Privacy & Cookies Policy

1. Who we are

This policy explains how MFM Labs Ltd collects, uses, and protects your personal data when you visit our website or make a purchase from us.

MFM Labs Ltd is the data controller for the personal data described in this policy.

2. What data we collect

Waitlist and marketing sign-up

• Your email address, provided when you join our waitlist or subscribe to marketing.

When you place an order

• Name and email address
• Delivery address
• Order and payment details (processed securely by our payment provider — we do not store card numbers)
• Purchase history

Automatically collected data

When you visit our website, we may collect limited technical data including:

• IP address and approximate location
• Device type, browser, and operating system
• Pages visited, time on site, and how you found us
• Click and scroll behaviour (via Microsoft Clarity)

This data is collected only with your consent (via our cookie banner) and is used solely to improve the website experience.

3. Why we process your data and our lawful basis

Under UK GDPR we must have a lawful basis for every type of processing. Here is ours:

• Waitlist / marketing emails: Consent. You opted in. You can withdraw at any time via the unsubscribe link in any email or by emailing info@madeformiles.com.
• Processing your order: Contract. We need your data to fulfil and deliver your order and to comply with our legal obligations.
• Analytics and cookies: Consent. Obtained via our cookie banner. No analytics cookies are loaded until you accept.
• Fraud prevention and legal compliance: Legitimate interests and legal obligation.

4. How we use your data

• To send you waitlist updates and product launch information (if you signed up)
• To process and fulfil your orders, including sending confirmation and dispatch emails
• To handle returns, refunds, and customer service queries
• To improve our website using anonymised analytics data
• To comply with our legal and regulatory obligations

We will not sell your data, and we will not use it for any purpose not listed above without asking for your consent first.

5. Who we share your data with

We do not sell your data. We share it only with trusted service providers who process it on our behalf:

Klaviyo

We use Klaviyo to manage our email list and send marketing and transactional emails. Your email address is stored on Klaviyo's servers in the US. Klaviyo is certified under the EU-US Data Privacy Framework.

Privacy policy: klaviyo.com/legal/privacy-notice

Google Analytics (GA4)

We use GA4 to collect anonymised website usage data. This requires your consent and is only activated after you accept cookies.

Privacy policy: policies.google.com/privacy

Microsoft Clarity

We use Clarity to understand how visitors interact with our site (scroll behaviour, clicks). Anonymised and aggregated. Requires cookie consent.

Privacy policy: privacy.microsoft.com

Shopify (when our full store launches)

Our full e-commerce store will be hosted on Shopify, which will process order, customer, and payment data on our behalf. We will update this policy before the store goes live.

Privacy policy: shopify.com/legal/privacy

6. International transfers

Some of our service providers (including Klaviyo and Google) are based outside the UK. Where your data is transferred internationally, we ensure appropriate safeguards are in place, including reliance on UK adequacy decisions or the UK International Data Transfer Agreement (IDTA).

7. How long we keep your data

• Waitlist emails: until you unsubscribe, or until we delete the waitlist if the product does not launch.
• Order data: 7 years, as required for UK tax and accounting purposes.
• Marketing preferences: until you withdraw consent.
• Analytics data: as per Google Analytics and Microsoft Clarity default retention settings.

8. Cookies policy

Cookies are small text files placed on your device when you visit a website. Here is how we use them.

Strictly necessary cookies

These are required for the website to function and cannot be switched off. They do not require your consent.

Analytics cookies

We use Google Analytics (GA4) and Microsoft Clarity to understand how visitors use our site. These cookies are only placed after you accept via our cookie banner.

Marketing cookies

We do not currently use marketing or advertising cookies. If this changes, we will update this policy and request fresh consent.

Managing your cookie preferences

When you first visit our site, a cookie banner gives you the option to accept or decline non-essential cookies. You can change your choice at any time by clearing your browser cookies and revisiting the site.

Most browsers also let you manage cookies directly in their settings.

9. Your rights under UK GDPR

• Right of access: request a copy of the data we hold about you.
• Right to rectification: ask us to correct inaccurate or incomplete data.
• Right to erasure: ask us to delete your personal data.
• Right to restriction: ask us to limit how we use your data.
• Right to data portability: request your data in a portable format.
• Right to object: object to processing for direct marketing at any time.
• Right to withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior lawful processing.

To exercise any right, email info@madeformiles.com. We will respond within one month.

You can also complain to the Information Commissioner's Office (ICO):

10. Children

Our website and products are not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe we have done so inadvertently, please contact us at info@madeformiles.com and we will delete it promptly.

11. Changes to this policy

We may update this policy from time to time. The 'Last updated' date at the top will reflect any changes. For significant changes we will notify you by email if we hold your address, or by a notice on the website.

12. Contact us