// PRIVACY POLICY
Your privacy is important to us.
This policy explains how we handle your personal information.
Effective date: 17 April 2026 Last updated: 17 April 2026
This policy explains how Four Hearts Studio collects, uses and protects your personal data. We've written it in plain English and kept it as short as we can without leaving anything important out. If you have a question we haven't answered, email us at [email protected].
Who we are
Four Hearts Studio is operated by Mathew Baxter, a sole trader based in the United Kingdom.
- Trading name: Four Hearts Studio
- Contact address: 5 Bacchus Gardens, Leighton Buzzard, Bedfordshire, LU7 9SA, United Kingdom
- Contact email: [email protected]
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Mathew Baxter is the data controller for the personal data described in this policy.
What this policy covers
This policy applies to personal data collected through:
- Our website at fourhearts.studio and any subdomains we operate.
- Our email list and any marketing communications we send.
- The personalisation experience (when you submit memories, stories and personal details for a custom game).
- Any purchases you make through our Stripe Checkout (when available from Christmas 2026).
It does not cover third-party websites we link to. Those have their own privacy policies, and we recommend reading them.
What personal data we collect
We collect different types of personal data depending on how you interact with us.
When you join our email list
- Your email address.
- The date and time you subscribed and the page you subscribed from.
- Information about whether you've opened or clicked emails we send you (via our email provider, Bento).
When you use the personalisation experience
Ahead of the full launch, we're releasing a customisation experience that lets you build a preview of a personalised game. When you use it we may collect:
- Your first name and last name (optional, used to personalise the experience).
- Memories, stories, inside jokes, relationships and other personal details you choose to share to shape the game.
- An email address if you save your progress or request a preview.
You decide what to tell us. Only share details you're comfortable having stored on our servers for the time described in the "How long we keep your data" section below.
When you place an order (from Christmas 2026)
- Your name and email address.
- Billing address and — if relevant — a delivery address for the recipient.
- The memories and stories you want woven into the game (as above).
- Order details: what you bought, when, and the price paid.
We never see or store your card details. Payments are handled by Stripe via Stripe Checkout. Your card information is entered on Stripe's own systems and tokenised before it reaches us. We receive only the confirmation that payment succeeded and the metadata needed to fulfil your order (last four digits of the card, cardholder name, billing country).
When you visit the website
- Technical data: IP address, browser type and version, operating system, device type, referring URL, pages viewed and time spent.
- Cookie and similar technology data, where you've given consent. See our Cookie Policy for the full list.
When you contact us
- Your name, email address and the contents of your message.
How we use your personal data and our legal basis
Under UK GDPR we need a lawful basis to process your data. Here's what we do and why we're allowed to do it.
| What we do | Why we do it | Legal basis |
|---|---|---|
| Send you the emails you signed up for (newsletters, launch updates, marketing) | To keep you informed and to grow our audience | Consent. You can withdraw it any time using the unsubscribe link in any email. |
| Save your work in the personalisation experience | So you can come back and finish it | Consent (pre-purchase) or contract (if linked to an order). |
| Process an order and deliver your game | To fulfil our contract with you | Contract. |
| Handle refunds, disputes and customer support | To resolve issues with orders and emails | Contract and legitimate interests in running a responsive business. |
| Comply with tax, accounting and consumer-protection law | Because UK law requires it | Legal obligation. |
| Measure how people use the website (analytics, session recordings) | To improve the site | Consent. No analytics cookies are set until you accept them in the banner. |
| Prevent fraud and abuse | To protect ourselves and customers | Legitimate interests. |
If we ever want to use your data for something material that isn't covered above, we'll ask you first.
Marketing and your choices
We only send you marketing emails if you've actively opted in — usually by submitting your email on our website. Every marketing email has an unsubscribe link that works in one click. You can also email us at [email protected] and ask to be removed.
Withdrawing consent for marketing does not affect the lawfulness of emails we sent before you withdrew it.
Who we share your personal data with
We don't sell your data. We do share it with a small number of trusted service providers (known as "processors" under UK GDPR) who help us run the business. Each has been chosen for its security practices and contractually bound to protect your data.
| Provider | Purpose | Where they're based |
|---|---|---|
| Bento | Email list, newsletters, marketing automation and transactional email | United States |
| Stripe (from Christmas 2026) | Payment processing via Stripe Checkout | Ireland (EU) and United States |
| Laravel Forge / Laravel Cloud | Web hosting, server provisioning and management | United States (managing underlying infrastructure — we'll update this policy if we migrate the underlying host) |
| Google Analytics 4 (with consent) | Website analytics | United States |
| Google Tag Manager (with consent) | Manages how analytics and marketing tags are loaded | United States |
| Microsoft Clarity (with consent) | Heatmaps and session recordings so we can see where the site is confusing | United States |
| Laravel Nightwatch (once deployed) | Application performance monitoring and error tracking | United States |
Stripe acts as an independent data controller for payment data under its own privacy policy. All other providers listed above act as our processors.
We may also share your data when we're legally required to — for example, in response to a court order or a request from a regulator such as HMRC or the Information Commissioner's Office.
If the business is ever sold or transferred, your personal data may be passed to the new owner under the same terms set out in this policy, and we'll notify you before that happens.
International transfers
Most of our providers are based in the United States. When your personal data is transferred outside the UK, we rely on one or more of the following safeguards:
- The UK Extension to the EU-US Data Privacy Framework where the recipient is certified (Google, Microsoft and Stripe are certified at the time of writing).
- Standard Contractual Clauses with the UK International Data Transfer Addendum where the Data Privacy Framework does not apply.
You can request a copy of the relevant safeguards by emailing [email protected].
How long we keep your data
We only keep your data for as long as we need it.
- Email subscribers: until you unsubscribe or we close the list.
- Personalisation experience saves: up to 12 months after your last activity, then deleted (earlier on request).
- Order and tax records: 6 years after the end of the tax year in which the order was placed. This is a UK HMRC requirement.
- Customer support emails: up to 3 years, so we can reference past conversations if you get in touch again.
- Website analytics data: retained at Google Analytics' and Microsoft Clarity's default retention settings (currently 2 months and 90 days respectively for user-level data).
After the retention period we either delete the data or anonymise it so it can no longer be linked to you.
Your rights
Under UK GDPR you have the following rights over the personal data we hold about you:
- Access — request a copy of the data we hold about you.
- Rectification — ask us to correct anything that's wrong.
- Erasure ("right to be forgotten") — ask us to delete your data, subject to legal retention requirements.
- Restriction — ask us to pause processing while a query is resolved.
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interests.
- Withdraw consent — where we rely on consent, withdraw it at any time.
- Complaint — complain to the UK Information Commissioner's Office (ICO) if you think we've got something wrong.
To exercise any of these rights, email [email protected]. We'll respond within one month. There's no fee for reasonable requests.
If you're not happy with our response you can complain to the ICO at ico.org.uk/concerns or on 0303 123 1113. We'd really rather you came to us first so we can try to fix it.
Children
Four Hearts Studio is not aimed at children. You must be 18 or over to place an order with us. If you're under 18 and have signed up to our email list, please ask a parent or guardian to contact us and we'll remove your details.
A game can of course be gifted to a recipient of any age — a child, a grandparent, a friend. In that case we only collect data from the adult purchaser. If the purchaser shares stories or memories involving a child recipient, we treat that information with the same care as any other personal data described in this policy and will delete it on request.
Security
We take security seriously but no system is perfect. In practice this means:
- All traffic to our website is encrypted using TLS (HTTPS).
- Passwords and sensitive tokens are hashed using industry-standard algorithms.
- We never store card details — payments are handled exclusively by Stripe.
- Access to systems holding personal data is limited to Mathew Baxter and restricted by multi-factor authentication.
- We keep software dependencies up to date and monitor for known vulnerabilities.
If we ever become aware of a personal data breach that affects you, we'll notify you and the ICO in line with UK GDPR.
Cookies and tracking
A full list of the cookies we use, what they do and how to control them is in our Cookie Policy. You can change your cookie preferences at any time by opening the cookie preferences panel from the footer of any page.
Changes to this policy
When we update this policy we'll change the "Last updated" date at the top. If the changes are material — for example, a new processor or a new purpose for processing — we'll notify you by email if we have your address, or by a prominent notice on the website for at least 30 days.
Contact
Questions, complaints, rights requests and compliments all go to the same place:
- Email: [email protected]
- Post: Mathew Baxter, 5 Bacchus Gardens, Leighton Buzzard, Bedfordshire, LU7 9SA, United Kingdom