Privacy
What we
keep.
Short, because there is not much of it. No analytics, no advertising pixels, nobody buying your attention off us.
Who we are
EN¿GMA. We decide what happens to the information described here, which makes us the data controller for it. Questions, requests and complaints all go to hello@enigmamade.com.
The short version
We do not run analytics. There are no advertising or social pixels on this site, nothing profiles you across the web, and we do not sell or share anything with anyone for marketing. The only information we hold is what you actively hand us in order to get something done.
When you buy something
Checkout is handled by Stripe. You give them your card details directly — those never touch our servers and we never see them. Stripe passes us your name, email address and delivery address, because we cannot post a parcel without them.
We keep order records for as long as we have to for tax and accounting purposes, which in the UK is six years.
When you use the fitting room or the character generator
You give us a photograph and an email address. The photograph is sent to Replicate, who run the image model that makes the picture. We do not store your photograph — it goes to the model and it is not written to our disks. Replicate hold the request on their systems under their own retention policy, which is worth knowing before you upload anything you would not want a third party to have.
The finished picture is stored, for 30 days, at a long unguessable web address that we email to you. After 30 days the file is deleted automatically. The address is not listed or indexed anywhere, but anybody you forward it to can open it.
Your email address is kept with that record so we can send the picture to you, and so we can tell you if it failed.
The character gallery
Characters only appear in the public gallery if you tick the box that says so. It is a separate tick from the one that lets us generate the picture at all, because they are different things: one is permission to make it, the other is permission to show it.
If you tick it, an unwatermarked copy of your character is published on the gallery page where anyone can see it. If you did not tick it, no such copy is ever made. Changed your mind? Email us and we will take it down — deleting the file is all it takes.
When you ask to be notified
If you sign up to hear when something is back in stock or released, we store your email address alongside the garment, colour and size you asked about. We use it for that one message and nothing else. There is no newsletter to be quietly added to. Ask us and we will delete it.
Certificates of authenticity
The register at enigmamade.com records who owns each garment: a name and an email address. A certificate page is public and shows the owner's name, so that anybody buying second-hand can check it — it does not show the email address.
Transfers need confirmation by email from both the current owner and the new one, which is what stops somebody moving a certificate that is not theirs. Records are kept for as long as the certificate exists, because a chain of ownership with holes in it is not a chain of ownership.
Cookies and things stored in your browser
One cookie, called em_v. It holds a random number, no name and nothing identifying, and it exists so that a garment you have hearted can be un-hearted by the same browser. It lasts three years and does nothing else.
Your bag, your saved items, your light or dark preference and any customiser designs are kept in your browser's own storage. That never reaches us. Clear your browser data and it is gone, including from our point of view — we never had it.
Who else touches it
- Stripe — payments and checkout.
- Replicate — runs the image models behind the fitting room, the character generator and the customiser.
- Resend — delivers our email.
- Vercel and our web host — serve the site and its API.
That is the whole list. They act on our instructions, and none of them are given anything for their own marketing.
What you can ask for
You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. You can object to us holding it at all. Email hello@enigmamade.com and we will deal with it within a month.
If you think we have handled your information badly and we have not put it right, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first and gave us the chance to fix it.
Last updated 1 September 2026.