Privacy

Last updated 12 October 2026

Who is responsible for your information

David McCulloch (DR McCulloch), an artist at Hale Studios, Unit 12, Millmead Road, Tottenham Hale, London N17 9QU, is the controller of the personal information described here. You can write to me about it there or at .

What I collect and why

When you buy. Payment is taken by Stripe on its own checkout page. Stripe collects your name, e-mail address, delivery address and card details. I receive your name, e-mail address, delivery address and what you bought, so I can send your work and keep a record of the sale. I never see your card details. The lawful basis is the contract between us. Keeping sale records is also a legal obligation.

While you are at checkout. To stop anyone holding back works from other buyers, the shop limits how many checkouts one visitor can have open at once. It does this with a one-way scrambled form of your IP address (a salted hash), never the address itself, kept with the record of the checkout. The lawful basis is my legitimate interest in running the shop fairly.

When you enquire. If you write to me through a form on the shop, I keep your name, e-mail address and message. They are also e-mailed to me so I can reply. The lawful basis is taking steps you have asked for before a possible sale and my legitimate interest in answering you.

When you write to me from the About page. I keep your name, e-mail address and message, with the shop's enquiries, and they are e-mailed to me so I can reply. The lawful basis is my legitimate interest in answering you.

When you sign up for letters. If you ask for my Letters or Announcements, I keep your e-mail address and which of the two you chose, so I can send them. Nothing is kept until you press the button in the e-mail that asks you to confirm. Every e-mail I send carries a link that takes you off either list, or both, straight away. The lawful basis is your consent, which you can withdraw at any time with that link or by writing to me.

When you play the game. When the bot starts on a page my server records the time. When the page is cleared it records the time again. The leaderboard is timed this way so that nobody can make up a score in their browser. Each record holds two random numbers (one for your game, one for the page), which page it was, the times, your browser's own count of the letters the bot ate, whether you played at hyper speed and how many of the page's power-ups you picked up. Nothing about you or your device is kept with them. While you play, the game keeps its place in your browser (session storage) until you close the tab.

When you put your name on a leaderboard. I keep the name you type with your score and time. It may be shown for anyone to see, in the game and on the leaderboard page. Once your name is up, every page you clear later in that game goes on that page's leaderboard under the same name by itself. Your place in the all-time rankings counts every page you clear in that game and is brought up to date each time you clear another. A score close to the fastest the game allows waits until I have checked it. The first name you put up stays yours for the rest of that game. Your browser also remembers it (local storage), so the boards use it next time too. The name doesn't have to be your real one. The lawful basis for the game's records is my legitimate interest in keeping the leaderboard fair. For your name it is your consent. Write to me and I'll delete it.

Your basket. What you put in the basket is kept in your own browser (local storage) and is not sent to me until you go to checkout.

Visits to the site. The site uses Google Analytics to count visits, see which pages are read and how far people get in the game (never the name you put on a leaderboard). It sets cookies and collects information such as the pages you view, roughly where you are, your device and browser. I use it only in aggregate, to understand how the site is used. Your browser also remembers which paintings you have looked at, kept only in that browser, so that a return to one can be counted; with Cookies off nothing is kept. You can switch analytics cookies off with the Cookies switch at the bottom of every page. Your browser settings or Google's opt-out add-on (tools.google.com/dlpage/gaoptout) will also stop it. The site's host, Vercel, also keeps short-lived server logs, including IP addresses, to keep the site running and secure.

Who else handles it

I use these services to run the shop and the site. Each one handles your information only to provide its service:

• Stripe, for payments (stripe.com/gb/privacy)
• Supabase, in London, which stores the shop's stock records, its enquiries and the game's leaderboard
• Resend, which delivers enquiry e-mails to me, keeps the list of people who asked for letters and sends them
• Vercel, which hosts the site
• Google, for Analytics
• Royal Mail, which receives your name and address to deliver your work

Some of these services are based in, or transfer information to, the United States. Where that happens the transfer is covered by the UK's data bridge with the US or by the standard contractual clauses approved for UK transfers. I do not sell your information. I will not add you to a mailing list unless you ask and confirm.

How long I keep it

Records of a sale (your name, address, what you bought and what you paid) are kept for six years, as HMRC requires. Enquiries and messages are kept for up to two years after we were last in touch, unless they lead to a sale. The game's records are deleted a day after the game starts. A name on a leaderboard is kept until you ask me to delete it. Your place on a mailing list lasts until you leave it; when you do, I keep only a note that you left, so you are not sent anything again. Google keeps analytics data for the period set in my Analytics account, at most 14 months.

Your rights

You can ask me for a copy of the information I hold about you. You can also ask me to correct it, delete it, restrict how I use it, object to my using it or send it to you in a portable form. Write to me at the address above and I will reply within a month. Some information I have to keep by law, such as sale records, even if you ask me to delete it.

If you are unhappy with how I have handled your information, please tell me first. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

Changes

If the way the shop handles information changes, I will update this notice and the date at the top.