Privacy policy

1. Who we are

1.1 Jinglebell is operated by Samuel Cross, a sole trader, trading as Jinglebell (“Jinglebell”, “we”, “us” or “our”).

1.2 For the purposes of UK data-protection law, Samuel Cross trading as Jinglebell is the controller of the personal information covered by this Privacy Policy.

1.3 You can contact us about privacy or your personal information at: Email: elf@jinglebell.io. Address: Jinglebell c/o The Beehive, Stembrook, Dover CT16 1PF.

2. Personal information we may collect

Depending on how you use Jinglebell, we may collect and use the following kinds of personal information.

2.1 Account and contact information

This may include:

• your name;
• email address;
• phone number;
• account identifier;
• login and authentication information; and
• communication and marketing preferences.

Jinglebell currently uses passwordless authentication. When you sign in, a code is sent to your email address rather than Jinglebell asking you to create a password.

2.2 Photographs and content you provide

This may include:

• photographs and other images you upload;
• cropped or processed versions of uploaded images used to create your character;
• character and face-positioning information;
• saved characters;
• saved designs;
• text, messages, doodles and other content you add to a creation; and
• design previews and files needed to produce your creation.

Some image-processing functions may take place locally on your device. Where processing happens entirely on your device, the image does not need to be sent to us for that particular processing step.

However, photographs and processed versions may subsequently be uploaded and stored where necessary to save your character or design or provide another Jinglebell feature.

2.3 Order and delivery information

When you place an order, we may process information such as:

• your name;
• email address;
• phone number;
• billing and delivery address;
• products ordered;
• photographs, designs and other personalisation information needed to produce your order;
• order date and order reference;
• order and payment status;
• delivery and tracking information; and
• previous order history.

2.4 Payment information

Payments are handled by a third-party payment provider.

Jinglebell may receive information associated with the transaction, such as your name, contact details, billing information, transaction status and payment reference.

We do not receive or store your full payment-card details.

2.5 eCard information

If you purchase or send a Jinglebell eCard, we may process:

• your details;
• the recipient's name;
• the recipient's email address;
• photographs, characters, designs, messages and other content included in the eCard;
• the chosen delivery date; and
• information about sending or delivering the eCard.

If somebody sends you a Jinglebell eCard, we may therefore receive personal information about you from the person sending it rather than directly from you.

2.6 Customer-service and communications information

If you contact us, we may keep information including:

• your name and contact details;
• the contents of your message;
• information about your account or order where relevant; and
• our correspondence with you.

2.7 Technical, security and usage information

When you use Jinglebell, our systems and service providers may automatically process technical information such as:

• IP address;
• date and time of requests;
• browser and device information;
• operating system and general device type;
• language settings;
• referring page or website;
• pages or resources requested;
• technical request and response information;
• authentication and security events; and
• information about how Jinglebell is used.

We may also use cookies, pixels and similar technologies as explained below.

3. Information about other people

3.1 Jinglebell is designed to let people create personalised characters and products. This means the person using Jinglebell may sometimes upload a photograph of somebody else.

3.2 If somebody uploads your photograph, likeness or other personal information through Jinglebell, we may process that information even though you did not provide it to us directly.

3.3 Our Terms require users to have the appropriate rights and permissions to use the photographs and other content they upload.

3.4 Where an identifiable child appears in an uploaded image, our Terms require the user to be the child's parent or legal guardian or to have appropriate permission from their parent or legal guardian.

3.5 We use this information only for the purposes described in this Privacy Policy and our Terms, such as creating, storing and producing the Jinglebell creation requested by the user.

4. Why we use personal information and our lawful bases

UK data-protection law requires us to have a lawful basis for using personal information. Different bases may apply to different activities.

4.1 Providing Jinglebell and fulfilling orders

We use information where necessary to:

• create and save characters and designs;
• provide account features;
• process purchases;
• create and send eCards;
• manufacture personalised products;
• arrange delivery;
• provide order updates; and
• deal with problems relating to an order or service.

This processing is generally necessary to perform our contract with you or to take steps you request before entering into a contract.

4.2 Operating and improving Jinglebell

We may process information where reasonably necessary to:

• operate and maintain the service;
• diagnose technical problems;
• understand how Jinglebell is being used;
• improve our services;
• maintain appropriate business records; and
• manage our relationships with service providers.

We generally do this on the basis of our legitimate interests in operating, maintaining and improving Jinglebell. Where consent is required for a particular analytics or storage technology, we will instead ask for your consent before using it.

4.3 Security, fraud prevention and misuse

We may process account, transaction and technical information to:

• protect accounts;
• detect and prevent fraud;
• investigate suspicious activity;
• protect Jinglebell and its users;
• enforce our Terms; and
• maintain the security and integrity of our systems.

We generally do this on the basis of our legitimate interests in protecting Jinglebell, our customers and our systems, or where necessary to comply with a legal obligation.

4.4 Legal, tax and accounting requirements

We may retain and use information where necessary to comply with applicable tax, accounting, consumer-protection and other legal obligations. Where we are legally required to do this, our lawful basis is compliance with a legal obligation.

4.5 Customer support

We use information you provide when contacting us to answer your enquiry, investigate problems and provide customer support.

Depending on the reason for your message, this may be necessary for performance of our contract with you or based on our legitimate interests in providing customer service and operating Jinglebell.

4.6 Marketing

If you choose to receive Jinglebell marketing emails, we may use your name, email address and marketing preferences to send you news, offers, product information and other Jinglebell marketing.

Where you have opted in to marketing, we rely on your consent.

In some circumstances, we may also send marketing about similar Jinglebell products or services where you have previously purchased from us or expressed an interest in purchasing and the law allows us to do so without consent. In those cases, we may rely on our legitimate interests.

You can unsubscribe from marketing at any time using the unsubscribe option in our emails or by contacting us.

Your marketing choices do not affect service or transactional communications that we need to send in connection with your account, purchases or use of Jinglebell.

4.7 Cookies, analytics and advertising

We may use cookies and similar technologies for purposes including:

• making the website function;
• maintaining sessions and account features;
• remembering choices;
• understanding how Jinglebell is used;
• measuring website performance; and
• measuring or supporting advertising.

The legal basis depends on the technology and purpose involved.

Where consent is legally required, we will ask for it. You can manage your choices using our cookie controls.

More information is available in our Cookie Policy.

5. Anonymous creations

5.1 You may be able to use parts of Jinglebell and begin creating a character before registering for an account.

5.2 To make this work, Jinglebell may temporarily associate uploaded photographs, character information and creation data with an anonymous session or device rather than a registered account.

5.3 If you create something without an account, we may keep your creation and associated uploaded images for up to 12 months.

5.4 We may delete anonymous creations sooner, including from 3 months after they were created.

5.5 If you want to keep an anonymous creation, you should save it to a registered Jinglebell account.

5.6 You may be able to delete an anonymous creation using the same browser or device used to create it.

5.7 If you no longer have access to that browser or device and want us to delete an anonymous creation, contact us at elf@jinglebell.io. We may ask for enough information to locate the relevant creation and avoid affecting somebody else's information, such as the character name and approximate date it was created.

6. How we use photographs

6.1 Uploaded photographs may be used to create Jinglebell characters, designs, eCards, digital creations and personalised products.

6.2 To provide these features, we may store the original uploaded image and create additional cropped or processed image files needed for web display, character positioning and print production.

6.3 Certain face-detection, cropping or background-removal functions may operate locally on your device. Where this happens, the image does not leave your device for that particular processing operation.

6.4 This does not mean that photographs are never uploaded to Jinglebell. Uploaded photographs and resulting image files may be stored where necessary to save and provide your creation.

6.5 We do not use uploaded photographs to identify who somebody is through facial recognition.

6.6 We do not use your uploaded photographs in Jinglebell advertising simply because you uploaded them. If we ever want permission to feature a customer's photograph or creation for a separate promotional purpose, we will ask separately where appropriate.

7. Who we share personal information with

We may share or make personal information available to third parties where reasonably necessary to operate Jinglebell, including:

7.1 Hosting and technology providers

Providers that host or support our website, databases, storage, authentication and other technical infrastructure.

7.2 Payment providers

Providers that securely process payments and help manage transactions, refunds, fraud prevention and related payment functions.

7.3 Manufacturing and fulfilment providers

Where you order a physical product, we provide the information reasonably necessary to manufacture, fulfil and arrange delivery of your order. This may include the relevant print/design file, your name, delivery address, contact details and other order information.

7.4 Delivery providers

Your name, delivery address, contact details and relevant order or delivery information may be provided to delivery providers so that they can deliver your order. This information may be provided to them by us or by the manufacturing or fulfilment provider handling your order.

7.5 Email and communications providers

We use third-party services to send and receive communications including account authentication codes, order communications, eCards, customer-support messages and marketing emails.

7.6 Analytics and advertising providers

Analytics and advertising providers may process information about visits to and interactions with Jinglebell.

7.7 Professional advisers, authorities and legal recipients

We may disclose information where reasonably necessary to obtain professional advice, establish or defend legal rights, comply with a legal obligation, respond to lawful requests or protect Jinglebell, our users or others.

7.8 Other service providers and contractors

We may also share personal information where reasonably necessary with other people and businesses that help us operate Jinglebell, such as customer support providers, virtual assistants, designers, professional advisers, customer relationship management providers, business administration providers and other technology or operational service providers. The information they receive will depend on the services they provide and what they need to perform them.

7.9 Business transfers

If Jinglebell or all or part of its business or assets is sold, transferred, reorganised or acquired by another person or business, personal information may be disclosed or transferred as part of that transaction. Where required, we will take appropriate steps to ensure your personal information continues to be handled in accordance with applicable data-protection law.

8. Marketing emails and other communications

8.1 If you actively choose to receive Jinglebell marketing emails, we may send you information about products, offers, promotions and other Jinglebell news.

8.2 Marketing consent is optional and does not affect your ability to purchase from or use Jinglebell.

8.3 You can unsubscribe at any time using the unsubscribe option in a marketing email or by contacting us.

8.4 We may keep a record that you have unsubscribed so that we can respect your choice and avoid sending you marketing you have declined.

8.5 Account authentication codes, order confirmations, delivery information, eCard communications, security messages and other communications necessary to provide something you've requested are not treated as membership of our general marketing list.

9. Cookies and similar technologies

9.1 Jinglebell uses or may use cookies, pixels, local storage, scripts and similar technologies.

9.2 Some are necessary to provide functions such as authentication, security, shopping baskets and saved sessions.

9.3 With your consent, we use Google Analytics (provided by Google) to understand how visitors use the site, and the Meta Pixel (provided by Meta) to measure how our adverts perform. These only run if you accept the Analytics or Marketing category in our cookie banner; both are switched off until you choose.

9.4 Consent is our legal basis for these analytics and advertising technologies. We send them only page activity, steps in the studio and basic order details such as product references, quantities and the order value, not your name, email address, postal address or designs.

9.5 You can withdraw or change your consent at any time using the "Cookie settings" link in the site footer or the button on our Cookie Policy page (/cookies), which also lists each technology, who sets it and how long it lasts.

10. How long we keep personal information

We do not intend to keep personal information for longer than reasonably necessary for the purposes for which it is used.

Different information therefore has different retention periods.

10.1 Account information and saved creations

Account information, uploaded imagery, saved characters and designs may generally be retained while your account remains active or until you delete the relevant content.

You can delete your Jinglebell account through your account settings.

10.2 Anonymous creations

Anonymous creations and associated uploaded images may be retained for up to 12 months from creation and may be deleted by us sooner, including from 3 months after creation.

You may be able to delete an anonymous creation directly from the same browser or device you used to create it. If you can no longer access it that way, you can contact us and we will try to locate it for you. If you'd like an easier way to save, manage and delete your creations, you can create an account.

10.3 Deleted information and backups

When account content is deleted, it is removed from Jinglebell's live systems.

Deleted information may remain temporarily in encrypted disaster-recovery backups. Our current routine backup cycle retains those snapshots for up to 7 days, after which deleted information rolls off as the backup cycle progresses.

These disaster-recovery backups are not used as ordinary live databases.

10.4 Orders and transactions

Deleting an account does not necessarily mean we can delete every record relating to a completed purchase.

We may retain order, transaction, delivery and related business records for as long as reasonably necessary to meet applicable tax, accounting, legal, fraud-prevention, dispute and record-keeping requirements.

Where possible, links between those retained records and deleted account content may be removed or minimised.

10.5 Customer communications

We retain customer-service and other correspondence for as long as reasonably necessary to deal with the enquiry, maintain appropriate business records, resolve disputes and meet applicable legal requirements.

Messages sent through our contact form are delivered to our inbox. If delivery fails, we keep a copy so we can still reply. Records of contact form use (without your message) and any such copies are deleted after 90 days.

10.6 Technical and security information

Technical, authentication and security logs are retained for periods appropriate to their purpose, including operating and securing Jinglebell, troubleshooting problems, preventing misuse and investigating technical or security incidents.

The exact period may vary according to the type of log and the service provider involved.

10.7 Marketing information

We retain marketing information while you remain subscribed. If you unsubscribe, we may retain limited information about your marketing history, previous consent and marketing preferences where reasonably necessary for record-keeping, compliance and to make sure we continue to respect your choices.

11. International processing

Some of the companies that help us operate Jinglebell may process personal information outside the United Kingdom.

Where personal information is transferred outside the UK, we take appropriate steps to ensure that it is protected in accordance with applicable UK data-protection law. This may include relying on UK adequacy regulations or appropriate safeguards.

You can contact us at elf@jinglebell.io if you would like further information about safeguards relevant to your personal information.

12. Keeping information secure

We take reasonable technical and organisational measures intended to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

No internet service or storage system can guarantee absolute security. If we become aware of a personal-data breach, we will assess and respond to it in accordance with applicable law.

13. Your data-protection rights

Depending on the circumstances and the lawful basis we rely on, UK data-protection law may give you rights including the right to:

• ask for access to personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• ask us to delete personal information in certain circumstances;
• ask us to restrict how we use information in certain circumstances;
• receive certain information in a portable format where the right to data portability applies;
• object to certain uses of your information; and
• withdraw consent at any time where we rely on your consent.

These rights are not all absolute and may depend on why we are using the information and the circumstances of your request.

Your right to object

You have the right to object at any time to the use of your personal information for direct marketing.

If you object to direct marketing, we will stop using your personal information for that purpose.

Where we rely on legitimate interests for other processing, you may also have a right to object. We will consider your request in accordance with applicable data-protection law.

To exercise your rights, contact elf@jinglebell.io.

We may need to ask for information reasonably necessary to identify you and locate the relevant information.

14. Photographs and rights requests

If you believe a photograph of you or other personal information about you has been uploaded to Jinglebell by somebody else and you have concerns about its use, please contact us. We may ask for information reasonably necessary to locate it and deal with your request.

15. Children

15.1 Jinglebell accounts, purchases and contracts are intended for adults aged 18 or over.

15.2 However, we recognise that an adult may use a photograph showing a child when creating a Jinglebell character or personalised product.

15.3 Our Terms require a user uploading an identifiable child's image to be the child's parent or legal guardian or to have appropriate permission from their parent or legal guardian.

15.4 If you are a parent or legal guardian and believe a child's personal information has been used through Jinglebell inappropriately, please contact us at elf@jinglebell.io.

16. Changes to this privacy policy

We may update this Privacy Policy as Jinglebell develops, our service providers or features change, or legal requirements change.

The latest version will be published on our website with its updated date.

Where a change materially affects how we use personal information, we will take reasonable steps to bring it to the attention of affected users where appropriate.

17. Complaints and contacting us

If you have a question, concern or request relating to your personal information, please contact us first so that we have the opportunity to help.

Email: elf@jinglebell.io

Address: Jinglebell c/o The Beehive, Stembrook, Dover, CT16 1PF, United Kingdom.

You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's data-protection regulator.

You can find information about your data-protection rights and how to raise a concern on the ICO's website.