Privacy policy
Last updated: 23 October 2026
MailBakes Ltd. ("MailBakes", "we", "us") sells cake cards and letterbox bakes by post through mailbakes.com. This policy explains what personal information we collect, why, who we share it with, and your rights. We are the data controller for your information.
Contact us: hello@mailbakes.com · MailBakes Ltd., Unit 17, Wylam Road, Liverpool L13 4BF, United Kingdom
Company number: 15954204 · ICO registration number: ZB949170
1. What we collect
- Your details – name, email, phone number, billing and delivery addresses, account login details.
- Order details – what you buy, card messages, delivery dates, discount codes, order and refund history. Payment is handled by our payment providers; we never see or store your full card number.
- Recipient details – when you send a gift, the recipient's name, address and the message you write. Please only give us someone's details if you're happy they'd expect to receive a gift from you.
- Personalisation – photos, text and designs you upload or create for a personalised card.
- Reminder dates – birthdays and occasions you save in My Dates, so we can remind you.
- Rewards – loyalty and membership activity, vouchers and rewards.
- Customer service – emails, chats and messages you send us, including photos of any problem with an order.
- Device and browsing data – IP address, browser, device, pages viewed, and how you interact with our site and emails, collected through cookies and similar technologies (see section 6).
2. How we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Taking payment, baking, dispatching and delivering your order; sending order and delivery updates | Contract |
| Handling questions, complaints, refunds and replacements | Contract / legitimate interests |
| Running your account, saved dates, reminders and loyalty rewards | Contract |
| Marketing emails and texts | Consent (or, for emails to existing customers about similar products, legitimate interests – you can opt out at any time) |
| Analytics, site improvements and testing new features | Consent (non-essential cookies) / legitimate interests |
| Personalised advertising on platforms such as Meta, Google and TikTok | Consent |
| Preventing fraud and keeping our site secure | Legitimate interests |
| Keeping tax and accounting records | Legal obligation |
We don't make decisions about you that have legal or similarly significant effects based solely on automated processing.
3. Who we share it with
We only share what's needed, with trusted providers who act on our instructions:
- Store and payments – Shopify (our e-commerce platform) and payment providers Shopify Payments, Apple Pay and Google Pay.
- Delivery – Royal Mail and Parcel2Go, to get your order to the recipient.
- Email, SMS and marketing – Klaviyo.
- Customer service – our email provider (Google) and the customer service and chat tools we use to answer your messages.
- Analytics and advertising – Google (Analytics, Ads, Tag Manager), Microsoft Clarity, Meta (Facebook/Instagram), TikTok, and Triple Whale (marketing attribution).
- Loyalty and site features – apps that run our rewards, product personalisation and reminders.
- AI service providers – to help us answer customer queries and run our business, under contracts that stop them using your data for their own purposes.
- Professional advisers and authorities – accountants, lawyers, HMRC, the police or regulators where the law requires it.
We never sell your personal information.
4. International transfers
Some providers (for example Shopify, Klaviyo, Google, Meta and Microsoft) process data outside the UK, including in the US, Canada and the EU. Where this happens we rely on UK adequacy regulations, the UK International Data Transfer Addendum or equivalent safeguards to protect your information.
5. How long we keep it
- Orders and payment records – 6 years after the end of the financial year, as required for tax.
- Account, saved dates and rewards – while your account is active; deleted 2 years after your last order or login, or sooner if you ask.
- Recipient details and personalisation uploads – kept with the order record; uploaded photos deleted 12 months after delivery.
- Marketing – until you unsubscribe; we keep a note that you've opted out so we don't contact you again.
- Customer service messages – 2 years after the conversation ends.
6. Cookies
We use strictly necessary cookies to run the site (for example your basket and checkout). With your consent, we also use analytics cookies (Google, Microsoft Clarity) and advertising cookies and pixels (Google, Meta, TikTok, Klaviyo). You can accept or reject non-essential cookies in our cookie banner and change your choice at any time, and you can also block cookies in your browser settings.
7. Your rights
Under UK data protection law you can ask us to:
- give you a copy of your personal information;
- correct anything that's wrong or incomplete;
- delete your information;
- restrict or object to how we use it, including for direct marketing (which you can stop at any time);
- transfer it to you or another company;
- withdraw consent where we rely on it.
Email hello@mailbakes.com to use any of these rights. We'll respond within one month and won't usually charge. To unsubscribe from marketing, use the link in any email or reply STOP to a text.
If you're unhappy with how we've handled your information, please contact us first. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
8. Children
Our site isn't aimed at children and we don't knowingly collect personal information from anyone under 16 without consent from a parent or guardian.
9. Security
We use secure, reputable providers, encrypted connections and restricted staff access to protect your information. No system is completely secure, but if a breach affects you we'll tell you and the ICO where the law requires it.
10. Changes to this policy
We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.