Privacy policy

We collect what we need to make your plaque, deliver it, and run your album. We do not sell your data, we do not use your photographs for marketing, and your album is not public or indexable.

• Order details — your email address, delivery address, what you ordered, and the amount paid.
• Album content — the photographs, videos, trip dates and description you upload.
• Account details — if you create one: your email address, your name if you give it, and a hashed password. We never store your password itself.
• Technical data — your IP address and browser, used for security and rate limiting.
• Analytics — only if you consent. See the cookie policy.

We do not receive or store your card details. Payments are processed by Stripe, and card data goes directly from your browser to them.

Order and album data is processed to perform our contract with you. Security logging and fraud prevention rely on our legitimate interests in running the service safely. Analytics and marketing email rely on your consent, which you can withdraw at any time.

Only the suppliers needed to run the service: our payment processor (Stripe), our email provider, our hosting and file-storage providers, and the carrier delivering your parcel. Each receives the minimum necessary — the carrier gets your delivery address, not your photographs.

We do not sell personal data, and we do not share it for advertising.

Album pages carry instructions telling search engines not to index them, are never listed anywhere public, and cannot be found by guessing — the identifiers are long random values.

Media files are stored privately and served through short-lived links that expire within minutes. Access is checked on every request.

Anyone holding your physical plaque can view its album. That is the purpose of the product, and it is worth remembering before you hand it round.

Albums have a 50-year access term from creation. Viewing and uploads stop when that term ends. Expiry does not automatically delete media; you can contact us to request a copy or deletion of your data. Order records are kept for seven years, which is what UK tax law requires. Security logs are kept for a short period and then discarded.

Under UK GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, object to processing, or ask us to send it elsewhere. Email triptapofficial@gmail.com and we will respond within one month.

Deleting an album deletes its photographs and videos. That cannot be undone, so keep your own copies.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk.