whoever owns the piece after you. This is why the feature is off by default and why we ask before turning it on.

13 Children's information

This website is not directed at children, and our garments are not marketed to them. We do not knowingly collect personal information from anyone under the age of 13, and we ask that children under that age do not submit an email address to us.

If you believe that a child has provided us with personal information, please contact us and we will delete it promptly.

14 Automated decision-making

We do not carry out automated decision-making producing legal or similarly significant effects, as described in Article 22 of the UK GDPR. We do not profile you, score you, segment you, or make inferences about your interests, behaviour or characteristics. Everyone on our mailing list receives the same message at the same time.

15 Your rights

Data protection law gives you a set of rights over information relating to you. In summary, you have the right to:

• be informed about how your information is used, which is the purpose of this notice;
• request access to the information we hold about you, together with an explanation of how and why we use it;
• request rectification of information that is inaccurate or incomplete;
• request erasure of your information where there is no compelling reason for us to continue holding it;
• request restriction of processing, which means asking us to hold information without further using it;
• object to processing carried out on the basis of legitimate interests, and to object at any time to direct marketing;
• data portability, meaning a copy of information you provided to us, in a structured, commonly used and machine-readable format. For garment archives this is built in: the passport carries a download that packages every photograph, video and sound file together with a written record and a machine-readable index, and it can be used at any time without asking us;
• withdraw consent at any time, where consent is the basis on which we are processing.

Exercising any of these rights is free of charge. We may decline a request that is manifestly unfounded or excessive, but we will explain our reasoning if we ever do, and you may challenge that decision.

16 Exercising your rights

To exercise any of the rights above, or to ask anything at all about this notice, contact us by hello@intothestormseye.com, or by post to the address above.

We will respond within one calendar month of receiving your request. If a request is particularly complex, we may extend that period by up to two further months, in which case we will tell you within the first month and explain why. We may ask you to confirm your identity before we act, which is a safeguard for you rather than an obstacle: it prevents somebody else obtaining or deleting your information by pretending to be you.

17 Complaints

If you are unhappy with how we have handled your personal information, we would much rather you told us first, so that we have the opportunity to put it right.

You are nonetheless entitled to complain at any time to the Information Commissioner's Office, the United Kingdom's independent supervisory authority for data protection. The ICO can be reached at ico.org.uk, by telephone on 0303 123 1113, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Contacting us first does not in any way affect your right to complain to them.

18 Changes to this notice

We may update this notice from time to time to reflect changes in what we do or in the law. The version number and date at the top of this page will always indicate the current revision.

Where a change is material, for instance if we begin using an email delivery provider or introduce any form of analytics, we will update this notice before that change takes effect, rather than afterwards.