Privacy

Who is responsible for your data

Scott John Mathews trading as uglydog is the data controller for the information described here. That means we decide what is collected and why, and we are accountable for it. Email scott@uglydog.online about anything on this page.

What we collect, and why

When you order something

Your email address, delivery name and address, what you ordered and the price. We need these to make and send your order, to email you a receipt and progress updates, and to keep the sales records HMRC requires. The lawful basis is performing our contract with you, and for the tax records, a legal obligation.

Your card details never reach us. Payment happens on Stripe's own checkout; we only receive a reference, the amount, and whether it succeeded.

When you ask for a quote

Your name, email and the description of the project you send us — kept so we can quote and, if you go ahead, do the work. The lawful basis is taking steps at your request before a contract.

If you create an account

An account is optional; you can buy as a guest with just an email. If you make one we store your email, an encrypted version of your password, and your order history so you can track orders online.

If you email us

We keep the message and your contact details so we can reply and keep a record of what was agreed. The lawful basis is our legitimate interest in answering you and running the business properly.

When you browse the site

We count page views to understand which pages help and where people give up. What is collected and how to refuse it is set out on our cookies page.

When we manage our Facebook Page

We use our internal app, uglydog Page Manager, through the uglydog:modelworks social poster to prepare and publish posts — text, photos, links and videos, including Reels and Stories — to our own UglyDog: ModelWorks Facebook Page, and to look after the comments people leave on them. It is a tool for uglydog, not a Facebook login service for customers or a service for managing other businesses' Pages.

The connection uses our Page's name and identifier, the permissions granted by its administrator, and a Page access key issued by Meta. The access key lets the tool act on the Page; our Facebook password is not collected or stored by the poster. The key and posting records are held on our local computer, not in this website's public files.

We keep draft and published post text, references to attached photos and videos, photo descriptions, posting times and success or failure records locally so we can review our work and avoid repeating posts. The poster also reads our own posts back from Facebook, with how many reactions, comments and shares each has, and our Page's statistics. Its purpose is running and promoting uglydog's own workshop, which is our legitimate interest in this use.

Comments on our posts. So we can read and answer comments on our Page's posts, the poster shows them — with the commenter's name where Facebook provides it — and lets us reply as the Page, hide a comment, remove one, or like it. Comments and names are read from Facebook when we look and are not stored on our computer; the poster keeps only Facebook's reference numbers for the comments we have already seen, so new ones stand out. When we ask for a suggested reply, the comment's words are handled by a writing assistant that runs on our own computer and are not sent to any other service. The poster does not collect followers' profiles or private messages.

Page statistics. Facebook prepares statistics about our Page (Meta calls them Page Insights) from how people use it: how many follow the Page, and how often our posts and Page are seen and clicked. Meta gives us these only as totals that identify no one. The poster reads them when we look, and once a day keeps that day's totals in uglydog's private business records on our website's server, which the public cannot see, so we can tell how posts do over time. We keep those totals for as long as they help us run the workshop. Meta and uglydog share responsibility for them, as Meta's Page Insights Controller Addendum sets out, and Meta explains what it collects, and how to use your rights, in its information about Page Insights data. We use the totals to see which posts work, as part of running and promoting our workshop.

Posts chosen for publication, and our replies to comments, are sent to Meta and may be visible to people on Facebook, according to the Page and app settings. Meta handles information on Facebook under its own privacy policy.

Facebook connection and data deletion

The Page administrator can disconnect the app by removing its access in Facebook's business integration settings or revoking the Page access key. Disconnecting stops future access; it does not automatically delete posts already on Facebook or the poster's local history.

To request a copy, correction or deletion of information about you held by this tool, email scott@uglydog.online with the subject uglydog Page Manager data request. Tell us which post or information you mean; do not send us your Facebook password or an access key. We will check the request, remove local copies where appropriate, and deal with posts we control on our Page. Meta handles information it retains separately under its own policy. The rights and response times below also apply.

Who else sees it

We share information with the providers needed for the purposes described here. Our shop's service providers handle order and enquiry information to provide their services; Meta's use of information on Facebook is covered by its own privacy policy, linked above.

• Stripe — takes the payment and handles card data.
• Couriers — get the delivery name and address, to deliver the parcel.
• Our hosting and email providers — store the site and send our emails.
• Google Analytics — only if you accept analytics cookies.
• Meta (Facebook) — receives the posts we publish to our Page and our replies to comments.

We do not sell your information or supply customer contact lists for anyone else's advertising. We will disclose data if the law requires it.

Where your data is held

Our website servers are in the UK and the EU. The Facebook poster's records are held on our local computer in the UK. Meta operates internationally; its privacy policy explains where it processes Facebook information and the safeguards it uses. Some suppliers, including Stripe and Google, may process data outside the UK. Where that happens it is covered by UK adequacy regulations or the standard contractual clauses approved for international transfers.

How long we keep it

• Order and payment records — six years after the tax year, as HMRC requires.
• Quote requests that go nowhere — up to two years, then deleted.
• Account details — until you close the account or ask us to delete it.
• Emails — up to three years, so we can look back at what was agreed.
• Analytics — as set out on the cookies page.
• Facebook drafts and posting history — while needed to manage our Page and avoid repeating posts, or until we delete them following a valid request. The poster does not automatically expire these records. The access key remains stored locally until we remove or replace it; an expired or revoked key no longer allows access. Posts on Facebook are kept there until separately removed.
• Which comments we have seen — only Facebook's reference numbers, no words or names, kept while needed to tell new comments from ones already read.

Your rights

Under UK data protection law you can ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything that is wrong;
• delete it, where we do not have to keep it for tax or legal reasons;
• stop or limit what we do with it, or object to it;
• hand it to you, or another provider, in a portable format.

Email us and we will respond within one month. There is no charge. We may ask you to confirm who you are first, so we do not hand your details to somebody else.

If you are not happy with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you told us first so we can fix it.

Marketing

We only send marketing email if you have asked for it, and every one has an unsubscribe link. Order confirmations and progress updates are not marketing — you get those because you bought something, and they stop when your order is complete.

Children

The shop is not aimed at children and we do not knowingly collect their data. If you think a child has given us information, tell us and we will remove it.

Changes

If we change how we handle your data we will update this page, and the date at the top will tell you when.