Privacy

Last updated July 2026

The short version: I collect the minimum needed to grow garlic and post it to you, and I don't sell or share your details with anyone.

What I collect

When you order: your name, email, delivery address, and what you bought. When you join the drop list: just your email. When you email me: whatever you put in the email. Beyond that, nothing — no profiles, no buying data about you from anyone.

What I use it for

Fulfilling your order, telling you when drops open or ship, and answering your emails. If you’re on the drop list, you’ll get a handful of emails a year — when pre-orders open, when things ship, and the occasional field note. Every email has an unsubscribe link that actually works.

Payments

Card payments are handled by Stripe — I never see or store your card details. When you pay, your card and billing details go directly to Stripe, which processes them as an independent controller under its own privacy policy (stripe.com/privacy). Stripe may transfer data outside the UK; it does so under recognised safeguards.

Who else sees your data

The delivery company gets your name and address so your parcel arrives. Stripe handles payments. My email provider (Brevo) stores the drop list and sends the drop emails. The site runs on Netlify, which processes form submissions on my behalf. I use Make.com to connect these systems — it moves order and email data between them and stores nothing longer than it needs to. Nobody gets your details for marketing — not now, not ever, not for any amount of money.

Analytics

The site uses Ahrefs Analytics to count visits — which pages get read and where visitors come from. It’s the privacy-respecting kind: no cookies, no personal data collected, nothing that identifies you (ahrefs.com/privacy). If I ever add anything that needs cookies, you’ll be asked first — with a banner you can say no to without anything changing.

How long I keep it

Order records are kept for six years because tax law says so. Drop-list emails are kept until you unsubscribe. If you email me, the thread stays in my inbox until it’s no longer useful.

Cookies

The site itself sets no cookies. When you buy something, Stripe’s checkout (on stripe.com) sets the cookies it needs to process your payment securely — that’s covered by Stripe’s own policy. No advertising cookies, ever.

Your rights

Under UK GDPR you can ask me what I hold about you, ask me to correct it, or ask me to delete it (subject to the tax-records rule above). Email milly@elephantgarlic.co.uk and I’ll deal with it personally — there is no data protection department, there’s just me.