Privacy policy

This policy explains what personal data we collect when you use the Hang app or website, why we collect it, and the rights you have over it. We keep it short and plain on purpose.

1. Who we are

The data controller is Hang Photos Ltd, registered in England and Wales (company number available on request at [email protected], registered office available on request at [email protected]). You can reach us at [email protected].

2. What we collect

• Account details. Your name and email address when you create an account or sign in. If you use the web designer without an account, Supabase creates a temporary anonymous identity so your design and basket remain private.
• Your photos and designs. The photos you upload and the gallery wall designs and frame previews created from them.
• Order and delivery details. What you ordered, the amounts paid, and the name, address and email used for delivery and order updates.
• Payment information. Payments are processed by Stripe. We receive confirmation of payment and the amount, but we never see or store your card details.
• Support messages. Emails you send us and our replies.
• Android waitlist details. Your email address and, if you provide it, your name when you ask to hear about the Android launch. We keep a record that you gave consent and confirmed your email address.
• Technical data. Basic device and usage information needed to run and secure the service.

3. Why we use it

• To fulfil your order (contract): printing and framing your photos, delivering them, taking payment and sending order emails.
• To run and improve the service (legitimate interests): keeping accounts secure, fixing problems and understanding how the app is used.
• To meet legal obligations: keeping order and payment records for tax and accounting purposes.
• To tell you about the Android launch (consent): if you join and confirm the Android waitlist, we will email you when Hang is available on Android. You can withdraw your consent at any time by contacting us.

We do not sell your personal data and we do not use it for third party advertising.

4. Who we share it with

We share data only with the services we need to run Hang:

• Prodigi, our print and fulfilment partner, receives your photos, frame specifications and delivery address to produce and ship your order.
• Stripe processes payments.
• Supabase hosts our database, authentication and photo storage.
• Resend delivers our emails, such as order confirmations and Android waitlist confirmation messages.
• Cloudflare Turnstile helps us protect the web designer and Android waitlist from automated submissions.
• PostHog provides optional website analytics only after you choose to allow analytics cookies. We do not send photos, signed photo links, addresses or payment details to analytics.
• Hosting and infrastructure providers that run our website and services.

Each of these acts under a contract that limits what they can do with your data. We may also share data where the law requires it.

5. International transfers

Some of our providers process data outside the UK. Where that happens we rely on safeguards recognised under UK data protection law, such as adequacy decisions or standard contractual clauses.

6. How long we keep it

• Order records are kept for as long as the law requires for tax and accounting, normally six years.
• Unordered anonymous designs and their private uploads are scheduled for deletion after 30 days without activity.
• Ordered artwork and support material is normally kept for 12 months. Frozen production artwork and records may be kept longer where needed to fulfil the order or handle a dispute.
• Support emails are kept as long as needed to resolve the issue and keep a record of it.
• Android waitlist details are kept while we prepare the Android launch. We will review the retention period and any future Android updates when the launch is ready.

7. Your rights

Under UK GDPR you can ask us to:

• give you a copy of your personal data,
• correct data that is wrong,
• delete your data,
• limit or object to how we use it, and
• provide your data in a portable format.

Email [email protected] and we will respond within one month. If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk.

Signed-in customers can also request account deletion from their account controls. Unordered designs and private uploads are removed, the authentication identity is deleted, and the customer record is pseudonymised. We keep statutory order and payment records where the law requires it.

8. Changes to this policy

If we make significant changes to this policy we will update this page and, where appropriate, let you know by email.