Privacy policy
Last updated 23 October 2026.
Infinity National Ltd, trading as Instahit, is the data controller for the personal information collected on this website. Contact us at letstalk@instahit.co.uk or by post at 68–70 Cowbridge Road East, Cardiff CF11 9DU.
What we collect and why
| Information | Why we use it | Lawful basis |
|---|---|---|
| Name, delivery address, email, phone | To take, deliver and support your order; to send order and dispatch emails | Contract |
| Order history | To handle returns and complaints, keep accounts and meet tax rules | Legal obligation, legitimate interests |
| Payment details | Taken and stored by our payment provider, Stripe. We never see your full card number | Contract |
| Age confirmation | To keep to our own policy of selling only to adults; your answer is kept on your device, not by us | Legitimate interests |
| Marketing preference | To email you about new flavours and offers, only if you opt in. Unsubscribe from any email | Consent |
| Trade application details | To check and set up a trade account | Contract, legitimate interests |
| Device and usage data | To keep the site secure and working, and to see which pages are used | Legitimate interests |
Who we share it with
Only the companies that help us run the shop, each bound by contract to protect your information and to use it only on our instructions. We do not sell your information and we do not share it for anyone else's advertising.
| Who | What they do for us | Where |
|---|---|---|
| Stripe | Takes the payment. They hold your card details; we never see the full number | United States and Ireland |
| Royal Mail (Click & Drop) | Receives the delivery address to produce the label and the tracking | United Kingdom |
| Our parcel courier | Receives the name and delivery address for parcels and trade boxes that go by courier rather than Royal Mail | United Kingdom |
| Resend | Sends your order, dispatch and sign-in emails | United States |
| Cloudflare | Hosts the website, the database and our file storage, and keeps the site secure | Western Europe |
| Cloudflare (Web Analytics) | Counts visits to the site: pages viewed, rough country, the referring website, device type and page speed. No cookies, nothing stored on your device, not used to identify you | Cloudflare's global network (a United States company) |
| Meta (WhatsApp) | Only if you choose to message us on WhatsApp, in which case Meta carries the message | United States and Ireland |
Where it is kept
Everything we hold about you sits in Cloudflare's Western Europe region: the order database, the file storage that holds delivery labels and account photos, and the nightly database backups. Royal Mail is in the United Kingdom.
Two of our suppliers are United States companies — Stripe, which takes the payment, and Resend, which sends our emails — as is Meta if you choose to message us on WhatsApp. Those transfers out of the United Kingdom are covered by the UK International Data Transfer Addendum or the standard contractual clauses in that supplier's data processing terms, which is the safeguard the UK GDPR requires. You can ask us for a copy.
How long we keep it
Order and invoice records for six years, as tax law requires. Marketing consent until you withdraw it. Trade applications we do not approve, and messages you send us, for 12 months. Sign-in sessions for 30 days and sign-in links for 30 minutes, each kept for a further week after it expires so a revoked one can be recognised. Unfinished checkouts for 30 days. Copies of the emails we send you for 90 days. Nightly database backups for 60 days, plus one a month kept longer. When you ask us to delete your details we anonymise your account within a month — your name, address, phone and email are removed and the account cannot be signed into — and the change works its way out of the backups as they age; the order records the law requires us to keep stay, without the account around them.
Decisions and profiling
We do not make any decision about you by automated means alone, and we do not profile you. Cashback is worked out arithmetically from what you spend; it is not a decision about you.
Children
This shop is for adults. We do not knowingly collect information about anyone under 18, and we will delete it if we find we have.
Your rights
You can ask us for a copy of the information we hold about you (your account page has a "Download my details" link that gives you your account, orders, addresses, cashback, subscription and review records at once; copies of messages you have sent us through our forms are given on request, once we have checked they are yours), ask us to correct or delete it, ask us to restrict how we use it, object to how we use it, withdraw a consent you have given — for marketing, untick the box in your account at any time — or ask us to send your details to someone else. There is no charge. We will answer within one month. Email letstalk@instahit.co.uk. If you are unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk.
Cookies
We use a small number of cookies and similar storage for the site to work: your bag, your age confirmation and security checks. We also count visits with Cloudflare Web Analytics, which uses no cookies; you can switch that off on our cookie policy page, and a Global Privacy Control signal from your browser switches it off for you.
