Privacy Policy

Who is responsible

Apparition Instruments Ltd is a company registered in England and Wales (company number 17454761), based in Nottingham, United Kingdom. We decide how customer information is used for this website, Orders and enquiries. You can reach us through the Contact Us page or email luke@apparitioninstruments.co.uk.

Information you give us and why

When you place an Order, we process your name, email address, delivery address, items and kit choices, Order reference, payment status, amount paid or refunded, and fulfilment and tracking details where applicable. We use these to take payment, fulfil and deliver your Order, provide updates, handle refunds and respond to questions. Guest checkout remains available. If you sign in with a verified email address and view My Orders, previously unowned guest Orders placed with that same email address can be associated with your account. Once associated, they remain with that account even if its email address changes.

When you send an enquiry, we process the name, email address, category, optional Order reference and message you submit, so we can receive and reply to it. The enquiry is sent to our business inbox using our email provider. To limit repeated submissions, the Contact system records a submission identifier, outcome and keyed fingerprints of the submitted email address and, where supplied to the server, IP address. For an authenticated enquiry about an Order you own, the audit also records the verified Order reference. It does not store the message body in that audit table.

Customer Accounts and Google Sign-In

You may register with an email address and password, confirm your address, sign in, request a recovery email and sign out. Supabase Auth processes the account identifier, email, password authentication information, email verification and sign-in/session details to run these features. Your password is handled by the authentication service; this site does not display it or put it in our Orders database.

If you choose Continue with Google, Google provides Google user data to Supabase Auth for the sign-in flow. The basic identity information available through this flow includes your Google account identifier, email address and verification status, and may include the name/display name and profile picture supplied by your Google Account. Supabase Auth can retain provider identity information and basic profile fields in its authentication records. On the Account page, Apparition uses the verified email address to identify and display the signed-in account; it does not display or copy a Google profile picture or name into a separate customer-profile or Orders table.

We use this Google user data only to authenticate you, create or recognise your Apparition account and maintain your signed-in session. Supabase processes it as our authentication service provider. Google supplies the identity information for the sign-in; we do not sell Google user data, share it with advertisers or use it for advertising. We do not request access to Gmail, Google Drive, Google Calendar, Google Contacts, your files or other unrelated Google services. The Google Sign-In request uses basic identity permissions (openid, email and profile); no additional Google product scopes are requested by the website.

Supabase Auth exchanges the Google sign-in response and provides an Apparition session. The Supabase browser client stores session data on your device to keep you signed in; depending on the OAuth response, that session may also contain a Google provider access token and, if supplied, a provider refresh token. The website does not read those provider tokens to call Google APIs. Do not use Google Sign-In on a shared device unless you sign out and clear the browser's site storage afterwards.

Payments, delivery and messages

Stripe hosts the secure payment step and processes card/payment information. Apparition receives payment identifiers, outcome and amounts needed to record and manage the Order; card details entered into Stripe Checkout are not collected by our website. We share the delivery details needed to send your parcel with the delivery service used for your Order. Our server-side email service sends Order confirmations and eligible Order-status and full-refund messages to the email address supplied for the Order. Contact enquiries go to our business inbox. These services process information to provide the requested transaction or response, not to advertise Google-derived account data.

Browser storage and technical information

The website saves basket contents and kit selections in your browser's local storage. The customer Account page uses a separate local-storage key for your Supabase Auth session and the temporary verifier needed to complete secure redirects. Admin access has its own authentication storage. You can remove local data with your browser's site-data controls; removing a session may sign you out or clear a saved basket. The web host and authentication, payment and email providers may process technical information needed to deliver their services, such as request and connection information. The Contact system uses an IP fingerprint, when available, for submission limits. We do not use Google account information for behavioural advertising.

Who receives information

Information goes to the providers needed for the service you use: Supabase for authentication and the website's operational database, Google for the Google sign-in you choose, Stripe for checkout and refunds, our hosting and email providers for website delivery and transactional messages, and the carrier used to deliver your Order. We provide each with information relevant to its role. A provider's own privacy information may explain its separate processing when you interact with its service. We may also disclose information where required by law. We do not sell personal information.

How long information is kept and how it is protected

Account information remains in Supabase Auth while the account is maintained, unless it is deleted or must be retained for a specific obligation. Order, payment and correspondence records are kept for the time needed to fulfil Orders, deal with queries, refunds and disputes, and meet applicable record-keeping duties. The Contact submission audit fingerprints are automatically removed after 14 days; this does not delete messages already delivered to our business inbox. Browser storage remains until you clear it, sign out where applicable, or the browser removes it. We use restricted administrative access and service-side controls for account and Order records, but no online service can guarantee absolute security.

Your choices and rights

You can use guest checkout without creating an account, or choose email/password instead of Google Sign-In. You may ask us about the personal information we hold, request correction or deletion where applicable, or raise a concern about how it is used. Some Order records may need to be retained even if you close an account. Contact us using the details above so we can review your request. You can also complain to the UK's Information Commissioner's Office (ico.org.uk). You can disconnect the application's access in your Google Account settings; this does not by itself delete an Apparition account or Order history.

Changes to this policy

We will update this page if our website or information-handling practices change. The date above identifies this version. For privacy questions, use our Contact Us page.