Privacy Policy
Privacy Policy
Last updated — 8 October 2026
Who We Are
Lost Axis is an art edition house based in the United Kingdom. We sell limited-edition giclée artworks online at www.thelostaxis.com. For any data-related enquiries, contact us at orders@thelostaxis.com.
What Data We Collect
When you place an order or browse our site, we may collect:
- Name and delivery address — provided at checkout to fulfil your order.
- Email address — provided at checkout for order confirmation and dispatch updates.
- Payment information — card details are collected and processed securely by Stripe. We do not store your full card number on our servers.
- Private site statistics — Lost Axis counts page and product views, cart and checkout actions, purchases, section interactions, campaign names, referrer domains, approximate country, device class and browser family to improve the website. A short-lived session identifier exists only in session storage. We do not collect advertising click IDs, persistent visitor IDs, names, email or postal addresses, full IP addresses, form contents, keystrokes or screens in these events. Anonymous session events are retained for 13 months so Lost Axis can inspect complete journeys, then become daily aggregate totals and are deleted. You can opt out or turn them back on without an account through Cookie Preferences.
- Pricing-test assignment — a random first-party identifier may assign your browser to one version of a pricing test. We retain the experiment, version, variant and assignment time so the displayed price remains consistent through checkout and aggregate results remain auditable. The identifier contains no name or email; private statistical reporting follows your separate Private site statistics opt-out choice.
- Browsing data — if you accept advertising cookies, Meta's browser pixel records page views and actions such as joining our list, backed by Meta's Conversions API from our own server. The server-side Meta version includes a cryptographically hashed version of your email address plus your IP address and browser type, so Meta can match the event to the right ad — this is not anonymous data, it is designed to be matched back to you. Google's advertising tag records page visits, advertising attribution and, after Stripe confirms payment, completed purchases with their value, currency and a Stripe transaction identifier. OpenAI's browser pixel records completed purchases, including order value, currency, product identifiers and an order-based event identifier. These tags do not load or run before you accept. See our Cookie Policy for the full detail.
Why We Collect Your Data
- Order fulfilment — to produce, frame and deliver your order.
- Communications — to send order confirmations, dispatch notifications and respond to enquiries.
- Site improvement — with your consent, to understand anonymous journeys through product selection and checkout, diagnose drop-off and improve usability.
- Marketing — to serve relevant advertising via Meta (Facebook/Instagram) based on your browsing behaviour, and to measure advertising from Meta, Google and ChatGPT. You can change this choice at any time via the Cookie Preferences link in our footer.
Legal Basis Under UK GDPR
- Contract — processing your name, address, email and payment data is necessary to fulfil the contract of sale when you place an order.
- Legitimate interest — we have a legitimate interest in understanding how visitors use our site and in promoting our products through targeted advertising.
- Consent — where we use cookies and matching server-side data for advertising (Meta Pixel, Meta Conversions API, Google Ads tag and OpenAI Ads Measurement Pixel), we rely on your consent. They stop the moment you decline or withdraw consent via the Cookie Preferences link in our footer.
How Long We Retain Data
Order data (name, address, email, transaction records) is retained for six years from the date of purchase to comply with UK tax and accounting obligations. Lost Axis retains anonymous private-statistics session events for 13 months, then converts them to daily aggregate totals and deletes the source events. Advertising-measurement data collected by the Meta Pixel, Meta Conversions API, Google Ads tag and OpenAI Ads Measurement Pixel is retained by those providers under their own data retention policies. You may request deletion of your personal data at any time — see Your Rights below.
Third-Party Processors
We share your data only with the third parties necessary to operate our business:
- Stripe — payment processing. Stripe handles all card data securely under PCI DSS Level 1 compliance.
- Our fulfilment partner — your name and delivery address are shared with our fulfilment partner so they can produce, frame and dispatch your order.
- Our email service provider — your email address is shared with our email service provider to send order confirmation and dispatch notification emails.
- Meta (Facebook) — advertising. If you accept advertising cookies, the Meta Pixel (browser) and Meta Conversions API (our server) both send browsing and, for server-side events, hashed identifying data to Meta for the purpose of serving and measuring targeted advertisements. If you decline, neither runs.
- Google — advertising measurement. If you accept advertising cookies, the Google Ads tag records page visits, attribution and server-confirmed completed purchases so we can measure and improve Google advertising. A purchase contains its value, currency and a Stripe transaction identifier, but not your name, email, delivery address or payment details. If you decline, the library is not requested; withdrawing consent switches its advertising storage and personalisation signals off.
- OpenAI — advertising measurement. If you accept advertising cookies, its browser pixel records completed purchases so we can measure ads shown in ChatGPT. The event includes order value, currency, product identifiers and an order-based event identifier, but does not explicitly include your name, email, delivery address or payment details. If you decline, it does not run.
- Vercel — website hosting. Our site is hosted on Vercel, which may process server logs containing IP addresses.
We do not sell your personal data to any third party.
Your Rights
Under UK GDPR, you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — ask us to correct any inaccurate data.
- Erasure — ask us to delete your personal data, subject to our legal obligations.
- Portability — request your data in a structured, commonly used format.
- Objection — object to processing based on legitimate interest, including profiling for advertising.
To exercise any of these rights, email orders@thelostaxis.com. We will respond within 30 days.
Cookies
Our site uses cookies placed by the Meta Pixel and Google Ads tag, plus matching data sent from our own server via Meta's Conversions API, for advertising purposes. These tools help us serve and measure relevant advertising on Meta and Google. You can review or change your choice anytime via the Cookie Preferences link in our footer, manage cookies through your browser settings, or see the full inventory of what we set in our cookie policy.
Contact
For any questions about this privacy policy or your personal data, contact orders@thelostaxis.com.