LEGAL
Privacy Policy
Exactly what this shop holds about you, why it holds it, who else sees it, and how to make it stop.
Last updated 30 Oct 2026
Who holds your data
MTBAY is run by a private limited company registered in England and Wales. That company is the data controller for everything described on this page: it is the one that decides what is collected and why, and the one you can hold to it.
- Registered company name
- MT MARKETPLACE AND CONSULTING LTD
- Company number
- 17358203
- Registered office
- MT Marketplace and Consulting, 124 City Road, London, EC1V 2NX, England
- ICO registration number
- — to be confirmed —Most organisations that keep customer records have to be on the Information Commissioner's register and pay the data protection fee.
- mt@mtbaymarket.comEverything in this policy goes here, including a request to see or delete your data.
UK data protection law applies: the UK GDPR and the Data Protection Act 2018. There is no separate privacy address, no web form and no ticket system — the address above is a real inbox and a person reads it.
Nothing here is sent anywhere else
When you open a page on this shop, your browser talks to this shop and to nothing else. No analytics, no tag manager, no advertising pixel, no embedded video, no map, no chat widget, no social button. No third party is told that you were here.
That is unusual enough to be worth spelling out, because a site with no cookie banner and no tracking looks like something was forgotten. Nothing was forgotten. The site's font is downloaded once when the site is built and then served from this shop's own domain, so reading a page makes no connection to Google. The only outside address in the page source is the XML namespace that labels an SVG drawing, which is a name and not a request.
If that ever changes — an analytics tool, an embedded video, a help widget, a mailing list — this page changes with it before the change ships, and a consent banner appears if one is needed.
Three cookies do have to exist for the shop to work at all. They are listed in full, with their lifetimes and their flags, on the cookie page.
What is held about you
Four things, and each one only after you do something that needs it. A visitor who reads the catalogue and leaves is not recorded anywhere.
An account, if you make one. Your email address, the name you type in, and the date you signed up. Your password is not stored. What is stored is a bcrypt hash of it at cost 12 — a one-way scramble that cannot be turned back into your password, by us or by anyone who steals the database.
An order, when you buy something. The email address the receipt should go to, which is your account address unless you type a different one at the checkout; the currency; which kits you bought and what each line cost on the day; the total; and the moment you agreed to the file being released straight away.
A basket, when you add a kit. Which kits you picked and which currency the basket is priced in. Before you sign in, that basket is reached by a cookie holding a random id — not by your name, not by your email, not by anything about you.
An email, if you send one. A commission enquiry or a support question arrives as an ordinary email in the shop owner's inbox, carrying whatever you chose to put in it. No form on this site posts an enquiry anywhere.
The sign-up box in the footer stores nothing at all. There is no mailing list behind it yet: the address you type never leaves your browser and is gone when the page reloads. When a real mailing list is wired up, joining it will be a deliberate choice and this page will name whoever runs it.
That is the whole list. No postal address, no phone number, no date of birth, no card number, no advertising identifier, no browsing history and no record of what you looked at.
Your IP address
Your IP address is read from the request when you sign in, register or sign out, and it is used to count attempts — ten per fifteen minutes from the same address. That is what stops somebody working through a list of stolen passwords against this shop's sign-in form.
It is held as a counter key in the memory of the web server. It is never written to the database and never written to a log: the only thing the server logs about a failed request is the method and the path. The counter lives as long as its window — fifteen minutes for sign-in attempts, one minute for everything else — and every restart of the server erases all of them.
It is not attached to your account, not used to work out where you are, and not used to recognise you on a later visit.
Why each of these is lawful
UK GDPR wants a named reason for each use, not one list at the bottom of the page. These are ours, one at a time.
Your account exists because you asked for one, and the shop cannot hand you a sign-in, a basket that survives a visit, or a download page without it. The basis is performance of a contract with you.
Your order exists for the same reason: nobody can sell you a file without writing down what was sold. Keeping that record afterwards is a different basis — legal obligation, because HMRC requires a business to keep its sales records.
The timestamp of your agreement to immediate supply is kept because consumer law makes the seller prove the agreement was given before the download was unlocked. Legal obligation again. A tick box nobody wrote down proves nothing six months later.
Counting sign-in attempts by IP address rests on our legitimate interests — specifically, not having customers' accounts broken into. We weighed that against your interest in not being identified: what is used is one number, held in memory, for fifteen minutes, read by nobody and kept nowhere. There is no lighter way to do it, and not doing it leaves every account on the shop open to a password list.
Three cookies keep the shop working: your session, your basket and the language you chose. Under the Privacy and Electronic Communications Regulations they are strictly necessary for a service you asked for, so they need no consent and there is no banner. The cookie page explains that in full.
Nothing on this site runs on consent, because nothing on this site asks for any. If a mailing list or an analytics tool is ever added, consent will be asked for plainly, refusing will cost you nothing, and withdrawing it will be as easy as giving it.
Paying
This shop cannot take money yet. The checkout writes an order with the status pending and stops there. No payment provider is connected, no card number has ever been typed into this site, and no card details exist anywhere in it.
Payments will go through Stripe. When they do, your card details will be typed into fields that Stripe controls and sent straight to Stripe. They will not travel through this shop's servers and will not be stored here — what comes back is the fact that a payment succeeded or failed, which is written onto your order. Stripe will be a controller in its own right for what it collects, under its own privacy policy, and this page will name it and link to it on the day it goes live.
Until that day, read the paragraph above as a plan rather than a description. Nothing in it is happening yet.
How long each thing is kept
- Your account
- Until you ask us to delete itIt is yours, and expiring it while you are using it would help nobody.
- Your password hash
- Deleted with the accountIt has no use once the account is gone.
- Orders and their lines
- Six years after the saleHMRC requires sales records to be kept that long, so an order outlives a deletion request. See your rights, below, for what happens to the rest of it.
- Your agreement to immediate supply
- Kept with the orderIt is the seller's only proof that you were told your 14-day cancellation right was ending.
- A basket you never checked out
- The cookie expires after 7 daysThe basket row in the database currently stays until it is cleared out by hand: there is no automatic clean-up yet. It holds product slugs and a currency, and nothing that identifies you.
- Sign-in counters keyed by IP address
- 15 minutes at mostIn the server's memory only, and gone on restart.
- Emails you send us
- — to be confirmed —No retention period has been set for the inbox yet. This row will say one when it has.
Nothing on this list is kept because it might be useful later.
Where in the world it is
Not decided yet, and this page will not guess. The hosting provider has not been chosen, so the country your data will sit in is not yet known. It will be named here, in the row above, before the shop takes a payment.
If any of it ends up outside the UK, the transfer will run on one of the routes UK law allows — an adequacy decision covering that country, the International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses — and this page will say which one.
Stripe operates internationally, so paying for something will involve a transfer once payments are live. The same promise applies: this page will name the mechanism rather than wave at it.
How it is kept safe
The measures worth stating are the ones you could check, not the ones that sound reassuring:
- Passwords are hashed with bcrypt at cost 12, and never stored, logged or emailed in readable form.
- The session cookie is httpOnly, so no script running on the page can read it, and it is marked Secure on the live site, so your browser never sends it over plain HTTP.
- The server refuses to start in production without a real signing key for sessions, rather than falling back to a weak one.
- Error messages never carry database output, so a failure cannot leak somebody else's row to you or yours to them.
- Every download is checked against the order it belongs to on each request, and the files are not kept in a publicly served folder.
No system is perfect and this one is young. If you find a problem, email the address at the top of this page and you will get an answer.
What you can make us do
UK GDPR gives you these rights over what we hold. Using them is free, and we have one month to answer.
- See it. Ask for a copy of everything held about you.
- Correct it. Tell us the name or the email address is wrong and we will change it.
- Delete it. Your account and your basket go. Orders are the exception: HMRC requires the sales record to be kept, so the order stays and we remove what is not needed to justify it.
- Restrict it. Ask us to stop using something while a dispute about it is settled.
- Take it with you. Ask for your account and order data in a file another service could read.
- Object. Tell us to stop a use that rests on legitimate interests, which here means only the sign-in counter.
- Withdraw consent. Nothing here runs on consent today, so there is nothing to withdraw; if that changes, withdrawing will be one step.
Email mt@mtbaymarket.com and say which one you want. You do not have to cite the law or use any particular wording. We may ask you to confirm you control the email address on the account first, because handing somebody's order history to whoever asks for it would be the worse failure.
If we get it wrong, you can complain to the Information Commissioner's Office, the UK's data protection regulator. You can go to them without telling us first — though we would rather you gave us the chance to fix it.
No decisions are made about you
Nothing here profiles you. There is no scoring, no segmentation, no personalised pricing and no automated decision that has any effect on you: every visitor sees the same catalogue at the same price, in the currency that goes with the language they are reading.
Article 22 of the UK GDPR gives you the right to have a decision made only by a machine looked at by a person. It has nothing to do here, because no decision of that kind is made.
Children
This shop sells design tools to people doing professional work, and it is not meant for children. Buying something means entering a contract, so an account is for an adult. We do not ask anybody's age, which means we could not tell, and we do not try to guess from anything else.
If a child has made an account here, email us and it will be deleted.
When this page changes
The date at the top of this page is the date its wording last changed in substance. A change is made here, on this page, and that date moves with it.
A change that gives us a new reason to use data you have already handed over — a mailing list, an analytics tool, a new processor, a new country — will not be made quietly. Account holders will be emailed before it takes effect, and anything that needs consent will ask for it rather than assume it.