Privacy Policy

1. Scope

This policy explains how we handle personal data when you use the free fundraising Hub. If you place a print order, the personal data involved in fulfilling that order is handled under the privacy terms you agree to at the point of ordering.

2. What we collect

If you use the Hub without giving an email:

• the designs and content you create;
• basic usage events (e.g. pack created, design downloaded, which products you use) and the device type (mobile/desktop);
• limited technical/diagnostic data, including a hashed form of your IP address (we use a one-way SHA-256 hash; we never store your raw IP);
• error diagnostics if something breaks (to help us fix it).

If you give an email (e.g. to save a pack, or because you placed a print order):

• your email address, and the link between you and your packs;
• order-related information where you order printing.

We do not ask for more than we need, and we don't collect special-category data through the Hub.

3. Why we use it, and our legal basis (UK GDPR Article 6)

What	Why	Legal basis
Creating/storing your designs	To provide the Hub you asked for	Contract / legitimate interests
Magic-link & save-to-email	To let you return to your packs	Contract
Usage events & device type	To understand and improve the Hub	Legitimate interests
Error diagnostics	To detect and fix faults	Legitimate interests
Marketing emails to existing customers	See §5	Legitimate interests (soft opt-in under PECR)
Print orders	To fulfil your order	Contract

Where we rely on legitimate interests, we've weighed them against your rights; you can object (see §9).

4. Children's and schools' data

4.1 The Hub is for adults (18+) acting for their organisations. It is not directed at children and is not intended to be used by children.

4.2 We operate a hard prohibition on uploading images of children (Acceptable Use §2.2). Because uploaded images never travel to other users or into the gallery, the Hub does not create a public space in which a child could be shown.

4.3 If you believe a child's personal data has reached the Hub, contact us at help@stubbstickets.com and we will remove it.

5. Email and marketing — the soft opt-in basis

5.1 No spam pledge. We don't sell your details, and we don't send marketing to people who haven't bought from us or asked to hear from us.

5.2 Soft opt-in. Where you are an existing customer and gave us your details when buying from us, we may email you about our similar products and services (including the free Hub), relying on the soft opt-in under the Privacy and Electronic Communications Regulations. You were and are able to opt out.

5.3 Two separate streams. Marketing emails and transactional/service emails (proofs, order updates, and account notices such as the inactivity warnings in §7) are kept separate. Opting out of marketing does not stop the transactional emails you need.

5.4 Every marketing email has an unsubscribe link tied to your unique token, and we honour unsubscribes and complaints promptly.

6. Cookies

6.1 At launch the Hub uses a single essential session cookie (PHPSESSID) to make the site work. It is not used for tracking or advertising and does not need consent.

6.2 (When we later add analytics that set non-essential cookies — e.g. session-replay tools — we will add a cookie-consent mechanism and load them only after consent, and this section will be updated. None of that is active at launch.)

7. How long we keep your data

7.1 Inactive packs are deleted after 18 months of no activity. "Activity" means any of: logging in, editing a pack, or placing an order — not just ordering. We chose 18 months (not 12) because fundraising is seasonal, so a genuine once-a-year fundraiser is never caught out.

7.2 Before deletion, we send a short series of warning emails ("your designs are about to be removed — log in to keep them"). These are transactional service notices about your own account, so they are sent regardless of marketing preferences.

7.3 If there is still no activity, we delete the pack and its uploads.

7.4 Order records are kept as long as we need them for the print order, accounting and legal reasons, under our main retention policy.

8. Who we share data with (sub-processors)

We use a small number of trusted providers to run the Hub. We name them openly:

Provider	Purpose
Krystal	Website and database hosting
Replicate	AI image tools (e.g. background removal)
Anthropic	AI features (design help / copy generation)
Adobe Stock	Licensed background imagery in our themes
Postmark	Sending emails (if/when used for Hub email)
Microsoft Clarity	Usage analytics (only when enabled, after cookie consent — not active at launch)
Trust Payments	Payment processing for print orders

We don't sell your data or share it for others' marketing. If we add a new provider, we'll update this list.

9. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased (including asking us to delete your packs and uploads);
• restrict or object to certain processing;
• data portability where it applies;
• withdraw consent where we relied on it.

To exercise any of these, email help@stubbstickets.com. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, though we'd appreciate the chance to put things right first.

10. Security

10.1 We protect your data with measures including: storing only a SHA-256 hash of IP addresses (never the raw IP); using secure database queries throughout; validating uploads (image types only, size-limited); non-guessable pack addresses; and keeping pack pages out of search-engine indexes.

10.2 No system is perfectly secure, but we take reasonable steps to protect your information and to detect and fix problems.

11. Changes

We may update this policy. The current version is always here with its "last updated" date.

Back to Fundraising Hub  ·  Terms of Use