Privacy Policy

Modulars is an independent UK workshop that designs and 3D-prints accessories for IKEA® SKÅDIS pegboards. The site is operated by an independent sole trader based in the United Kingdom, who is the data controller for everything described here.

Any question about your data — including asking for a copy or deletion — goes to orders@modulars.uk.

You open the designer in your browser, arrange parts on a virtual pegboard, and order the result. We print it, pack it and post it.

You don't need an account, and you don't need to give us anything at all to use the designer — no email, no sign-up, no name. Your design stays in your own browser until you choose to order it, share it, or email it to yourself.

Worth stating plainly, because a lot of it is unusual:

• Card or payment details. Never, at any point. Payment happens on Shopify's own checkout — card data goes to them and their payment processor, and never touches our servers.
• Your postal address or phone number. Our database has no field for either. Delivery details are collected by Shopify at checkout and held there for fulfilment.
• Passwords. None exist. Customers have no accounts, and staff sign in through Google.
• Advertising or tracking cookies. No Google Analytics, no Meta pixel, no third-party analytics or advertising tool of any kind. Nothing here follows you to other sites.
• Your IP address, in our own records. Our analytics has no field for one. (Our host necessarily handles IP addresses at the network level to deliver and protect the site — see Security.)
• Anything fed to an AI. No AI or machine-learning model processes your design, your email or your order, and nothing you do here is used to train one.
• Precise location, your contacts, or anything else from your device.

Using the designer

Nothing that identifies you. Your layout, saved walls and undo history live in your own browser (see Your browser). We record a few anonymous product events with no identifier attached (below).

Placing an order

The design you ordered, the item list, the total, the order status and a tracking code — plus an email address if you give us one. No name, address or phone reaches us; Shopify collects those at checkout.

Emailing yourself a design

Your email address, the design and its link, the piece count and total, and whether the message actually sent.

A custom part request

Your email address, what you described, and any dimensions, weight, budget or quantity you entered. Please don't put anything sensitive in the description box — it's a free-text field for describing a part, not a secure channel.

Signing in

Only needed for staff. Google tells us your email address, display name and profile picture URL, and we record when you last signed in. If you signed in as a customer out of curiosity, that same record exists — email us and we'll remove it.

Product analytics

A fixed, short list of events — design opened, item placed, offer viewed, checkout started, order placed, custom part requested, design shared — with a small amount of context, capped in length. No IP, no user agent, no cookie, no session or user id, so we genuinely cannot tell who did any of it, or connect two events to the same person.

The designer keeps your work on your own device. These are ordinary browser storage entries, not cookies, and they never leave your machine unless you order, share or email the design:

modulars-autosave-v1

Your current design plus undo/redo history, so a refresh doesn't lose your work.

modulars-walls-v1

Walls you saved, under the names you gave them (up to 24).

modulars-pending-order

The basket handed from the designer to the review page. Cleared when the tab closes.

modulars-hints-v1

Remembers that you've already seen the mobile tips.

Clearing your site data removes all of them. That storage is yours.

If you're browsing or ordering, we set no cookies at all. That's why there's no consent banner — there is nothing to consent to.

The only cookies we set belong to staff sign-in, and only once someone signs in:

__Secure-authjs.session-token

The signed-in staff session. Expires after about 30 days.

__Host-authjs.csrf-token

Cross-site request forgery protection for the sign-in form.

__Secure-authjs.callback-url

Where to return to after signing in.

__Secure-authjs.pkce.code_verifier, .state, .nonce

Short-lived values that secure the Google sign-in handshake. Minutes.

On local development builds the same cookies appear without the __Secure- and __Host- prefixes. There are no advertising cookies, no cross-site tracking and no fingerprinting anywhere on the site. Once you reach Shopify's checkout, Shopify sets its own cookies under its own policy.

The services involved in running the shop, and what each one sees:

Vercel

Hosting and content delivery — all site traffic passes through it. Privacy policy

Turso

The database — it holds everything listed under “What we do collect”. See their privacy policy at turso.tech

Shopify

Checkout and payment. We send them the items and your design; they collect your name, address, email and payment details directly. Privacy policy

Resend

Sends order and design emails — it sees the recipient address and the message. See their privacy policy at resend.com

Google

Staff sign-in only (OAuth). Not used for customers. Privacy policy

Vercel Blob

Private storage for our own 3D model files. No customer data is stored there.

One thing we get asked about: the site's typefaces are downloaded when the site is built and served from our own domain. Your browser never requests anything from Google Fonts, so loading a page here does not reveal your IP address to Google.

• To print, pack and post what you ordered.
• To email you your order confirmation and tracking code.
• To reply to a custom part request.
• To see which parts people actually use, so we design better ones — in aggregate, with no identity attached.
• To keep the site up, and to slow down abuse and scraping.
• To keep the business records we're legally required to keep.

We don't sell your data. We don't share it for advertising. We don't use it to train an AI model. If we ever wanted to use it for something not on this list, we'd ask first.

Under UK GDPR we have to say why we're allowed to process each thing:

Contract

Fulfilling your order and emailing you about it — we can't complete a sale without it.

Consent

Emailing a design to yourself, and sending us a custom part request. You typed your address and asked us to use it, and you can withdraw that at any time.

Legitimate interests

Aggregate product analytics, rate limiting and abuse prevention, and knowing which staff accounts hold admin access — keeping a small shop working and online.

Legal obligation

Keeping order and tax records for the period HMRC requires.

Orders

Six years after the order — the period UK business and tax records must be kept. This covers the design, items, total, tracking code and any email address.

Custom part requests

24 months, then deleted.

Design emails you asked for

24 months, then deleted.

Product analytics

24 months. They contain no identifier, so this is housekeeping rather than protection.

Staff sign-in records

While that person has access, then removed.

Shared design links

Kept while the link works. They hold a pegboard layout and nothing about you.

Rate-limiting IP addresses

Held in memory for a matter of minutes and never written to a database or a log by us.

Anything in your browser

Until you clear it. That one's entirely yours.

Being straight with you: at our size, deletion is done by hand, not by a scheduled job. If you ask us to delete something we will, promptly — but we'd rather tell you how it works than imply an automated pipeline we don't have.

Under UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, hand it over in a portable form, or object to us processing it. Where we rely on consent, you can withdraw it at any time.

Email orders@modulars.uk and we'll answer within one month — usually the same week.

In practice, for most people we hold an email address and a pegboard layout, so there's little to verify. We won't ask you for identity documents we have no use for. If we can't match your request to anything at all, we'll tell you that rather than go quiet.

If we get it wrong you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint. You don't have to raise it with us first, though we'd like the chance to fix it.

Your tracking code is the key to your order: anyone holding it can see that order's contents and status without signing in. That's deliberate — it's what lets order tracking work without making you create an account, and it means there's no guessable order number for anyone to probe. Treat it like a receipt and don't post it publicly. If you think yours has been exposed, email orders@modulars.uk and we'll sort it out.

We build for UK customers, but some of the services above are US companies. Where your data is processed outside the UK, that transfer relies on the UK International Data Transfer Addendum, or on the UK extension to the EU–US Data Privacy Framework where the provider is certified under it. If you want to know where a specific piece of your data physically sits, ask and we'll find out.

This isn't a site aimed at children, and we don't knowingly collect anything from under-13s. If a child has sent us an email address or a custom request, email orders@modulars.uk and we'll delete it — no explanation needed.

• Everything is served over HTTPS, with HSTS on.
• We hold no card details, so there is nothing of that kind here to lose.
• No customer passwords exist, so none can leak.
• Admin pages sit behind Google sign-in and re-check permission against the database on every single request, so removing someone's access takes effect immediately.
• Print-quality model files are never publicly reachable — the designer only ever loads a reduced-fidelity mesh.
• Our hosting provider processes IP addresses at the network level to route and protect traffic. That's true of every website; the distinction is that our own application never records them.
• If a breach ever affects your data we'll tell you and the ICO as required, without waiting to be asked.

If we change something material, the date at the top of this page changes with it and the text says what it now says. No quiet edits, and nothing applied retroactively to data we've already collected.

orders@modulars.uk — for privacy questions, data requests, or anything else. A real person reads it, and we'll come back to you within a month at the outside.