Effective date: 4th September 2026
1. About this policy
This Privacy Policy explains how Made Lore collects, uses, stores and shares personal information.
It applies when you:
- visit made-lore.co.uk;
- create an account;
- contact us;
- subscribe to marketing;
- place an order;
- upload content;
- personalise a product;
- use the product editor;
- use the Universe Creator;
- submit a review;
- make a privacy request; or
- otherwise interact with Made Lore.
2. Who is responsible for your information
The data controller is:
Christopher Baxter, a sole trader trading as Made Lore and Mad Potter’s Studio
Business address:16 The Lawns
Collingham
Nottinghamshire
NG23 7NT
United Kingdom
Email: hello@made-lore.co.uk
References to “Made Lore”, “we”, “us” or “our” mean Christopher Baxter trading as Made Lore.
3. Personal information we may collect
Depending on how you use the website, we may collect the following information.
3.1 Identity and contact information
This may include:
- your name;
- billing address;
- delivery address;
- email address;
- telephone number;
- account username; and
- communication preferences.
3.2 Order and transaction information
This may include:
- products ordered;
- product options;
- order value;
- discounts;
- delivery service;
- transaction references;
- payment status;
- refunds;
- returns;
- correspondence; and
- order history.
3.3 Payment information
Payments are processed by Stripe or another payment provider.
We do not normally receive or store your complete payment-card number or security code.
We may receive:
- payment confirmation;
- payment method type;
- a masked card number;
- billing details;
- fraud indicators;
- payment-provider identifiers; and
- refund information.
3.4 Account information
This may include:
- account preferences;
- saved addresses;
- saved projects;
- login records;
- password reset records;
- account activity; and
- profile information you choose to provide.
Passwords are stored in a protected, non-readable form rather than as plain text.
3.5 Customer Content
Customer Content may include:
- photographs;
- uploaded artwork;
- names;
- dates;
- written messages;
- design instructions;
- generation prompts;
- selected templates;
- generated artwork;
- design manifests;
- crop and placement information;
- preview images; and
- production files.
Customer Content may contain personal information about you or another person.
You must have the necessary authority to provide personal information relating to another person.
3.6 Website and device information
This may include:
- IP address;
- browser type;
- device type;
- operating system;
- approximate location derived from an IP address;
- referral source;
- pages viewed;
- session identifiers;
- website interactions;
- error logs;
- security logs; and
- cookie choices.
3.7 Communications and customer-service information
This may include:
- emails;
- contact-form submissions;
- support requests;
- complaints;
- photographs of faulty goods;
- delivery enquiries;
- privacy requests; and
- records of how an issue was resolved.
3.8 Marketing information
This may include:
- whether you subscribed;
- when and how consent was obtained;
- emails sent;
- whether a marketing message was opened or selected;
- marketing preferences; and
- unsubscribe or objection records.
3.9 Fraud and security information
This may include:
- suspected fraudulent activity;
- failed login attempts;
- blocked activity;
- device and network indicators;
- payment-risk information; and
- records relating to misuse of the editor or Universe Creator.
4. How we obtain personal information
We may obtain information:
- directly from you;
- from someone placing an order for you;
- through your use of the website;
- from payment providers;
- from delivery companies;
- from email and marketing providers;
- from fraud-prevention services;
- from technical service providers;
- from publicly available sources where lawful; and
- from cookies and similar technologies.
5. Why we use personal information
We use personal information for the following purposes.
Providing the website and accounts
We use information to operate the website, register accounts, authenticate users and provide requested features.
Lawful basis: performance of a contract or steps requested before entering a contract, and our legitimate interests in operating a secure website.
Processing and fulfilling orders
We use information to accept payment, create products, manage orders, deliver goods, issue refunds and provide order updates.
Lawful basis: performance of a contract and compliance with legal obligations.
Personalisation and production
We use Customer Content to prepare previews, create production artwork, manufacture products and investigate production problems.
This may include automated image preparation or enhancement where required for the product or service you have requested.
Lawful basis: performance of a contract or steps requested before entering a contract.
Universe Creator and AI-assisted processing
Where you request AI-assisted artwork, we may process prompts, uploaded reference material, generated results, account identifiers and technical information.
The Universe Creator uses the OpenAI API to provide AI-assisted artwork generation.
Made Lore may also use the Black Forest Labs FLUX API for configured artwork generation, editing or preparation operations. Depending on the operation requested, relevant prompts, reference images or artwork and technical processing information may be submitted to Black Forest Labs to generate or prepare the requested output.
This processing may include:
- submitting prompts and permitted reference material to OpenAI or Black Forest Labs / FLUX where the selected operation uses that provider;
- generating artwork;
- screening content;
- applying usage limits;
- preventing abuse;
- creating previews; and
- preparing selected artwork for production.
Where image preparation or enhancement is required, relevant customer images may also be processed using Claid.ai, operated by Let’s Enhance, Inc.
Lawful basis: performance of a contract or steps requested before entering a contract, our legitimate interests in operating the service safely, and legal obligations where applicable.
Content moderation
We may review prompts, uploads and generated results to prevent unlawful, infringing, abusive or unsafe content.
Review may be automated, manual or both.
Lawful basis: our legitimate interests in protecting customers, third parties and the business, and compliance with legal obligations.
Customer service and complaints
We use information to answer enquiries, deal with complaints and resolve order problems.
Lawful basis: performance of a contract, compliance with legal obligations and our legitimate interests in managing customer relationships.
Website security and fraud prevention
We use information to protect accounts, transactions, systems, intellectual property and customers.
Lawful basis: our legitimate interests and compliance with legal obligations.
Accounting, taxation and legal records
We retain appropriate transaction and accounting records.
Lawful basis: compliance with legal obligations and our legitimate interests in establishing, exercising or defending legal rights.
Website improvement and statistics
We may analyse website use, errors and performance.
Where consent is required for the relevant cookie or technology, we rely on consent.
Where a statutory cookie exception applies, the associated processing may rely on our legitimate interests in measuring and improving our service.
Marketing
We may send marketing where:
- you have consented;
- the electronic-marketing soft opt-in lawfully applies to an existing customer; or
- another lawful method applies.
Every electronic marketing message will provide a way to unsubscribe.
Lawful basis: consent or legitimate interests, together with compliance with the Privacy and Electronic Communications Regulations.
6. AI and image-processing providers
6.1 OpenAI
Made Lore uses the OpenAI API to provide AI-assisted artwork generation through the Universe Creator.
Information sent to OpenAI may include:
- generation prompts;
- permitted reference images or other input content;
- generated results; and
- technical information required to operate and protect the service.
OpenAI states that information submitted through its API is not used to train or improve its general models unless the API customer explicitly opts in to that use.
Made Lore does not authorise Customer Content submitted through the Universe Creator to be used for general model training.
Except for endpoints or features with different documented retention behaviour, or where an eligible Zero Data Retention arrangement applies, OpenAI states that API inputs and outputs may be retained for up to 30 days to provide the service and identify abuse, after which they are removed unless a longer period is required by law.
6.2 Black Forest Labs / FLUX
Made Lore may use the Black Forest Labs FLUX API for configured artwork generation, editing or preparation operations.
Information sent to Black Forest Labs may include:
- generation prompts;
- permitted reference images or artwork;
- technical generation or processing parameters; and
- generated or processed output and task information required to operate the service.
Black Forest Labs states that information provided through its services, including prompts and uploaded content, tasks and corresponding generated outputs, may be used to train and improve its AI models and services after applying safeguards such as data minimisation and de-identification. Its current public terms provide a training opt-out for most non-beta use, subject to the applicable account or contractual arrangement.
Made Lore seeks to use available training opt-out controls for Customer Content where applicable. Unless and until an effective opt-out is confirmed for the Made Lore account and the relevant FLUX service, Customer Content submitted through FLUX may be subject to Black Forest Labs’ current training and improvement terms.
Black Forest Labs’ privacy information is available at Black Forest Labs Privacy Policy, and its FLUX API terms are available at Black Forest Labs FLUX API Service Terms.
6.3 Claid.ai
Made Lore may use Claid.ai, operated by Let’s Enhance, Inc., to process customer images where automated image preparation, enhancement or related processing is required.
Information sent for this purpose may include:
- an uploaded customer image;
- image dimensions and technical information;
- processing instructions; and
- the resulting processed image.
Claid states that customer images are not used to train its models.
Where Claid’s temporary API output-storage mechanism is used, processed output may be held temporarily for up to 24 hours. The precise storage arrangement depends on the processing method and output configuration used.
6.4 Changes to technology providers
We may change or add technology providers where reasonably necessary to operate the service.
Where a change materially affects how personal information is processed, retained or transferred, we will review this Privacy Policy and update it where required before using the new arrangement for customer information.
7. Special category and highly sensitive information
Made Lore does not ask you to upload medical records, biometric identifiers, financial account credentials or other highly sensitive information.
Customer photographs or messages may unintentionally reveal information such as health, ethnicity, religion or sexual orientation.
Do not upload sensitive information unless it is genuinely necessary for the product and you are authorised to provide it.
Where you disclose disability or health information to request an accessibility adjustment, we will use it only as necessary to consider and provide the requested support and meet our legal obligations.
8. Who we share information with
We may share relevant information with:
- website hosting and infrastructure providers;
- WordPress and WooCommerce service providers;
- payment providers, including Stripe;
- banks and financial institutions;
- Royal Mail and other delivery companies;
- email-delivery providers, including MailerSend;
- email-marketing providers, including MailerLite;
- security and fraud-prevention providers;
- customer-support providers;
- OpenAI, where you use the Universe Creator;
- Black Forest Labs / FLUX, where configured artwork generation, editing or preparation uses the FLUX API;
- Claid.ai / Let’s Enhance, Inc., where image preparation or enhancement is required;
- approved production or fulfilment providers where required;
- accountants, insurers and professional advisers;
- law-enforcement or regulatory bodies where legally required; and
- a purchaser or successor if the business is sold or reorganised.
We only provide information reasonably necessary for the relevant purpose.
Some providers act as our processors. Others, such as payment providers or delivery companies, may act as independent controllers for some activities.
We do not sell personal information.
9. International transfers
Some service providers may process information outside the United Kingdom.
This may include technology providers used for AI generation, image processing, website infrastructure, payment, email or other services.
Where personal information is transferred internationally, we will use an appropriate legal safeguard where required, such as:
- UK adequacy regulations;
- the UK International Data Transfer Agreement;
- the UK Addendum to approved contractual clauses;
- another legally recognised transfer mechanism; or
- a lawful exception for a specific transfer.
We will also consider the security and legal environment relevant to the transfer.
10. How long we retain information
We retain information only for as long as reasonably necessary.
Our normal retention approach is:
- order, payment and tax records: generally six years after the relevant accounting period or longer where legally required;
- customer accounts: while active and normally up to two years after closure, except information linked to transactions that must be retained longer;
- customer-service correspondence: normally two years after the matter is resolved;
- privacy requests and complaints: normally six years after closure where needed to demonstrate compliance or manage legal claims;
- marketing records: until you unsubscribe or object, with a minimal suppression record retained to respect your choice;
- security and website logs: normally up to 12 months unless required for an investigation;
- abandoned uploads and unpurchased generated artwork: normally deleted within 30 days;
- fulfilled-order production files and uploads: normally retained for up to 12 months to support complaints and authorised reproductions;
- saved customer projects: until deleted by you, the account is closed or the service’s stated storage period expires; and
- cookie information: for the period shown in the Cookie Settings register.
Information sent to an external technology provider may also be subject to the provider-specific temporary processing or retention periods described in section 6.
Information may be retained longer where required for:
- legal proceedings;
- fraud investigation;
- tax or accounting obligations;
- product-safety matters;
- enforcement of our terms; or
- another legal requirement.
11. Security
We use proportionate technical and organisational measures intended to protect personal information.
These may include:
- access controls;
- password hashing;
- encryption in transit;
- protected production storage;
- restricted administrative access;
- software updates;
- backups;
- logging;
- security monitoring; and
- contracts with service providers.
No internet service is completely secure.
You are responsible for protecting your account credentials and using a secure device and connection.
12. Children
Orders may only be placed by people aged 18 or over.
The website and Universe Creator are not designed as services specifically for children.
We do not ask children to provide personal information directly to us and the website is not intended to collect personal information directly from children under 13.
Adults may purchase products featuring a child’s name, photograph or other information where they have the necessary parental or legal authority.
We recognise that an online service may be subject to additional children’s data-protection requirements where it is likely to be accessed by people under 18, even where the service is not specifically aimed at children. We assess this risk as part of our privacy and service review and will apply appropriate age-related safeguards where required.
13. Marketing choices
You may unsubscribe from marketing by:
- selecting the unsubscribe link in an email;
- changing available account preferences; or
- emailing hello@made-lore.co.uk.
We may retain a minimal suppression record to ensure that marketing is not restarted accidentally.
Order confirmations, delivery updates, security messages and responses to enquiries are service communications rather than marketing.
14. Your rights
Depending on the circumstances, you may have rights relating to:
- access;
- correction;
- deletion;
- restriction;
- objection;
- data portability;
- withdrawal of consent; and
- safeguards concerning significant automated decisions.
Further details are provided on our Your Privacy Rights (UK) page.
15. Data protection complaints
You may make a data protection complaint by emailing:
Please state that the message is a data protection complaint and explain:
- what happened;
- which information is affected;
- what you believe should be corrected; and
- the outcome you are seeking.
We will:
- provide a clear way to submit the complaint;
- acknowledge it within 30 days;
- investigate it without undue delay;
- keep you informed where appropriate; and
- tell you the outcome without undue delay.
You may also complain to the United Kingdom’s data protection regulator, the Information Commissioner’s Office.
16. Changes to this policy
We may update this policy when our:
- services;
- technology providers;
- processing activities;
- retention arrangements;
- international-transfer arrangements; or
- legal obligations change.
Material changes will be identified by changing the effective date and, where appropriate, by providing an additional notice.
17. Contact
Questions, rights requests and data protection complaints should be sent to:
Email: hello@made-lore.co.uk
Post:Christopher Baxter
Made Lore
16 The Lawns
Collingham
Nottinghamshire
NG23 7NT
United Kingdom