Privacy policy

1. Who we are

This site is operated by Yowzer Limited (trading as Roaming Radfords), a company registered in England & Wales (company number 05020429).

Registered office: Unit 10 Mount Avenue, Bletchley, Milton Keynes, MK1 1LS, United Kingdom

Yowzer Limited is the data controller for personal data collected through this site. For any privacy-related question, email roamingradfords@gmail.com. We're in the process of setting up privacy@roamingradfords.com as a dedicated privacy contact address.

2. What data we collect

When you buy something from the shop

Orders are processed through Stripe Checkout. When you place an order we receive your name, delivery address and email address from Stripe so we can fulfil and dispatch your order. We never see or store your card details. Those stay with Stripe under their PCI compliance.

When you contact us

If you email us, we receive your email address and whatever you put in the message. We use this only to reply to you. Order notification emails sit in our shared mailbox under standard mailbox retention (typically indefinite unless deleted by us).

When you subscribe to the newsletter

Our newsletter subscriber list is managed by EmailOctopus (UK-based). When you sign up, your email address and optional first name are stored in EmailOctopus so we can send you the newsletter. Emails are delivered via Resend, a transactional email service based in the US (transfers covered by SCCs/UK IDTA), which in turn uses Amazon Web Services SES as its underlying email transport. You can unsubscribe at any time using the link at the bottom of every email.

When you visit the site

We use Cloudflare Web Analytics, which is cookieless and doesn't fingerprint visitors. We see aggregate, anonymous page-view counts: no personal data, no cross-site tracking.

When you use Ask Steve

Ask Steve is a live feature at /ask/ that answers questions using transcripts from Steve's public YouTube videos. When you submit a question:

• Your question text is sent to Anthropic (Claude API, US) to generate a response.
• Your question is also run through Cloudflare Workers AI (an embedding model) and Cloudflare Vectorize (a vector store of video transcript chunks) to find relevant source material.
• The question and answer are cached in Cloudflare KV for 24 hours, keyed by a hash of the question, this lets us serve repeated identical questions without re-querying Anthropic.
• Your IP address is recorded for rate-limiting (maximum 10 queries per hour per IP). It is not retained beyond 1 hour.
• A Cloudflare Turnstile challenge is run silently in the background to block bots. The Turnstile token is validated by Cloudflare and not stored by us.

What we store: question text (sent to Anthropic, cached 24h in Cloudflare KV); IP address (rate-limiting only, not retained beyond 1 hour); Turnstile token (validated by Cloudflare, not stored by us).
Lawful basis: legitimate interest in running and protecting the service.

3. Our legal basis for processing

• Contract: processing your order and delivering goods.
• Consent: subscribing you to the newsletter: you give consent when you sign up, and can withdraw it at any time.
• Legitimate interest: running and securing the site, replying to your emails, operating Ask Steve, and understanding aggregate site usage.
• Legal obligation: retaining order and tax records for the period required by UK law.

4. How long we keep your data

• Order data: kept for 7 years to meet UK tax and accounting requirements (HMRC).
• Newsletter subscriptions: kept until you unsubscribe. EmailOctopus removes your data on unsubscribe.
• Contact emails: kept only as long as needed to resolve your enquiry, then deleted on a rolling basis. Order notification emails sit in our shared mailbox under standard retention (typically indefinite unless deleted by us).
• Ask Steve questions: cached in Cloudflare KV for 24 hours, then automatically expired. Not retained in any other store by us.
• Ask Steve IP addresses: used for rate-limiting only; not retained beyond 1 hour.

5. Who we share your data with

We share your personal data only with the service providers we need to run the site and fulfil orders:

• Stripe (Stripe Payments UK Ltd / Stripe Inc.): payment processing. Covered by SCCs/UK IDTA for US transfers.
• Royal Mail or other couriers: to deliver your order (name + delivery address only).
• EmailOctopus (London, UK): newsletter subscriber list management. We share your email address and first name.
• Resend (San Francisco, US) and its sub-processors per their DPA: transactional and broadcast email delivery. We share recipient email address and email contents. Covered by SCCs/UK IDTA.
• Anthropic, PBC (San Francisco, US): AI text generation for Ask Steve. We share question text and recent conversation context. Covered by SCCs/UK IDTA.
• Cloudflare: we use several Cloudflare services:
  • Workers: site hosting and serverless functions.
  • Web Analytics: cookieless aggregate page-view stats (no personal data).
  • Turnstile: bot challenge for Ask Steve and newsletter signup.
  • Workers AI + Vectorize: embedding and retrieval for Ask Steve.
  • KV: question/answer cache for Ask Steve.
  • Email Routing: inbound mail forwarding to our contact mailbox.

We do not sell your personal data. We don't run advertising on the site.

6. International transfers

Stripe, Cloudflare, Anthropic and Resend are US-based providers and process data outside the UK. These transfers are covered by appropriate safeguards: Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum (UK IDTA), and the EU-US Data Privacy Framework where relevant. EmailOctopus is UK-based and no international transfer applies.

7. Your rights

Under UK GDPR you have the right to:

• Ask for a copy of the personal data we hold about you (right of access).
• Have inaccurate data corrected (right to rectification).
• Ask us to delete your data (right to erasure), where the law allows.
• Ask us to restrict how we use your data.
• Object to processing based on our legitimate interest.
• Ask for a portable copy of data you've given us (right to portability).
• Withdraw consent at any time, where consent is our legal basis.

To exercise any of these rights, email roamingradfords@gmail.com. We'll reply within one month.

8. Children's data

This site is not directed at children under 16. We don't knowingly collect personal data from children. If you think we hold data for a child without parental consent, please email us and we'll delete it.

9. Complaints

If you're not happy with how we've handled your personal data, you have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk. We'd appreciate the chance to put things right first. Email us before going to the ICO if you can.

10. Updates to this policy

We'll update this policy when our practices change. The "last updated" date at the top will reflect the most recent revision. For significant changes affecting how we use your data, we'll let newsletter subscribers know directly.

11. Cookies

See our cookies page for the (short) list.