Your data,
not our product.
Most privacy policies are written to protect the company. This one is written to be read. It says what we collect, why we collect it, and how to make us stop. Ask us anything that it fails to answer.
third parties, ever
request you make
if it ever happens
Last updated 9 July 2026 · Curio Ltd is the data controller
Three promises
We never sell your data
Not to advertisers, not to data brokers, not to anyone. There is no commercial arrangement anywhere in this business that involves passing your details to a third party for money.
We collect the minimum
A shipping address to send a parcel. An email to confirm it arrived. We do not ask for a date of birth, a phone number, or a gender to sell you headphones.
You can leave with everything
Ask, and we export every record we hold on you in a portable format — or delete it outright. No retention team will call to talk you out of it.
What we collect, and why
"Lawful basis" is the legal justification required under UK GDPR and the EU GDPR to process personal data at all. Where the basis is consent, you may withdraw it at any time and we stop. Where it is contract, refusing means we cannot ship you an order.
Who else sees it
- Shopify
- Storefront, checkout, and order records. Our data processor.
- Shopify Payments · Stripe
- Card authorisation and fraud checks. They see the card; we do not.
- Carriers
- Your name, address, and phone only when needed to make a delivery.
- Email provider
- Order confirmations and, if you opted in, the newsletter.
- Tax and law enforcement
- Only where we are legally compelled, and only what is compelled.
Each of these is a processor acting on our written instructions, not an independent owner of your data. None of them may use it for their own purposes.
Your rights
Access
Get a copy of everything we hold about you.
Rectification
Correct anything that is wrong or out of date.
Erasure
Have your records deleted, subject to tax retention rules.
Portability
Receive your data in a machine-readable format.
Objection
Object to processing based on legitimate interest.
Withdraw consent
Unsubscribe or revoke consent at any time, without penalty.
Exercise any of these by writing toprivacy@curio.example. We reply within 30 days, free of charge. If you are unhappy with the outcome you may complain to the Information Commissioner's Office at ico.org.uk — though we would rather you gave us the chance to fix it first.
The small print
How long do you keep my data?
Order records are held for seven years, because tax law requires it. Marketing consent lasts until you withdraw it. Analytics are aggregated after 14 months. Delete your account and everything not legally required goes with it.
Do you use cookies?
Only what the shop needs to work — your cart, your session, your preferences — plus privacy-respecting aggregate analytics. No advertising or cross-site tracking cookies. Details on the cookies page.
Where is my data stored?
On Shopify infrastructure, which may process data outside the UK and EEA. Those transfers rely on Standard Contractual Clauses and equivalent safeguards.
Is my data used to train AI models?
No. Your orders, messages, and browsing are not used to train machine-learning models, ours or anyone else's.
What happens if there is a breach?
We notify the regulator within 72 hours and tell you directly, without delay, whenever there is a meaningful risk to you. We will tell you what happened before we know exactly how.
Do you track children?
Curio is not intended for anyone under 16. We do not knowingly collect their data, and we delete it promptly if we learn we have.
Ask a human.
No legal department, no automated response. Write to us and someone who understands both the policy and the database will answer you properly.