Leovo

Privacy policy

Last updated 10 August 2026

This explains what we do with your information. It describes what actually happens on this website — not a generic template.

Who is responsible for your data

Oscar Read, trading as Leovo, is the data controller. That means we decide what personal data is collected and why. You can reach us at hello@leovohelps.com.

What we collect, and why

We only ask for what we need to make and send your cards.

• Business name, address and postcode — so we can find your Google listing and programme the card to the right place.
• Branch details — for multi-site orders, the name and address of each branch, so each card points at the correct one.
• Email address — to confirm your order, tell you when it ships, and check anything unclear.
• Instagram handle — only if you order an Instagram card.
• Delivery address — collected by Stripe at checkout so we can post your order.
• Order details — what you bought, when, and how much you paid.

We never see your card number. Payment is handled entirely by Stripe. Your card details go to Stripe, not to us, and we could not retrieve them if we wanted to.

Our lawful basis

• Performing our contract with you — everything needed to build, pay for and deliver your order.
• Legal obligation — keeping records of sales for HMRC.
• Legitimate interests — keeping the site secure and preventing fraud, and answering you when you get in touch.

We do not rely on consent for any of the above, because none of it is optional to fulfilling your order. If we ever want to send you marketing, we will ask separately and you can say no without affecting your order.

What we do not do

• We do not sell your data. Not to anyone, for any amount.
• We do not run advertising trackers or profile you across other websites.
• We do not send marketing emails unless you have asked for them.
• We do not make automated decisions that produce legal effects for you.

Who else touches your data

We use a small number of providers to run the business. Each processes data on our instructions only.

• Stripe — takes payment and collects your delivery address. Stripe is a controller in its own right for fraud prevention. See stripe.com/gb/privacy.
• Supabase — stores order records in a database we control, protected so it cannot be read from the public internet.
• Vercel — hosts the website and keeps short-lived technical logs.
• Royal Mail or a comparable carrier — receives the name and address needed to deliver your parcel.

Some providers process data outside the UK. Where that happens, transfers are covered by the UK International Data Transfer Agreement or equivalent safeguards.

How long we keep it

• Order and payment records — 6 years. HMRC requires this for tax purposes.
• Emails you send us — 2 years after the conversation ends.
• Website technical logs — around 30 days.

Cookies

This site sets no advertising or analytics cookies. Your basket is remembered using your browser’s local storage on your own device — it never reaches us until you check out, and clearing your browser data removes it.

Stripe sets its own cookies on its checkout pages, which are strictly necessary for taking payment and preventing fraud. That is why you are not asked to accept cookies here: we do not set any that require consent.

Your rights

Under UK GDPR you can ask us to:

• give you a copy of the data we hold about you;
• correct anything inaccurate;
• delete it, where we are not required to keep it for tax purposes;
• restrict or object to how we use it;
• transfer it to another provider.

Email hello@leovohelps.com and we will respond within one month. There is no charge.

Complaints

If you think we have handled your data badly, tell us first and we will try to fix it. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Children

Leovo sells to businesses and does not knowingly collect data from anyone under 18. If you believe a child has given us personal data, tell us and we will delete it.