Privacy Policy

Drunken Monkey is the controller of your personal data under the UK GDPR and the Data Protection Act 2018. For anything about this policy or your data, email [email protected].

• Account details: your email address and password (stored only as a secure hash), or your basic profile from Google, Apple or Facebook if you sign in with them.
• Photos you upload and the designs, titles and messages you create from them.
• Order details: the recipient's name and delivery address, what you ordered, and delivery tracking.
• Payment details: handled by Stripe. We see whether a payment succeeded, never your card number.
• Reviews you choose to leave about an order.
• Technical data: your IP address and browser details, used to keep the service secure and stop abuse.
• How you use the site: which pages you visit and steps you take, such as viewing a design, starting checkout or placing an order, with the type of device and the site that sent you. If you accept analytics cookies we can also link visits from the same browser, and record how you move around a page (see Cookies).

• To make and deliver your order, including generating artwork from your photo, taking payment and sending it to print. Basis: performing our contract with you.
• To process your photo with AI. Basis: your consent, which you give with the checkbox before uploading. You can withdraw it at any time by deleting your photos.
• To run your account, send order updates, password resets and a request for a review after delivery. Basis: contract and our legitimate interests.
• To keep the service safe, prevent fraud and enforce our Content Policy. Basis: our legitimate interests.
• To keep financial records as required by UK tax law. Basis: legal obligation.
• To understand how the site is used and improve it, for example which designs are popular and where people get stuck. Basis: our legitimate interests for counting visits and the steps you take; your consent for analytics cookies and session recordings. We never use this for advertising.

Your photos get extra care:

• They are used only to create artwork for you. We never sell them, use them for advertising, or show them publicly.
• The copy we send to our AI providers, and the artwork we make, carry no location or camera details (EXIF data). The original you uploaded keeps them until you delete it.
• They are stored privately and only you can see them. Our support team sees the finished design, not the original photo.
• You can delete any photo at any time in Account → Photos. This removes it from our storage. Designs you already made from it stay in your account.

We never sell your data. These services process it for us, under contracts that let them use it only on our instructions, and each gets only what it needs:

• Amazon Web Services (London, UK): hosts our website, database and photo storage. Holds all the data described in this policy.
• Google (Gemini) (United States): generates artwork from your photo. Receives your photo and the words you add to the design.
• fal.ai (United States): draws the artwork instead if Google declines a photo. Receives your photo and the design, only when that happens.
• Stripe (United States and Ireland): takes payments. Receives your email address and payment details, which we never see.
• Printify and its print partners (Latvia, the United States and print sites near the delivery address): print and post your order. Receive your artwork, the recipient's name and delivery address, and your email address for delivery updates.
• Delivery couriers, chosen by Printify: receive the recipient's name and delivery address.
• Zoho (European Union): sends our emails. Receives your email address and the content of the emails we send you, such as order confirmations and password reset links.
• Google and Apple (United States): only if you choose to sign in with them. They tell us your email address and basic profile.
• Meta (Facebook) (Ireland and the United States): only if you choose to sign in with Facebook. Tells us your email address, name and profile picture. We don't post to Facebook or see your friends.
• PostHog (European Union): product analytics, only if you accept analytics cookies. Receives the pages you visit and what you click, your browser and device type, and an account ID if you're signed in. Text you type into forms is masked and never sent.

Stripe and Printify also keep some order and payment data to meet their own legal obligations, and Google, Apple and Meta keep your sign-in account. That data is covered by their own privacy policies, including how long they keep it, and deleting your Drunken Monkey account doesn't remove it.

Where data leaves the UK, we rely on UK adequacy regulations (for the European Union and the UK–US Data Bridge) or the UK International Data Transfer Agreement or Addendum to protect it. We may also share data if the law requires it.

• Photos: until you delete them, or until your account is deleted.
• Designs: while your account is open, so you can reorder.
• Orders and payment records: six years after the end of the financial year they relate to, as UK tax law requires.
• Records of how the site is used: 13 months, then deleted automatically. If you delete your account they are kept only as anonymous counts.
• Account details: until you delete your account in Account → Overview, or ask us to.

You can delete your account yourself in Account → Overview, or ask us to by emailing [email protected]. If an order is still being made or is on its way, you can delete your account once it has been delivered.

• Deleted straight away: your profile and sign-in details, photos, designs, print files, basket, reviews and any checkouts you didn't pay for.
• Kept for tax records: what you ordered, when, the price, VAT and the delivery address, for six years after the end of the financial year of the order, as UK tax law requires. These records are no longer linked to you and no longer include your artwork or gift messages. They are deleted automatically when the period ends.
• A note that the account was deleted, with the date but no name or email address, so we can show we did it.
• Backups: copies in our database backups are overwritten within 35 days.

Data that Stripe, Printify, Google, Apple or Meta hold under their own policies isn't covered by this (see Who we share it with).

If you signed in with Facebook, you can also remove Drunken Monkey from your Facebook account in Settings & privacy → Settings → Apps and websites. That stops the sign-in; to delete the data we hold, delete your account as described above.

Strictly necessary, always on because the site can't work without them:

• next-auth.*: keep you signed in and protect forms against forgery. Last for your session, or up to 30 days if you stay signed in.
• dm_consent: remembers your cookie choice, for 6 months.

Analytics, only if you accept them:

• dm_aid: a random ID that lets us recognise repeat visits from the same browser, for 13 months.
• ph_*: set by PostHog to measure how the site is used and, for some visits, record how you move around a page. Up to 1 year.

We don't use advertising cookies. If you reject analytics cookies we still count page visits, but without any cookie or ID that could recognise you. You can change your choice at any time from Cookie settings at the bottom of every page; withdrawing consent deletes the analytics cookies.

Data is encrypted in transit. Images are served through short-lived signed links, access to our systems is limited to the people who need it, and passwords are never stored in readable form. No system is perfectly secure, so if we ever have a breach that puts you at risk, we'll tell you and the ICO as the law requires.

Under UK data protection law you can ask us to:

• give you a copy of your personal data
• correct data that is wrong
• delete your data, including your whole account
• restrict or object to how we use it
• send your data to you or another service in a portable format

Email [email protected] from the address on your account. We'll reply within one month. If you're not happy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

You must be 18 or over to create an account and buy from us. Photos of children may be uploaded only by, or with the permission of, a parent or guardian.

If we make significant changes we'll update the date at the top of this page and, where appropriate, email you.