Privacy notice

The Astral Registry is the controller of the personal data described here. We collect only what we need to make, deliver and run your gift, and we never sell it. Questions or requests go to keepers@astralregistry.com.

What we collect, and why

• Your order: your name and email, the recipient's name, the occasion, message and dedication you write, and the parcel you chose. We use these to make the certificate and pack, send your receipt and files, and answer questions (to perform our contract with you).
• Delivery address (Collector Pack): the name and UK address you give us, printed on the label and passed to Royal Mail to deliver the pack (contract).
• Recipient's email (Digital Pack, optional): if you ask us to email the recipient on a chosen date, we keep their address until then and use it only to send that gift email (contract with you, and our legitimate interest in delivering the gift). Please only give us an address the recipient would expect to hear from us at.
• Payment checks: Stripe processes your card; we never see or store card numbers. Stripe tells us the amount paid, your billing country and the country your card was issued in, which we use to confirm you are a UK buyer (contract, and to prevent fraud).
• Claiming the gift: the recipient gives an email address and a phone number. We send a one-time code to each to prove the gift is theirs, and use them to sign the holder in and send live-access reminders (contract with the holder). Codes are stored only as hashes and expire after 10 minutes.
• Playing: game progress such as position checks, shards, relics, scores, the chosen handle, and the days you play. We use these to run the game, keep it fair, show the Ledger and, in aggregate, to understand how the game is used (legitimate interests). Other players see only your handle, estate and Ledger entries, never your email, phone or address.

Who we share it with

Only the service providers that run the Registry for us, under contracts that protect your data:

• Stripe (payments)
• Royal Mail (delivery of Collector Packs)
• Our email provider (receipts, files, gift and reminder emails) and text-message provider (claim codes)
• Our hosting and database providers

Some providers may process data outside the UK; where they do, they use safeguards approved under UK data protection law, such as the International Data Transfer Agreement or adequacy regulations.

How long we keep it

• Order and payment records: 6 years after the order, for accounting and tax.
• Delivery addresses: deleted or anonymised 12 months after dispatch.
• Recipient emails for scheduled sends: deleted 30 days after the email is sent.
• Holder email and phone, and game progress: while the parcel is held, and up to 12 months after a holder asks us to close it.

Cookies

We use one essential cookie, astral_session, to keep a verified holder signed in to the world. Checkout uses your browser's session storage to remember the parcel you picked. We don't use advertising cookies.

Your rights

Under UK data protection law you can ask for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, and ask for it in a portable form. Write to keepers@astralregistry.com; we reply within one month. If you're unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk.

See also the terms of sale.