Privacy policy
Last updated 16 October 2026
- We only collect what we need to send you cleaning tablets and look after your account.
- We never sell your data, and we only use advertising cookies if you say yes.
- Your data is stored on servers in London. Payments are handled by Stripe, so we never see your full card number.
- You can download or delete your data any time from your account.
1. Who we are
ploomi is a UK business selling plant-based cleaning tablets and refillable bottles. We decide how and why your personal data is used, which makes us the "controller" under UK data protection law (the UK GDPR and the Data Protection Act 2018).
Questions about your data? Email hello@ploomi.co.uk or use our contact form.
2. What we collect and why
| What | Why we use it | Lawful basis |
|---|---|---|
| Your name and email address | To create your account, send login links and email you about your orders | Contract |
| Your delivery address and any delivery instructions | To deliver your bottles and refills | Contract |
| Your mobile number, if you choose to give it | So the delivery company can text you about your parcel. Never used for marketing | Contract |
| Your orders and subscription (what you bought, how often, what you paid) | To run your subscription, and to keep the sales records the law requires | Contract; legal obligation |
| Card type and last four digits | So you can recognise the card on file. Stripe holds the full details, not us | Contract |
| Whether you've claimed the £3 starter, and its delivery address | To keep the starter offer to one per customer. A person, not a computer, reviews any order we flag | Legitimate interests (preventing misuse of the offer) |
| Messages you send us | To reply and help you | Legitimate interests (customer service) |
| Problems you report with an order, and any photo you add | To send a replacement or refund | Contract |
| An unfinished checkout (what was in your basket) | To send one reminder email if you leave checkout without paying, with a link back to finish. You can turn these off from the email | Legitimate interests |
| Your email address, if you join our launch list | To send you the one email you asked for when ploomi launches. We delete it 30 days after that email, or straight away if you ask | Consent |
| Which link or website brought you to ploomi (for example an Instagram post or an advert), and your answer if you tell us how you heard about us | To learn which of our posts and adverts work, so we spend less on the ones that don't. It's recorded against your order, never shared, and we never follow you to other sites | Legitimate interests (understanding our marketing) |
| If you refer a friend or are referred: who referred whom, and the credit given | To give the £5 discount and the £5 credit, and to stop the offer being misused (we check the two accounts don't share an address) | Contract; legitimate interests (preventing misuse) |
| If you apply to be a ploomi creator: your name, email, social handle, rough follower count, what you post about and what you tell us | To decide whether to work together and to reply. We keep it for two years after we last spoke, or delete it sooner if you ask | Legitimate interests (finding creators to work with) |
| If you send a partnership or wholesale enquiry: your name, email, company and website | To reply and work with you | Legitimate interests |
| Anonymous visit counts: the page you viewed, the website or link that sent you, and whether you're on a phone or computer | To count how many people visit and which pages they look at. No cookies are used. Instead of your IP address we store a scrambled code that changes every day, so we can count you once a day but can't recognise you again or identify you | Legitimate interests (understanding how the site is used) |
| Your visit to the site, only if you accept advertising cookies | Meta and TikTok pixels record that your browser visited, which pages you looked at and whether you placed an order (and its value), so we can measure and target our ads | Consent. You can withdraw it any time with "Cookie settings" |
| Your email, if you sign up for news in the website footer, and which link or website brought you | To send news, new scents and the odd offer. Every email has a one-click unsubscribe link | Consent |
| Your choice about marketing emails | To send news and offers only if you've asked for them | Consent |
| Technical data (IP address, browser type) in our server logs | To keep the site secure and fix problems | Legitimate interests (security) |
We'll always send you emails you need about your orders: confirmations, delivery updates, payment problems and a reminder a few days before a starter turns into paid refills. Marketing emails are different: we only send those if you opt in, and every one has an unsubscribe link. You can also change this in your account.
3. Who we share it with
We never sell your data. The only time advertisers get anything is if you accept advertising cookies, when Meta and TikTok learn that your browser visited and whether an order was placed (never your name, email or address). We use a small number of trusted companies to run ploomi, and they can only use your data to provide their service to us:
| Company | What they do for us | Where |
|---|---|---|
| Stripe | Takes payments, stores your card and manages billing | UK, Ireland and USA |
| Resend | Sends our emails | Ireland (EU) and USA |
| DigitalOcean | Hosts our website and database | London, UK |
| Laravel Forge | Manages our servers | USA |
| Meta Platforms and TikTok (only if you accept advertising cookies) | Measure and show our ads. They act as separate controllers under their own privacy policies | Ireland (EU), USA and elsewhere |
| Our delivery partners (such as Royal Mail) | Deliver your parcels, using your name, address, email and (if you've given it) mobile number to send delivery updates | UK |
We may also share information if the law requires it, for example with HMRC, or to protect our customers from fraud.
Where a provider handles data outside the UK, we make sure it's protected to UK standards, using the UK's adequacy regulations (including the UK–US "data bridge") or the UK's approved data transfer agreements.
4. How long we keep it
- Your account: until you delete it, or ask us to.
- Orders and payments: six years after the end of the financial year they were in, because tax law requires it. If you delete your account, we remove your name and address from these records and keep only the anonymous totals.
- Messages to us, creator applications and partnership enquiries: up to two years after we last heard from you.
- Photos of a problem with an order: deleted as soon as we've sorted it. What you told us stays with the order record.
- Launch list: 30 days after we send the launch email.
- Newsletter: until you unsubscribe. After that we keep only your email and the date you left, so we don't email you again by mistake.
- Server logs: normally no more than 30 days.
- Anonymous visit counts: 13 months.
5. Your rights
You have the right to:
- Get a copy of your data. Use "Download your data" in your account for an instant copy, or ask us.
- Correct it. Change your name, phone number, email and delivery address in your account, your card in billing, or ask us to fix anything else.
- Delete it. Use "Delete your account" in your account, or ask us. We'll keep only what the law makes us keep.
- Object to, or ask us to limit, how we use your data.
- Withdraw consent to marketing at any time.
- Move your data to another service. The download is in a standard format for this.
Email hello@ploomi.co.uk to make a request. It's free, and we'll reply within one month. We may need to check it's really you first.
If you're unhappy with how we've handled your data, please tell us so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
6. Keeping your data safe
Our site is encrypted (HTTPS), we don't use passwords that could leak (you sign in with a one-time email link), and only the people who run ploomi can access customer records. Card details never touch our servers.
7. Cookies
We use the cookies the site needs to work, and advertising cookies only if you say yes. See our cookie policy.
8. Age
You need to be 18 or over to buy from ploomi. We don't knowingly collect data from children.
9. Changes to this policy
If we make important changes, we'll update the date at the top of this page and, if you have an account, let you know by email.