What we
keep.

Who we are

EN¿GMA MADE is the trading name of Chris Doughty, a sole trader based in Scotland, at Codebase, 8–10 Corn Exchange Road, Stirling, FK8 2HX. This policy covers enigmamade.com and shop.enigmamade.com. We decide what happens to the information described here, which makes us the data controller for it. Questions, requests and complaints all go to hello@enigmamade.com.

The short version

We do not run analytics. There are no advertising or social pixels, nothing profiles you across the web, and we do not sell or share anything with anyone for marketing. We only hold what you hand us to get something done, plus the minimum needed to stop the site being abused.

When you buy something

Checkout is handled by Stripe. You give them your card details directly. Those never touch our servers and we never see them. Stripe passes us your name, email address and delivery address, because we cannot post a parcel without them.

Why we can: we need it to carry out the order you placed. How long: order records are kept for six years, because UK tax law requires it.

The fitting room, the character generator and the customiser

These make a picture with an AI image model. You give us a photograph, an email address and, if you want, a short note on how the picture should look. In the customiser you may also upload a logo or design.

Your photograph. It is sent to Replicate, who run the model. The model itself is Google's, so Replicate pass the request to Google to process. We do not write your photograph to our own servers. Replicate and Google hold the request under their own retention terms, so please don't upload anything you would not want a third party to process.

The finished picture is stored for 30 days at a long, unguessable web address that we email to you, then deleted automatically. The address is not listed anywhere, but anyone you forward it to can open it. Your email address and note are kept with that record for the same 30 days, so we can send you the picture or tell you it failed.

We see the results. When a picture is finished we get an email with your email address, your note and a link to the picture, so we can spot misuse and fix pictures that come out wrong. The link stops working when the picture is deleted after 30 days.

Daily limits. Each picture costs us money to make, so we log the email address, the IP address and the date of each one to enforce a daily limit. That log is deleted after 30 days.

Customiser uploads. A logo or design you upload is stored on our server so we can show it and make the picture. Ask us and we will delete it.

Why we can: you asked us to make the picture, so we process what's needed to make it. Keeping the limit log is in our legitimate interest in keeping the service affordable and preventing abuse. The generators are for people aged 13 and over.

The wall

A character only goes on the public wall if you press Send to wall after you have seen it. Nothing goes up automatically. Once it's up, anyone can see it, and it stays there until you ask us to take it down. Email us and we'll remove it. Deleting the file is all it takes, so it will be quick.

Why we can: your consent, which you can withdraw at any time.

When you ask to be notified

If you sign up to hear when something is back in stock or released, we store your email address with the garment, colour and size you asked about. We use it for that one message and nothing else. There is no newsletter to be quietly added to. Ask us and we will delete it.

Certificates of authenticity

The register at enigmamade.com records who owns each garment: a name and an email address. A certificate page is public and shows the owner's name, so anybody buying second-hand can check it. It does not show the email address. Transfers need confirmation by email from both the current owner and the new one, which stops somebody moving a certificate that isn't theirs. When a certificate page is opened we log the time and a one-way scrambled (hashed) version of the IP address, so we can see if a certificate is being copied.

Why we can: it's part of what you bought, and a working register is in the legitimate interest of every owner. How long: for as long as the certificate exists, because a chain of ownership with holes in it is not a chain of ownership.

Cookies and things stored in your browser

One cookie, called em_v. It holds a random number, no name and nothing identifying, so that a garment you have hearted can be un-hearted by the same browser. It lasts three years and does nothing else.

Your bag, saved items, light or dark preference, customiser designs and puzzle progress on enigmamade.com are kept in your browser's own storage. That never reaches us. Clear your browser data and it is gone.

Fonts. Some of our pages load their typefaces from Google Fonts. When they do, your browser sends your IP address to Google, as it would to any website it fetches from. Google says it doesn't use this to profile you.

Who else touches it

Stripe: payments and checkout.
Replicate: runs the image models behind the fitting room, the character generator and the customiser.
Google: the image model Replicate runs, and the web fonts.
Resend: delivers our email.
Vercel and GoDaddy: host the site and its API.

They act on our instructions, and none of them get anything for their own marketing. Several are based in the United States, so your information may be processed there. Where it is, it is protected by the UK's approved safeguards for international transfers: the UK Extension to the EU-US Data Privacy Framework, or the UK's standard contract clauses.

What you can ask for

You can ask for a copy of what we hold about you, ask us to correct it, delete it or stop using it, object to us holding it at all, and withdraw any consent you have given. Email hello@enigmamade.com and we will deal with it within a month.

If you think we have handled your information badly and we have not put it right, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first and gave us the chance to fix it.

Last updated 21 October 2026. See also our terms.