Privacy policy

Last updated: 23 July 2026

This privacy policy explains how Idoru Live collects, uses, discloses and protects personal information when you visit idoru.live, use our online store at shop.idoru.live, subscribe to our emails, apply to become a beta tester, buy or return a product, or otherwise communicate with us. Together, these websites, forms, products and services are referred to as the “Services”.

Who we are

For the purposes of the UK GDPR, EU GDPR and other applicable data protection laws, the controller is:

Registered business address:
Idoru Live
62/5 Montgomery Street
Edinburgh, EH7 5JA, UK

Operated by Adam Ferns, a UK sole trader.
Email: [email protected]

Workshop address:
Edinburgh Open Workshop
39–41 Assembly Street
Edinburgh, EH6 7BQ, UK

Personal information we collect

Depending on how you interact with the Services, we may collect or process:

  • Contact and delivery information, such as your name, email address, phone number, billing address and shipping address.
  • Order and account information, such as products viewed or ordered, cart activity, purchases, returns, exchanges, cancellations, account details, preferences and transaction history.
  • Payment information. Shopify and its payment providers process payment card and financial information needed to complete transactions. We do not receive your full payment card number.
  • Communications, including information you provide in support enquiries, emails, reviews or other messages.
  • Mailing-list and beta-programme information, including your email address, answers submitted through a form, sign-up source, time, confirmation or unsubscribe status and associated security metadata.
  • Device, usage and technical information, such as IP address, browser and device information, approximate location derived from IP, cookie identifiers, referring page, pages viewed, interactions, timestamps, diagnostic logs and advertising attribution parameters.

We collect this information directly from you, automatically from your browser or device, from Shopify and other service providers acting for us, and from advertising or business partners where permitted by law.

How and why we use personal information

  • Providing the Services and fulfilling contracts. We use information to operate the websites and store, process payments, fulfil and ship orders, manage accounts, provide support, handle returns and exchanges, and take steps you request before entering into a contract. The legal basis is performance of a contract or steps taken at your request before a contract (Article 6(1)(b) UK/EU GDPR).
  • Security, fraud prevention and site operation. We use technical and transaction information to protect accounts, payments, forms and websites; detect abuse or fraud; troubleshoot errors; and maintain performance. The legal basis is our legitimate interest in operating and securing our business and Services (Article 6(1)(f)).
  • Analytics and improvement. Subject to your consent where required, we use Google Analytics 4 and Shopify analytics to understand use of the Services and improve content, products and performance. The legal basis for optional analytics cookies or similar technologies is consent (Article 6(1)(a)); otherwise we rely on our legitimate interest in understanding and improving the Services where the law permits.
  • Marketing and advertising. If you consent, we send product updates, firmware news, offers, beta-testing information and other Idoru Live news. Subject to your cookie choices and applicable law, we use Google Ads, Meta Pixel and Shopify marketing features to measure campaigns, build audiences and show relevant advertising. The legal basis is consent where required (Article 6(1)(a)) and otherwise our legitimate interest in promoting our products (Article 6(1)(f)). You may withdraw marketing consent at any time.
  • Communicating with you. We use information to respond to enquiries and maintain our customer relationship. The legal basis is our legitimate interest in running the business and responding to you (Article 6(1)(f)), or contract where your enquiry concerns an order (Article 6(1)(b)).
  • Legal and business records. We process information to comply with tax, accounting, consumer-protection and other legal duties, respond to lawful requests, and establish, exercise or defend legal claims. The legal basis is compliance with a legal obligation (Article 6(1)(c)) or our legitimate interests (Article 6(1)(f)).

Information marked as required during checkout is necessary to process and deliver an order. If you do not provide it, we may be unable to complete the transaction or provide the requested service.

Cookies, analytics and advertising choices

Necessary cookies and similar technologies support core functions such as security, checkout, consent choices and session management. Optional analytics and advertising technologies are controlled through the cookie banner where required. On idoru.live you can reopen the banner through the “Cookie preferences” link in the footer. On shop.idoru.live you can use the store’s cookie and privacy controls.

Subject to your choices, Google Analytics 4 may process page views, approximate location, browser and device information, referrals and on-site interactions. Google Ads and Meta Pixel may process similar device, usage and attribution information for measurement and advertising. The main Idoru P-1 page may send a Meta ViewContent event. Purchase, cart and checkout events are processed in the Shopify store rather than the main site.

We do not sell personal information for money. Some advertising or personalisation activities may be treated as a “sale”, “sharing” or targeted advertising under certain laws. Where applicable, you can opt out at shop.idoru.live/pages/data-sharing-opt-out. Shopify may also recognise a Global Privacy Control signal where required.

Mailing list and beta-tester forms

If you subscribe or apply to become a beta tester, we use Shopify to manage the subscription and related emails. Our main-site forms are protected by Cloudflare Turnstile, which processes limited device, network and security information to identify automated abuse. We keep subscription information until you unsubscribe, withdraw consent or the relevant programme ends. After an unsubscribe request, we may retain limited suppression information so that we continue to honour your choice.

How we disclose personal information

We disclose personal information only where reasonably necessary for the purposes described above, including to:

  • Shopify and payment providers that host the store, process checkout and payments, manage accounts, marketing and customer privacy features, and support store operations;
  • Cloudflare for website delivery, security and form protection;
  • Google for analytics, advertising and related services, and Meta for advertising measurement and audience services, subject to your choices;
  • delivery, fulfilment, IT, hosting, email, customer-support and professional service providers acting for us;
  • business partners where needed to provide a feature you request or where you direct us to disclose information; and
  • regulators, courts, law-enforcement bodies or other parties where required by law or reasonably necessary to protect rights, safety, the Services or a legal claim.

These providers process information under their own privacy notices or under contracts requiring them to protect it.

Relationship with Shopify

Shopify hosts our online store and processes information about access to and use of the store to provide and improve Shopify services. Information submitted to the store is transmitted to Shopify and relevant third parties, which may be located outside your country.

We currently use Shopify enhanced services, including Shopify Network Intelligence, which may use information from your interactions with our store, other merchants and Shopify to improve Shopify services, personalisation and advertising. For these enhanced uses, Shopify is responsible for its own processing and for responding to rights requests relating to that processing. See the Shopify Consumer Privacy Policy and the Shopify Privacy Portal.

International transfers

Some providers may process personal information outside the UK or European Economic Area, including in the United States. Where the law requires safeguards for such a transfer, we rely on an adequacy regulation or decision, approved standard contractual clauses, the UK International Data Transfer Agreement or Addendum, or another lawful transfer mechanism.

How long we keep information

We keep personal information only for as long as reasonably necessary for the relevant purpose, including:

  • order and transaction records for as long as needed to fulfil the order and meet tax, accounting, consumer-protection and legal obligations;
  • account information while the account remains active and for a reasonable period afterwards where needed for records, disputes or security;
  • mailing-list and beta-programme information until you unsubscribe, withdraw consent or the programme ends, with limited suppression data retained to respect opt-outs;
  • enquiry and support records for as long as needed to respond and manage follow-up, and longer only where a legal or record-keeping reason applies; and
  • security logs, cookie identifiers and analytics information in line with our and our providers’ configured retention periods and only while needed for security, troubleshooting, measurement or improvement.

Your rights and choices

Depending on where you live and subject to applicable exceptions, you may have rights to request access to, correction of, deletion of, restriction of, or portability of personal information, and to object to certain processing. Where we rely on consent, you may withdraw it at any time without affecting processing that was lawful before withdrawal. You have the right to object to direct marketing at any time.

You can unsubscribe from promotional email through the link in any marketing email. You can exercise other rights by emailing [email protected]. We may need to verify your identity before completing a request. Where applicable, you may use an authorised agent and may appeal a decision about a rights request.

If you are in the UK, you may complain to the Information Commissioner’s Office. If you are in the EEA, you may complain to your local supervisory authority; a list is available from the European Data Protection Board.

Children

The Services are not directed to children, and we do not knowingly collect personal information from children under the age of majority in their jurisdiction. A parent or guardian who believes a child has provided information may contact us to request deletion. We do not knowingly sell or share, as those terms are defined by applicable law, personal information of anyone under 16.

Automated decision-making

We do not use personal information to make solely automated decisions that produce legal or similarly significant effects about you. Automated fraud and security tools may flag activity for review to protect the Services and transactions.

Security

We use reasonable technical and organisational measures to protect personal information against accidental or unlawful loss, misuse, alteration and unauthorised access. No internet transmission or storage system can be guaranteed to be completely secure, so please do not send sensitive information through unsecured channels.

Third-party websites

The Services may link to support, social media or other third-party websites. Their operators process information under their own privacy notices, and we are not responsible for their privacy or security practices.

Changes to this policy

We may update this policy to reflect changes to our practices, Services or legal obligations. We will publish the revised version at this address, update the “Last updated” date and provide any additional notice required by law.

Contact

Questions, complaints and privacy-rights requests can be sent to [email protected] or by post to:

Idoru Live
62/5 Montgomery Street
Edinburgh, EH7 5JA, UK

Operated by Adam Ferns, a UK sole trader.