Skip to content
ByHand

Privacy policy

Last updated 10 October 2026

Who looks after your data

ByHand is the data controller for personal data collected through this site. Contact us about privacy at contact@byhand.studio.

What we collect, and why

When you browse

Nothing that identifies you. When you view a shop or click through to a maker's site, we add one to that shop's anonymous hourly count so the maker can see how their shop is doing. We don't store your IP address with it, set a tracking cookie, or build a profile of you.

When you have an account

  • Username, email and password. To sign you in and to email you about your shop. We store your password only as an Argon2 hash, which we can't turn back into the password. (Legal basis: contract.)
  • Display name. Optional, shown with your comments and lists. (Contract.)
  • Votes, lists, comments and reports. To provide those features. Comments and public lists are visible to everyone; votes and private lists are not. Reports are seen only by our moderators. (Contract and legitimate interests in keeping the site safe.)
  • Sign-in security. A count of recent wrong passwords, so we can pause sign-ins to an account under attack. (Legitimate interests.)

When you list a shop

Your shop details, photos, making evidence, social links and markets, which are public once the shop is approved, and the review notes we send you. (Contract.)

While you fill in the form, we save what you've typed to your account so you can finish it later or on another device. Only you can see a draft. It's deleted when you send it for review, when you discard it, or with your account. (Contract.)

When you say who runs your shop

You can choose to say your shop is run by someone in a community, for example an LGBTQIA+ maker, a Black or Indigenous maker, a maker of colour, a disabled maker, or a refugee or migrant maker. Some of these reveal things the law treats as special category data (such as sexual orientation, ethnic origin or health), so:

  • It's off unless you turn it on, from your shop dashboard, and we only save it once you tick the box to say yes. We keep the date you said yes. (Legal basis: your explicit consent, UK and EU GDPR Article 9(2)(a).)
  • Your shop then appears in that community's lists. You choose whether your shop page shows it too. Either way it's public: anyone browsing a list can see your shop is in it.
  • A list only appears once at least three shops are in it, so it can't point at just one person.
  • It never changes where your shop ranks, and we never send it, or which of these lists a shopper looks at, to PostHog or Sentry: those addresses are blanked before anything leaves the page.
  • You can remove it any time from your dashboard, which withdraws your consent and deletes it straight away. It's also deleted with your shop or your account, and a moderator may clear it if it's reported as untrue (the rest of your shop stays up).

When you pay

Payments for featured stalls and fast-track reviews are handled by Stripe. We never see or store your card details; we keep a record of what was bought, when and for how much. (Contract and legal obligation to keep financial records.)

Who we share it with

Only the services that run ByHand for us, under contracts that protect your data:

  • Fly.io (our servers and database) and Vercel (the website).
  • Cloudflare (photo storage and delivery).
  • Postmark (the emails we send you).
  • Stripe (payments).
  • Mapbox (place search and the markets map; see below).
  • Sentry (error reports, which may include technical details of a failed request).
  • PostHog, hosted in the EU (how the site is used, only if you accept analytics cookies).

Some of these process data outside the UK. Where they do, transfers are covered by UK adequacy regulations or the International Data Transfer Addendum. We'd only share data with anyone else if the law required it.

How long we keep it

  • Account data: until you delete your account (from your account page, any time). It's removed straight away, and from backups within 30 days.
  • Comments: until you or a moderator remove them, or your account is closed.
  • Communities you've said your shop belongs to: until you remove them, a moderator clears them, or the shop or your account is deleted.
  • Payment records: Stripe keeps these for six years, as UK tax law requires.
  • Anonymous shop statistics: as long as the shop is listed.

Place search and the markets map

When you search for a place (to say where your market is, or to find markets near you), our server asks Mapbox for matching places. Mapbox sees what you typed, not who you are. The markets map is only loaded when you choose to show it; your browser then fetches the map from Mapbox directly, so Mapbox sees your IP address and which part of the map you looked at. (Legitimate interests in showing where markets are.)

Your rights

You can ask for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to take it elsewhere. Email contact@byhand.studio and we'll reply within a month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ico.org.uk).

Cookies

We use one essential cookie to keep you signed in. See the cookie policy.

Children

ByHand accounts are for people aged 16 and over.