Privacy policy

Last updated: 29 September 2026.

Who we are

Cyrano Limited is the controller of the personal information described in this policy. We are registered in England and Wales under company number 03546315. Our registered office is 24 Finch Drive, Springwood Industrial Estate, Braintree, Essex, CM7 2SF.

Our online store is for trade customers. This policy covers people who visit the store, apply for or use a trade account, place or receive an order, make a product enquiry, or contact us on behalf of a business.

Information we collect

We may collect and use:

• Identity, contact and business information, such as your name, work email address, telephone number, business name, role and business addresses.
• Trade-account information, such as your account identifier, approval status, pricing tier and the people authorised to use the account.
• Order and transaction information, such as products, prices, delivery and billing addresses, payment status, fulfilment, returns and refunds. Stripe receives and processes your card details; Cyrano does not receive your full card number or security code.
• Enquiry and correspondence information, including the details and message you submit, our response, and any records needed to resolve a service or product issue.
• Technical and security information, such as your IP address, browser or device information, authentication records and service logs.
• Analytics information about selected visits and storefront actions. We do not send PostHog prices, basket or order details, account information, form entries or your identity.

We collect information directly from you, from another authorised person at your business, automatically when you use the store, and from service providers involved in an order or payment.

How and why we use information

We use personal information to:

• Review trade-account applications, create and secure accounts, provide the correct trade pricing, and manage authorised account users.
• Take payment, process and deliver orders, send transactional messages, manage stock, and handle cancellations, returns, refunds and disputes.
• Answer enquiries and provide product, account and customer support.
• Prevent fraud, misuse and security incidents, diagnose faults, maintain business records, and establish or defend legal claims.
• Understand and improve the storefront where analytics is enabled in accordance with your choice.

Our lawful bases

We use information where it is necessary to take steps at your request or perform a contract with you; where it is necessary for our legitimate interests or those of the business you represent; where we must comply with a legal obligation; or where you have given consent.

Our legitimate interests include operating a secure trade store, reviewing and administering business accounts, fulfilling business orders, supporting customers, preventing fraud, improving our services and protecting our legal rights. We consider the impact on the people concerned before relying on these interests.

Analytics and storage on your device

The store uses essential browser storage for functions such as authentication, baskets, security and remembering your analytics choice. These functions do not depend on analytics consent.

In production we use PostHog, hosted in the EU, to measure a small, defined set of storefront events. Until you answer the analytics banner, PostHog receives nothing. If you accept, PostHog may use an analytics identifier and session replay. If you reject, any measurement is cookieless and uses a privacy-preserving server-side hash, without a persistent identifier or person profile. We never identify signed-in customers to PostHog.

You can accept, reject or change this choice at any time using Analytics choices in the footer.

Who we share information with

We share information only where needed with:

• Providers that host and operate the store and its content, including Medusa Cloud and Sanity.
• Stripe, which processes card payments and handles payment security and authentication under its own privacy policy.
• Resend and other communications providers used to send account, order, dispatch, refund and enquiry messages.
• Cloudflare, which provides the Turnstile security check on public forms, and PostHog where analytics applies.
• Ideal Postcodes, which processes the postcode or address fragments you type into address search to find matching UK addresses. You can also enter your address manually without using address search.
• Payment, delivery, professional-advice and IT providers, and regulators, courts, law-enforcement bodies or other parties where disclosure is legally required or needed to protect legal rights.

We do not sell personal information. Service providers may use it only for the relevant service or as otherwise stated in their own notice where they act as a separate controller.

International transfers

Some providers may process information outside the United Kingdom. Where data-protection law requires it, we use an adequacy regulation, approved contractual safeguards or another lawful transfer mechanism, and require appropriate protection for the information.

How long we keep information

We keep personal information only for as long as needed for the purpose for which it was collected, including account administration, service, security, legal claims and regulatory obligations. Account information is normally kept while an account is active. Order, payment, tax and related correspondence may normally be kept for at least six years after the financial period to which it relates, and longer where the law or an unresolved claim requires it. Enquiries and technical logs are kept for shorter periods where possible.

Security

We use organisational and technical measures designed to protect personal information. No online service is completely secure, so please use a strong, unique password and tell us promptly if you believe an account has been compromised.

Your rights

Depending on the circumstances, you may have the right to ask for access to or a copy of your personal information; correction or deletion; restriction of or objection to its use; or transfer of information you provided. Where we rely on consent, you may withdraw it at any time without affecting earlier use.

These rights are not absolute. For example, we may need to keep order records to comply with tax or legal obligations. We may ask for information to confirm your identity before acting on a request.

Contact us or make a complaint

To ask a privacy question or exercise a right, email Contact us, call 0808 108 7778, or write to Cyrano Limited, 24-26 Finch Drive, Springwood Industrial Estate, Braintree, Essex, CM7 2SF.

You may also complain to the Information Commissioner’s Office at ico.org.uk. We would appreciate the opportunity to resolve your concern first.

Changes to this policy

We may update this policy when our services, providers or legal obligations change. We will publish the current version here and change the date above. We will give additional notice where a change materially affects how we use personal information and the law requires it.