Privacy
What we know about you, and why
AT HESTIA is a shop that recommends furniture and sends you to the retailer to buy it. We do not take payments and we do not hold card details. What we do hold is listed below, in full.
Who we are
AT HESTIA Ltd, registered in England & Wales, company number 17198649. We are the data controller for everything described here.
Registered address: Hillside House, Leverstock Green Road, Hemel Hempstead, England, HP3 8QD
For anything about your data, email hello@athestia.com.
What we collect, and why
If you join the newsletter
Your email address, your first name if you give one, the rooms you said you were interested in, and which form you signed up from. We record when you opted in and when you unsubscribe.
Your email is passed to Flodesk, who send the emails for us, along with your first name and rooms. Flodesk also receives your IP address at the moment you sign up. That is a record that you consented, which is what makes it a legal sign-up rather than us adding you. We do not store your IP address ourselves.
Our lawful basis is your consent. Every email has an unsubscribe link, and unsubscribing anywhere stops everything.
If you ask to be told when something opens
Some rooms and categories are not open yet and have a “tell me when this opens” box. We keep your email address against that one room or category, and the date we told you. That is all. It is a list of one thing, not a newsletter, and we use it once.
Our lawful basis is your consent. Ask us and we will take you off it.
If you make an account
Your email address and a password, stored as a one-way hash so that nobody here can read it, including us. Your first and last name, your country and postcode, the rooms you are interested in, and how you heard about us, all of which are optional. Your marketing preferences, and the date you set each one. We record roughly when you last signed in.
Our lawful basis is performing the contract of giving you an account. The exception is your marketing preferences, which are consent.
What you save
The pieces you save, and the names of any projects you put them in. Only you and we can see them.
When you click through to a retailer
We record which piece you clicked, which colour, which region, which retailer link, the search you typed if you came from one, and which page you came from. If you are signed in, that record is linked to your account. If you are not, it is linked to a random number kept in your browser for a year, which lets us see that several clicks came from one visit. That number has no name attached to it. The cookie notice explains it.
We do not record your IP address, your device, or your browser. These records exist so commission can be reconciled with the retailer and so we know which recommendations are useful. Our lawful basis is legitimate interests: running an affiliate business and knowing what works.
These are deleted automatically after 24 months. That is not a promise on paper. It is a job that runs every night.
Notes we write
If you contact us, we may keep a note against your account so we can pick up where we left off. You can ask for a copy of these like anything else.
If you send us a suggestion
The form at /suggest keeps what you type: the link, your email address, your name if you give one, your brand name if you are writing as a brand, and your note. We keep it so we can look at the piece and write back to you, which is the only thing it is used for. It does not join the newsletter, and we do not pass it on.
The form also has an unticked box offering the newsletter. Tick it and your address is added to our list and passed to Flodesk exactly as a sign-up anywhere else on the site is, recorded as having come from the suggestion form. Leave it unticked, which is how it starts, and your address is used to reply to you and for nothing else.
We also store a one-way hash of your IP address, never the address itself. It exists so the form can tell five suggestions in an hour from five thousand, and it cannot be turned back into where you were sitting.
Our lawful basis is our legitimate interest in running a shop people can write to, and in stopping that form being used to flood us. Ask us to delete a suggestion and we will.
Cookies
Three, and one of them only if you work here. One remembers that you are signed in; one is a random number set when you click through to a retailer, so several clicks can be seen as one visit. The cookie notice lists all of them and what each is for.
There is no analytics on this site. No Google Analytics, no Meta pixel, no advertising or tracking scripts of any kind. Nothing here reports your visit to anyone else, and nothing follows you to another website.
If that ever changes, this page changes first and you will be asked.
Who else sees it
Four companies, each doing one job:
- Supabase, the database and the image files. Everything above is stored there, in the UK (London, eu-west-2).
- Vercel, hosting. They serve the pages.
- Flodesk, the newsletter, as described above. A US company.
- Resend, which sends account emails such as password resets. A US company.
We do not sell your data, and we do not share it with anyone beyond the four companies above.
Retailers we link to are not given anything about you. When you click through you arrive on their site as any other visitor, and what they do then is covered by their own privacy policy, not this one.
How long we keep it
- Click-through records: 24 months, deleted automatically.
- Sign-in sessions: deleted when they expire.
- Suggestions sent through the form: kept while we are still considering the piece, and deleted whenever you ask.
- Your account and newsletter subscription: kept until you ask us to delete them. Email hello@athestia.com and we will.
Your rights
Under UK GDPR you can ask us to:
- give you a copy of everything we hold about you
- correct anything that is wrong, most of which you can edit yourself in your account
- delete your account and everything attached to it
- stop sending you things, which you can also do from any email
- hand your data to you in a portable form
- object to us relying on legitimate interests for the click-through records
Email hello@athestia.com and we will do it. We aim to respond within a month, which is what the law allows.
There is no button to delete your own account yet. Until there is, ask us and we will do it by hand. We would rather say that plainly than imply a self-service option that does not exist.
If you are unhappy
Tell us first and we will try to put it right. If we do not, you can complain to the Information Commissioner’s Office at ico.org.uk, or on 0303 123 1113.
Children
This is a furniture shop and is not aimed at children. We do not knowingly collect anything about anyone under 16.
Changes
If this notice changes, the date at the top changes with it. If a change matters, such as new tracking or a new company seeing your data, we will tell subscribers by email rather than quietly editing this page.
Also worth reading: our affiliate disclosure, which explains how we are paid.