Privacy
We ask for as little as we can and we tell you all of it. This page is the whole of it — there is no second policy behind it.
Who we are
Unboxia Limited is the data controller. 134 Rusheeney View, Rusheeney Village, Clonsilla, Dublin D15 YKA6, Ireland. Registered in Ireland, company number 822279. VAT number IE4770579AH.
For anything on this page, email info@unboxian.com. A person reads it.
What we ask for
Only what the checkout asks for. That is:
- Your first name and last name
- Your email address
- Your phone number — optional
- Your delivery address, your town or city and your Eircode — plus a second address line if you want to give one
- Whether you ticked the box to hear about new arrivals — optional, and empty unless you tick it
That is the list. There is no password, no date of birth, no gender and no marketing questionnaire, and you buy as a guest.
One more thing goes with the order without you typing it: how you reached us — for example from Google, from ChatGPT, from Instagram, or directly. Your browser tells the page which site sent you; we keep only the name of that site, never the page you came from, the pages you looked at or what you searched for, and no cookie is set for it.
If you want to see your orders later, you can sign in with the same email: we send you a one-time code and you type it in. That is all an account here is — your email address, confirmed by the code, so the orders placed with it can be shown to you and nobody else. It is optional and buying never needs it.
Without a name, an address and an email we cannot take the order — there is nowhere to send the parcel and no way to tell you it is coming. The phone number and the tick box are yours to leave blank, and leaving them blank changes nothing about the order.
Why we hold it, and what allows us to
| What | What for | What allows it |
|---|---|---|
| Name, delivery address, email | To take the order, post it to you and let you see it again | Performing our contract with you |
| Phone number | So a delivery that goes wrong can be sorted out | Performing our contract with you |
| Name, address, what you bought and what you paid, on the invoice | Because a sale has to be invoiced and the invoice kept | A legal obligation — Irish tax and VAT law |
| The site that sent you (for example Google or ChatGPT) | To know which ways of finding us bring customers | Our legitimate interest in knowing that — it is one word per order |
| Your email, if you ticked the box | To tell you about new arrivals and offers | Your consent, and you can take it back |
The tick box is separate from the order and starts empty. We record the moment you ticked it, because a consent nobody can date is not a consent. Not ticking it has no effect on your order at all.
Right now that box does nothing yet. There is no newsletter and we have not sent a single marketing email. When there is one, it will come with a way out of it in every message.
Your card never touches this site
When you press pay, we hand you over to Stripe and you type your card number on a Stripe page. Your card number, its expiry date and its security code never reach unboxian.com. We do not see them, we do not store them, and we could not show them to you if you asked.
What comes back to us from Stripe is that the order was paid, and a payment reference. That reference is what lets us refund you later to the same card. It is the only thing about your payment that we hold.
After paying you land on your own order page, at a link with a key in it. That link is your copy of the order and it keeps working — keep it, or ask us for it again.
No tracking. Cookies only to keep you signed in.
Browsing and buying set no cookies. If you choose to sign in to see your orders, two cookies keep you signed in, and signing out removes them. That is why you have never seen a consent banner here.
Your basket is kept by your own browser, in its local storage, and it holds only product codes and how many of each. No prices, no name, no email. Each time it changes, your browser sends that list to our server so it can be priced, and we do not keep it. Clearing your browser data wipes it. The cookies page goes through that in full.
There is no Google Analytics, no Meta pixel, no heatmap, no session recorder, no advertising tag and no third-party script of any kind. We do not know which pages you looked at before you bought, and we cannot find out: the only thing we note is the name of the site that sent you, as described above. Nobody is paying us to watch you and we do not sell, rent or hand over your details for anyone else’s marketing.
Even the typeface is ours to serve. It is downloaded once when the site is built and served from this domain, so your browser never asks Google for it and Google never sees your IP address. Most shops get this wrong; it is worth a sentence.
We also make no automated decisions about you and we do not profile you. No algorithm here decides anything that affects you.
Who else sees your details
Six companies, each doing one job for us, each contractually bound to use your details only for that job. They are:
| Stripe | Takes the payment. We send it your email address, your order number, and the list of what you bought with the amounts. Not your address. Not your phone number. |
|---|---|
| Supabase | Runs the database the order lives in. It holds everything on the list above. |
| Vercel | Hosts the site. It serves every page and the checkout form passes through it on its way to the database. |
| An Post | Delivers the parcel. It gets your name and delivery address on the label, and your phone number if you gave one, so the delivery can be arranged. That is what it takes to carry a parcel. |
| Resend | Sends the emails about your order — the confirmation, the dispatch notice and the receipt if you cancel. Those emails carry your name, your delivery address and what you bought, so Resend handles all three. |
| Hostinger | Runs our mailbox, info@unboxian.com. It holds what you write to us, and a copy of every order confirmation we send, so the shop knows there is a parcel to pack. |
Beyond those six: our accountant and Revenue see the invoices, because that is what invoices are for. And if we were ever legally required to hand something over, we would. That is the whole list.
Where your details are kept
The database holding your order sits in Frankfurt, Germany — inside the EU. Supabase, the company that runs it, is registered in Singapore, and its staff may need to reach the servers from outside the EU to keep them working. Its contract with us carries the European Commission’s standard contractual clauses to cover that.
Stripe’s European business is run from Dublin, and Stripe also moves personal data to Stripe, LLC in the United States. Where it does, it relies on the EU–US Data Privacy Framework, and on the standard contractual clauses where the Framework does not apply.
Vercel is an American company. The server code that handles the checkout form runs in Frankfurt, next to the database. The pages themselves are delivered through Vercel’s worldwide network, so they may be processed outside the EU, including in the United States. Vercel is certified under the EU–US Data Privacy Framework and its contract with us also carries the standard contractual clauses.
Resend is an American company, based in San Francisco. The order emails may be processed in the United States; Resend relies on the EU–US Data Privacy Framework and on the standard contractual clauses in its contract with us.
Hostinger is a Lithuanian company. It keeps data in the United Kingdom, the Netherlands, Lithuania and Cyprus, and has some servers outside the EU; where data leaves the EU it relies on the standard contractual clauses.
An Post is Irish, and your parcel never leaves the country: we deliver within the Republic of Ireland only.
How long we keep them
Your order and its invoice — your name, your delivery address, your email, what you bought and what you paid — six years from the end of the year you ordered in. Revenue requires a business to keep its records for six years and an invoice with your name on it is one of those records. We cannot delete it sooner even if you ask, and we do not keep it longer.
Your phone number is not part of that record. We remove it once the parcel has arrived and the time to cancel and send it back — 14 days, plus 14 more to post it — has run out.
Your marketing tick, if you gave it, until you take it back. Take it back and we delete it.
Your basket lives in your own browser and we cannot delete it or get it back for you. It is emptied once your payment is confirmed, or when you clear your browser.
Your rights
All of these are yours, they are free, and asking costs you nothing but the email. We answer within one month.
- See it. Ask for a copy of everything we hold about you, and we will send it.
- Correct it. A misspelt name or a wrong address — tell us and we fix it.
- Delete it. We will, except for what the six-year tax rule above makes us keep. We will tell you exactly what stayed and why.
- Take it with you. Ask and we will send you the details you gave us in a machine-readable file you can hand to somebody else.
- Object, or pause us. Tell us to stop using your details, or to hold them without using them while something is being sorted out.
- Change your mind about marketing. Email us and the tick goes. It has no effect on your orders, and there is nothing to undo, because nothing has been sent.
Email info@unboxian.com with your order number if you have one. There is no form.
If you are not happy with us
Tell us first and we will try to put it right. But you do not have to, and you can complain to the Irish regulator at any time:
Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963. www.dataprotection.ie. Complaints go in writing, through the form on their site.
Delivery and returns
How your order gets to you, what it costs and your 14 days to change your mind are all on the delivery and returns page. Refunds go back through Stripe, to the card you paid with.
Changes to this page
If we start doing something new with your details, this page changes first and the date below changes with it.
Last updated 14 September 2026.