Privacy Policy

1. Who is responsible for your data

PARTYSHARTY TA FAIRPRICE LTD, trading as Bash Box, is the data controller for the personal data described here. Our registered office is 82-84 Queens Road Bishopsworth, BS13 8PQ, England. You can reach us at support@partafai.shop or +44 7230169439. We serve customers internationally and price all orders in USD.

2. What we collect

• Contact & delivery details: name, email, phone (optional), delivery address (the shipping address used to send your box), city, postal code and country.
• Order & fulfilment data: the kits and memberships you buy, quantities, order value, order history and the order fulfilment details (shipping address, carrier and delivery status) needed to pack and ship your box.
• Account & support data: messages you send us, quote requests and saved Party Plans.
• Payment data: processed by Stripe. We receive confirmation and limited billing metadata but never your full card number.
• Technical data: essential cookies and basic, aggregated analytics (see our Cookie Policy).
• Builder inputs: the occasion, guest count and preferences you enter into the AI Party Kit Builder.

3. Collection sources (where we collect it from)

Our collection sources are: directly from you when you fill in a form, place an order, save a Party Plan or contact support; automatically through essential cookies and analytics when you use the site; and from our payment provider (Stripe) and delivery carriers, who return order, billing-confirmation and delivery-status data relating to your purchase.

4. Why we use it and our legal bases

• To fulfil your order and deliver your box — order fulfilment, packing and shipping to your shipping address are the performance of a contract.
• To provide support and answer enquiries — performance of a contract and our legitimate interests.
• To capture and follow up enquiries and abandoned checkouts — our legitimate interests in operating the store, and consent where required.
• To manage memberships and billing — performance of a contract.
• To meet legal, tax and accounting duties — legal obligation.
• To keep the site secure and prevent fraud — legitimate interests.

5. Payment provider boundary

Card payments are handled by Stripe Payments Europe. Stripe collects and processes your card details on its own systems; Bash Box never sees or stores your full card number, CVC or full PAN. Stripe acts as an independent controller/processor for payment data under its own terms and privacy policy.

6. Who we share it with

• Payment: Stripe (payment processing).
• Hosting & infrastructure: Vercel (application hosting) and Supabase (database and storage for orders and enquiries).
• Delivery: the carriers we use to ship your box, who receive the name and address needed to deliver.
• Email: our transactional email provider, to send confirmations and support replies.

We do not sell your personal data.

7. International transfers

Some processors operate outside the UK/EEA. Where data is transferred internationally we rely on adequacy decisions or Standard Contractual Clauses (and the UK Addendum) to protect it.

8. How long we keep it

Order and transaction records are kept for up to 6 years to meet tax and accounting rules. Enquiry and marketing lead data is kept for up to 24 months. Party Plans and builder inputs are kept while your account is active or until you delete them. Uploaded images for custom invitations are cleared after 30 days by default.

9. Your rights (UK GDPR / EU GDPR)

• Access a copy of your data.
• Rectify inaccurate data.
• Erase data (right to be forgotten) where applicable.
• Restrict or object to processing, including direct marketing.
• Data portability.
• Withdraw consent at any time.

To exercise any right, email support@partafai.shop.

10. California residents (CCPA/CPRA)

California residents may request disclosure of the categories and specific pieces of personal information collected, request deletion, and correct inaccurate information. We do not sell or share personal information as those terms are defined by the CPRA. You will not be discriminated against for exercising these rights.

11. Do Not Sell or Share

We do not sell or share your personal information for cross-context behavioural advertising. No opt-out is needed, but you may still contact us with any preference.

12. Cookies and analytics

We use essential cookies to run the cart and checkout, and limited aggregated analytics. See our Cookie Policy.

13. Automated decisions and children

The AI Party Kit Builder gives suggestions only; it makes no decision with legal or similarly significant effect, and you always review before ordering. Our products are sold to adults. Ordering is not permitted under 13; those aged 13–17 must have a parent or guardian's consent. Kid-themed products are intended for adult purchasers.

14. Security

We use encryption in transit, access controls and reputable processors. No method is perfectly secure, but we take reasonable steps to protect your data.

15. Complaints and contact

Contact us first at support@partafai.shop. UK users may also complain to the Information Commissioner's Office (ICO); EU users to their local supervisory authority.