Privacy Policy

Last updated: 23 October 2026

This policy explains what personal information we collect when you visit playshroomo.com or buy Shroomo, why we collect it, who we share it with and what your rights are.

1. Who we are

TZ Studios Ltd, trading as Shroomo, is the controller of your personal information. We're registered in England & Wales (company no. 15771994), and our registered office is 87-91 Newman St, London W1T 3EY. For anything privacy-related, email help@playshroomo.com.

2. What we collect and why

When you place an order

Your name, email address, delivery address, phone number (if you give it) and what you ordered. Stripe collects these at checkout so we can take payment, deliver your order and handle any returns. Card details go straight to Stripe. We never see your full card number. Legal basis: performing our contract with you.

Delivering your order

We share your name, delivery address and email with Parcel2Go, who books the delivery, and Evri, who delivers it and sends you tracking updates. Legal basis: contract.

Order records

We keep a record of each order in Google Sheets. Legal basis: contract, and our legal obligation to keep financial records for HMRC.

Order emails

We send one email with your order confirmation and tracking details from help@playshroomo.com. We don't send marketing emails. If we ever start a newsletter, it will be opt-in only. Legal basis: contract.

Contact form

Your name, email, order number (if relevant) and message, so we can reply to you. Legal basis: our legitimate interest in answering your questions.

Running the website

Our host, Cloudflare, processes IP addresses and request logs to deliver the site, keep it secure and block bots. We use Cloudflare Web Analytics to count visits. It doesn't use cookies or build profiles of individual visitors. Legal basis: our legitimate interest in running a secure, working website.

We need your order details to sell to you. Without them, we can't complete your order.

3. Who we share it with

We never sell your personal information. We only share it with the services that help us run the shop:

• Stripe: payments and fraud prevention
• Parcel2Go and Evri: delivery and tracking
• Zapier: connecting our order systems
• Google: order records (Google Sheets) and email (Gmail)
• Cloudflare: website hosting, security, email routing and analytics
• Web3Forms: delivering contact form messages to our inbox

We may also share information where the law requires it, for example with HMRC or the police.

4. Cookies

We don't use advertising or tracking cookies, so there's no cookie banner. Cloudflare may set strictly necessary cookies to protect the site from attacks. When you pay, Stripe sets its own cookies on checkout.stripe.com to prevent fraud. See Stripe's privacy policy for details.

5. International transfers

Parcel2Go and Evri are based in the UK. Stripe, Zapier, Google, Cloudflare and Web3Forms may process data outside the UK, mainly in the US. When that happens, the transfer is protected by the UK–US Data Bridge (where the provider is certified), the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

6. How long we keep it

• Order and payment records: 6 years from the end of the financial year they relate to, as HMRC requires.
• Contact form messages: 24 months.
• Website logs: for Cloudflare's standard retention period.

7. Keeping it secure

We use well-established providers with strong security and limit access to your information to the people who need it. Card payments are handled by Stripe, which is certified to PCI DSS Level 1.

8. Your rights

Under UK data protection law, you have the right to:

• access a copy of your personal information
• correct anything that's wrong or incomplete
• ask us to delete it
• ask us to restrict how we use it
• object to us using it on the basis of legitimate interests
• receive it in a portable format
• withdraw your consent at any time, where we rely on consent

To use any of these rights, email help@playshroomo.com. It's free, and we'll reply within one month. We may need to confirm your identity first. Some rights have limits. For example, we have to keep order records for HMRC.

9. Children

Shroomo is for adults aged 18 and over. We don't knowingly collect information from anyone under 18. If you think we have, contact us and we'll delete it.

10. Changes to this policy

We may update this policy when our services or the law change. We'll post the new version here with a new "Last updated" date.

11. Complaints

If you're unhappy with how we've handled your information, please contact us first so we can put it right. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.