PRIVACY

What is collected

When you order: your name, email address, delivery address, and what you bought.

When you use the contact form: your name, email address, and your message. It is relayed straight to the inbox and not stored anywhere else.

Card details are never collected. Payment happens on Stripe's own checkout page. Your card number never reaches this site, and nobody here can see it — only the last four digits and whether the payment worked.

There is no account to create, so there is no password, and there is no newsletter list unless you ask to be on one.

No cookies, no tracking

This site sets no cookies — not advertising cookies, not analytics cookies, not functional ones. That is why you were never shown a consent banner.

It does keep a few things in your own browser's local storage, which never leaves your device and is never sent anywhere: your basket, a discount code if you entered one, which currency you chose to view prices in, a cached copy of the day's exchange rates, where you dragged the music player, and a note that you have already seen the opening animation. Clearing your browser data clears all of it.

Visitor numbers are counted by Vercel Analytics, which is cookieless and does not follow anyone between sites: it records the page, the country, and the kind of device, with no identifier that can be tied back to a person.

Who else sees it

An order cannot be filled without passing through a few services. They are:

• Stripe — takes the payment. Handles your card details directly; we receive only confirmation.
• Shopify — holds the order record.
• Tapstitch — prints the garment and ships it. They receive your name and delivery address, because somebody has to put it on the parcel.
• Resend — sends order and contact email.
• Vercel — hosts the site and keeps short-lived server logs.
• Google Workspace — the inbox that receives your messages.

Each is used only to do its job. None of them is given your details for their own marketing, and nothing is sold to anyone, ever. Some are based outside the EU and transfer data under the standard contractual clauses or an adequacy decision.

How long it is kept

Order records are kept while they may still be needed for accounting and tax — in practice several years, because the law requires it. Contact-form messages are kept only as long as the conversation is live, and are deleted once it is finished.

Your rights

Under the GDPR you can ask for a copy of what is held about you, ask for it to be corrected, or ask for it to be deleted — subject to records that have to be kept for tax. You can also object to how it is used, or ask for it in a portable form.

Email sam@anotherpunk.com and it will be dealt with. There is no ticketing system and no department; it is one person, and you will get a straight answer.

If you are not happy with the answer, you can complain. Another Punk is established in Portugal, so its supervisory authority is the CNPD — but you do not have to go there. You are equally entitled to complain to the data protection authority of the country you live in, which is usually the easier one to deal with and the one that speaks your language.