Privacy Policy

Who we are

This website is operated by Lily Brunning, trading as Sloth & Moth (“we”, “us”, “our”). We are the data controller responsible for the personal data described in this policy.

Registered/business address: Suite RA01, 195-197 Wood Street, London, E17 3NU

How to contact us

For anything relating to your personal data, email us at slothandmothengland@gmail.com.

What personal data we collect

This is currently a pre-launch website. We are not taking orders or payments, and we do not collect payment details. When you join the waitlist we collect and store:

• your email address;
• the date and time you signed up;
• the page or source you signed up from;
• a record that you gave marketing consent, and the exact wording shown to you at the time;
• a one-way, non-reversible hash of your IP address, kept briefly and used only to limit repeated automated submissions. We do not store your IP address itself.

Our hosting and infrastructure providers also process standard technical data (such as IP address and browser details) in their own server logs in order to deliver and secure the website.

Why we collect it and our lawful basis

We use your email address to run The Do Nothing Candle waitlist: to send launch updates, first access and early-bird offers. Our lawful basis is your consent (UK GDPR Article 6(1)(a)), given by submitting the waitlist form. The wording presented at signup is:

“By joining the waitlist, you agree to receive emails from Sloth & Moth about The Do Nothing Candle, including launch updates, first access and early-bird offers. You can unsubscribe at any time. View our Privacy Policy.”

We also rely on our legitimate interests to keep the website secure and to prevent spam and abuse of the signup form.

Withdrawing consent and unsubscribing

You can withdraw your consent at any time. Every marketing email we send includes an unsubscribe link, and unsubscribing takes effect immediately. You can also email us at slothandmothengland@gmail.com and ask to be removed. Withdrawing consent does not affect anything we sent before you withdrew it.

How long we keep it

We keep waitlist data until the earlier of: you unsubscribe or you ask us to delete it. If you unsubscribe, we keep a minimal record of your email address and unsubscribe date so we do not email you again by mistake. Spam-prevention hashes are deleted after a short period.

Who processes your data

We use a small number of service providers who process data on our behalf:

• Lovable — website hosting, platform and managed email sending infrastructure.
• Supabase — the database in which waitlist entries are stored.
• Cloudflare — content delivery and website security.
• Google (Gmail) — receives an internal notification containing your email address when a signup occurs, so we know somebody has joined.
• Google Fonts — the site loads typefaces from Google's font service, which means your browser makes a request to Google and your IP address is visible to them as part of that request.

We do not sell your data, and we do not share it for anyone else's marketing.

International transfers

Some of these providers are based in, or operate infrastructure in, countries outside the UK, including the United States. Where personal data is transferred outside the UK, it is protected by an appropriate safeguard, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework, as applicable to the provider. 

How we protect your data

The website is served over HTTPS. Waitlist records are stored in a database that cannot be read by website visitors and are only accessible to authenticated administrators and to our server-side code. Access keys and credentials are held as server-side secrets and are never included in anything sent to your browser.

Cookies and tracking

Strictly necessary technologies keep the website working and secure, including a record of your cookie choice stored in your browser. We also use Google Analytics to understand how the site is used, but only if you accept it: analytics cookies are not loaded until you press Accept, and pressing Reject prevents them entirely. You can change your choice at any time using Cookie Settings in the footer. We do not use advertising pixels, remarketing tags or session-recording tools.

Full details are in our Cookie Policy. Where analytics is accepted, Google acts as a processor and may process data outside the UK; we ask Google to anonymise IP addresses.

Your rights

Under UK data protection law you have the right to:

• ask what personal data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to how we use it;
• ask for your data in a portable format;
• withdraw consent at any time.

To exercise any of these, email slothandmothengland@gmail.com. We will respond within one month.

Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint, or by calling 0303 123 1113.

Changes to this policy

As we move towards launch this policy will be updated, for example when we begin taking orders. The date at the top shows when it was last changed.