Privacy policy

Last updated: 27 July 2026

This policy explains what personal information we collect when you visit www.cover-up.com or buy from us, why we collect it, who we share it with, and the rights you have over it. We've written it in plain English — if anything's unclear, email us at help@cover-up.com and a real human in Wales will explain.

Who we are

Cover-Up is a trading name of Infinity Creations Ltd, a company registered in England and Wales (company number 11354317), registered with the UK Information Commissioner's Office (ICO) under registration ZA880497. We are the "data controller" for the personal information described in this policy. You can reach us about anything data-related at help@cover-up.com, or by post: Cover-Up, Unit 1c Kingsway Buildings, Bridgend Industrial Estate, Bridgend, CF31 3YH, United Kingdom.

What we collect

We collect and hold:

  • Identity and contact details — your name, email address, delivery and billing address, and phone number where you provide it.
  • Order information — what you bought, when, for how much, and its delivery and returns history.
  • Correspondence — emails and contact-form messages between us, including support conversations and any photos you send us (for example through our returns portal).
  • Reviews — reviews you choose to leave, and any content in them.
  • Technical and usage information — how you found the site and how you use it, collected through cookies and similar technology (details in our cookie policy).

What we never hold: your payment card details. Payments are processed entirely by our payment providers (Shopify Payments, PayPal and the other options at checkout) on their secure systems — we receive confirmation of payment, never your card numbers.

Why we use your information — and our legal grounds

UK data protection law requires us to have a lawful basis for everything we do with your data. Here's the honest map:

  • To make and deliver your order — including sharing your delivery details with our couriers and, for USA standard orders, our US fulfilment partner. Legal basis: performing our contract with you.
  • To handle your questions, returns and cancellations — including our returns portal and support inbox. Legal basis: performing our contract, and our legitimate interest in looking after customers.
  • To send you marketing emails — only if you've opted in, or where you're an existing customer and the message relates to similar products of ours (with an unsubscribe link on every email, always). This includes a small number of reminder emails if you start a checkout and don't finish it. Legal basis: consent, or our legitimate interest in the case of existing-customer messages and checkout reminders. You can opt out at any time.
  • To invite you to review your purchase — we invite all customers, never selectively. Legal basis: legitimate interest.
  • To keep proper business records — orders, invoices and tax records. Legal basis: legal obligation.
  • To prevent fraud and keep the site secure. Legal basis: legitimate interest.

AI-assisted customer support

A small workshop answers a lot of email, so we're honest about how we do it: when you email our support address, our helpdesk system may use AI assistance (provided by Anthropic) to help draft a reply and to help sort genuine messages from spam. A human reads, edits and approves every reply before it's sent — nothing is sent to you automatically by AI, and your messages aren't used to train AI models.

Who we share your information with

We never sell, rent or trade your personal information. We share it only with the services that make the shop work:

  • Shopify — the platform our store runs on, which stores our customer and order data.
  • Payment providers — Shopify Payments, PayPal, Klarna and the other payment options you see at checkout, to process your payment.
  • Delivery and fulfilment partners — Royal Mail, USPS and our other carriers, the shipping platforms we use to arrange dispatch (Packlink and Veeqo), and our US fulfilment partner for USA standard orders — these receive your name, delivery address and order details as needed to get your order to you.
  • Klaviyo — our email service, which holds email addresses and order history for the emails we send.
  • Judge.me — our reviews service, for collecting and displaying product reviews.
  • Yotpo — which powers our Refer-a-Friend programme.
  • Rebuy — which powers the product recommendations you see on the site, using your browsing and purchase activity with us.
  • Google — for analytics and measuring our advertising (see the cookie policy for how to opt out).
  • Anthropic — AI assistance for drafting support replies, as described above.
  • Secure cloud infrastructure providers — which host our support systems.
  • Business tools — the data-management tools we use to run the store, which access information only on our instructions.

We may also share information where the law requires it — for example in response to a court order — or to exercise or defend our legal rights, or with fraud-prevention services. In the unlikely event the business or its assets are sold, customer information would transfer as part of that sale, under the same protections.

Where your information lives

Some of the services above (for example Klaviyo, Google and Anthropic) are based in the United States. Where your information leaves the UK, we rely on the safeguards UK law provides for such transfers — including UK adequacy decisions and the approved international data transfer agreements these providers operate under.

How long we keep it

Order and transaction records are kept for six years plus the current year, as UK tax law requires. Marketing data is kept until you unsubscribe (unsubscribing keeps a note of your address only so we don't email you again). Support correspondence is kept while it's useful for helping you — typically no longer than necessary for any follow-up, warranty or legal purposes.

Your rights

You have the right to: access a copy of the personal information we hold about you; correct anything inaccurate; have it erased where there's no good reason for us to keep it; restrict or object to how we use it (including objecting to marketing at any time, which we'll always honour); take your data to another service in a portable format; and withdraw consent at any time where consent is our basis for using it.

Exercising any of these is free — just email help@cover-up.com. We'll respond within one month. We may need to confirm your identity first, purely so we don't hand your information to someone else.

If you're unhappy with how we've handled your data, you have the right to complain to the Information Commissioner's Office at ico.org.uk — though we'd appreciate the chance to sort it out first.

Cookies

Our cookie policy explains what cookies we use and how to manage them.

If you're in the United States

We serve US customers from the UK, and we hold ourselves to the standards above wherever you are. For the avoidance of doubt under US state privacy laws (such as California's CCPA/CPRA): we do not sell your personal information, and we do not share it for cross-context behavioural advertising beyond the measurement described above. If you'd like to exercise any right available to you under your state's law — access, deletion, correction or opt-out — email help@cover-up.com and we'll honour it the same way we honour UK rights requests. You can also use our data sharing opt-out page at any time.

Children

Our website isn't aimed at children, and we don't knowingly collect information from anyone under 16. If you believe a child has given us their details, contact us and we'll delete them.

Changes to this policy

We'll update this page when anything changes, with the date at the top. Significant changes will be flagged more visibly.

Questions?

Email us at help@cover-up.com — we'll be happy to help.