Last updated 28 September 2026. Written in plain language on purpose — if anything here is unclear, ask us.
Only what an order actually requires: your name, email address, shipping and billing address, order contents, and payment confirmation. Payment card details are handled by our payment provider and never reach our servers.
To fulfil and deliver orders, handle returns and support requests, meet tax and accounting obligations, and — only if you opted in — send you our monthly email.
We use a small number of cookies: one to remember your basket, one to remember your cookie choice, and analytics cookies that tell us which pages people actually read. Analytics cookies are only set after you accept them, and you can withdraw consent at any time.
Order records are kept for seven years to meet tax and accounting requirements. Marketing email data is kept until you unsubscribe, and deleted within 30 days of that.
Our payment processor, our shipping carriers, our email provider and our hosting provider — each only receives what they need to do their job. We do not sell personal data, and we do not share it with advertisers.
Under the GDPR (EU/UK) and CCPA (California) you can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Email hello@bonot.example and we will respond within 30 days. California residents may also request details of any disclosure of personal information.
Our site is not directed at children under 16 and we do not knowingly collect their data.
Data questions: hello@bonot.example. If you are unhappy with our response you can complain to your local data protection authority.