Privacy Policy

Stonewing Ltd, company number 17450442, VAT registration number GB 530 1941 23, registered office 167–169 Great Portland Street, London, England, W1W 5PF.

Stonewing Ltd is the controller of personal data described in this policy unless section 15 explains that we act only on a business customer’s instructions. Contact our privacy team at privacy@stonewinggroup.com.

This policy covers our public website, business account and onboarding journeys, customer dashboards, support, orders, subscriptions, fulfilment and public pages reached through Stonewing NFC or QR stands.

Stonewing is a business service and is not directed at children. We do not knowingly seek to collect children’s personal data through the service.

We collect business and location information; account-holder names, work contact details and authentication records; delivery addresses; order, subscription, payment-status and support records; page configuration and uploaded brand content; and operational security records.

Stripe processes complete payment-card details. Stonewing receives payment references, status and limited billing information needed to operate the account, but not complete card numbers.

Our public customer pages do not require a visitor account or personal details. The engagement record stores the relevant business, location, product, event type and time. It does not store the visitor’s IP address, user agent, referrer, cookie identifier, device identifier or identity.

To stop automated or repeated requests from distorting a business's figures, our server briefly uses the IP address your device connects from, as reported by our network provider, Cloudflare. It combines that address with the current date and a secret key to make a scrambled code. It then counts how many page views and link clicks that code makes on the same stand in one minute. Stonewing does not save the IP address itself. The scrambled code changes every day and is never added to the engagement record. It is deleted automatically, usually within a few minutes. An hourly clean-up normally removes any remaining codes within 70 minutes. If the clean-up fails, deletion may be delayed; we monitor for this and promptly delete any overdue codes. Everyone sharing one internet connection (for example the same Wi-Fi) shares the same allowance. If the allowance is exceeded, extra visits in that minute are not counted, but the page still works normally. For each stand we keep only a daily total of uncounted visits, with no visitor information. Our lawful basis is legitimate interests: keeping our customers' statistics accurate and protecting the service from abuse. The code lasts only a short time and we cannot link it back to you, so we would not normally be able to identify you from it. Access or erasure requests for it are therefore unlikely to apply in practice (UK GDPR Article 11). You can still object, and you can contact us about any of your rights. This is separate from the connection logs kept by our hosting, network and database providers, described below.

This section describes only what Stonewing’s own engagement record stores. Separately, like any website, our hosting, network and database providers (Lovable, Cloudflare and Supabase) automatically process technical connection data, such as IP address, browser user agent, time and requested address, to deliver pages and protect the service. Stonewing does not copy this into the engagement record or use it to identify visitors. We have not yet verified exactly which fields each provider logs or for how long; we will update this policy when we have.

A click records an outbound visit only. It does not tell Stonewing whether a review, follow, booking or purchase was completed on the destination service.

We receive information directly from business customers and their authorised users, from use of the service, from payment and email providers, and from staff carrying out support and fulfilment. A business may also provide work details for colleagues it authorises.

We use information to take steps at your request and perform our contract; process and evidence orders and acceptance; deliver stands; operate subscriptions; authenticate users; provide support; prevent abuse; secure, monitor and improve the service; maintain financial and legal records; and establish or defend legal claims.

Our lawful bases are contract, legitimate interests in operating and securing a business service, and compliance with legal obligations. Where consent is specifically required, we will ask for it separately and it may be withdrawn.

If you are a sole trader, you are our customer, so we rely on contract to set up and run your account, take payment, deliver stands and send service messages. If you act for a company or other organisation, our contract is with that organisation, so we rely on our legitimate interests in dealing with its representatives for the same purposes. For everyone, we rely on legal obligations for tax and accounting records; and on legitimate interests for keeping evidence of which terms were accepted, when and by whom, security, fraud prevention, support records, the stand supply record described below and establishing or defending legal claims.

We use Supabase for database, authentication and related infrastructure; Stripe for payment processing; Resend for service email delivery; and Lovable, with Cloudflare’s network, to host, serve and operate the application. Our database and file storage are hosted in London (Amazon Web Services eu-west-2). Our business mailbox (including support@, privacy@ and accounts@) is provided by Microsoft 365; Resend sends account and service emails such as order confirmations and payment notices. For most information these providers act on our behalf as processors. When a business customer sends page content to support, or asks us to return its content after service ends, Microsoft 365 handles that content on the customer’s behalf as a subprocessor under Schedule 1 of our Business Terms; Resend is not used for that content. Stripe and delivery carriers may also act as independent controllers for their own legal and regulatory purposes. We disclose only what each provider needs for its role.

We may also disclose information to professional advisers, regulators, courts, law enforcement, a prospective buyer of our business, or another person where required by law or necessary to protect legal rights.

Businesses choose links to external review, social, booking and website services. Those services process visitors under their own privacy information once a visitor follows a link.

Some providers may process information outside the United Kingdom. Where restricted transfers occur, we rely on an applicable UK adequacy regulation, approved contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum, or another lawful transfer mechanism, together with supplementary measures where appropriate.

We keep information only as long as needed for its purpose. Today most deletion is carried out manually under our retention schedule, not automatically; the periods below are the periods we apply.

• Orders, payments, subscriptions, cancellation and terms-acceptance evidence: 6 years after the end of the financial year or service they relate to (accounting and limitation periods).
• Business accounts and sign-in details: deleted about 12 months after all services end, unless needed for an open dispute.
• Unsuccessful or abandoned purchase journeys: 12 months after last activity.
• Delivery addresses: 2 years after dispatch, or longer while a replacement or dispute is open.
• Service email records and staff task records: 2 years.
• Support emails and their attachments: while the issue is open and for up to 2 years afterwards, unless needed for a legal claim. Copies of customer content sent to us for support or returned to a customer follow the 120-day limit below.
• Business customer page content we process for the customer: returned or deleted as set out in Schedule 1 of our Business Terms, and removed from our active systems no later than 120 days after service ends.
• Anonymous engagement history: kept to provide reporting and history, reviewed after 3 years.
• Information in provider backups: overwritten in the providers’ normal backup cycle and not restored for other purposes.

Printed stand artwork. We keep each printed artwork file while the location is subscribed and delete it within 120 days after its service ends, to handle faults, replacements and complaints, unless, before then, a specific claim, complaint or dispute about that stand has been raised by or with us, or a legal requirement applies; in that case we keep that file only for that matter, record why, and delete it once the matter is finally resolved and any time to appeal has passed. After that we keep only a supply record — order, stand code, print date, artwork version and a file fingerprint, with no image — for six years after service ends, as controller, to establish or defend legal claims about what we supplied. Our lawful basis is legitimate interests. Access is limited to Stonewing administrators, and we review these records each year. You can object by contacting privacy@stonewinggroup.com.

Where law requires us to keep information longer, or it is needed for an ongoing legal claim, we keep it restricted to that purpose until the need ends.

We use proportionate technical and organisational measures including controlled access, tenant separation, authentication, access logging and encrypted provider connections. No internet service can guarantee absolute security. Please report suspected account compromise promptly to privacy@stonewinggroup.com.

Stonewing uses browser storage that is necessary for sign-in, security, session continuity and remembering limited interface choices.

The Get Started journey uses sessionStorage only for a journey identifier, which keeps your order together if you reload the page and prevents duplicate orders. It is deleted when you close the tab. We do not read or store campaign (UTM) parameters, the referring web page, a marketing channel or a referral code from the link you followed, and we do not record them with your order. If we offer this in future, we will update this policy first and ask for consent where it is required.

Public Stonewing tap pages do not set a Stonewing visitor tracking identifier. The public tap-and-scan analytics described above do not use visitor tracking cookies or advertising identifiers. We do not currently use a marketing or behavioural advertising cookie programme.

We send expected service messages about accounts, orders, dispatch, billing problems and cancellation. These are not marketing messages. Stonewing does not currently operate a marketing-email programme through this service.

Depending on the circumstances, UK data-protection law may give you rights to access, correct or erase personal data; restrict or object to processing; receive portable data; and withdraw consent. Rights are not absolute and may not apply to anonymous data or records we must retain.

To exercise a right, contact privacy@stonewinggroup.com. We may need to verify your identity and authority. We normally respond within one month, subject to lawful extensions.

Stonewing is controller for account administration, orders, billing, delivery, support, security, our anonymous tap and scan analytics and our own operations. Where personal data is included in page content, links or images a business customer configures (for example names, photographs or social profile links of its staff), that customer is controller and Stonewing processes that content as its processor under Schedule 1 (Data Processing Schedule) of our Business Terms. Requests about such content should normally go to the business concerned; we will pass on any we receive. Customers must not upload personal data they lack authority to use.

Please contact privacy@stonewinggroup.com first so we can investigate. You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk or by using its published contact channels.

We may update this policy as our service or legal obligations change. We will publish the current version here and communicate material changes where appropriate. Privacy and data-rights enquiries should be sent to privacy@stonewinggroup.com.