Privacy Policy

Last updated: 4 August 2026

Tropical Fish Co("we", "us", "our") is committed to protecting your privacy. This policy explains how we collect, use, and safeguard your personal data when you use our website and purchase from us.

What We Collect

When you place an order, we collect the contact, delivery and order details needed to fulfil it. Shopify securely processes payment details; we do not store your full card number. If you contact us, we use the information you provide only to answer and manage that enquiry. If you request a stock alert, we store the email address and product identity needed to manage that product-specific request. If you request our newsletter, we temporarily store the email address needed to send and verify the confirmation request.

How We Use Your Data

We use personal data to operate the basket and checkout, process and fulfil orders, send service messages, prevent abuse, and respond to customer enquiries. With your separate permission, we use analytics to improve the shop and marketing measurement to understand advertising. A contact form or support enquiry is not treated as a sales lead or website conversion. We never sell your data.

Stock Alerts

A back-in-stock request applies only to the specific product you choose. We send a confirmation link first and, after confirmation, use the address for an availability message about that product. We stop the request after accepted delivery, although a mail-provider retry may very rarely duplicate the same message. We do not add the address to our newsletter or use it for unrelated promotions. You can cancel from the confirmation email. The browser may record a consented diagnostic stock-alert event without including your email; it is not a lead or key business conversion.

Email Newsletter

Newsletter signup is separate from ordering, support and stock alerts. We first send a non-promotional confirmation email; you are subscribed only after you deliberately press its confirmation button. We then record the confirmed email-marketing preference and time in Shopify. The confirmation link contains an opaque one-time request identifier, not your email address, and expires after 48 hours. You can unsubscribe at any time using the link in each marketing email. Newsletter signup is not a sales lead, order or key business conversion.

Payment Security

All payments are processed securely through Shopify Payments. We never store your full credit or debit card details on our servers. All transactions are encrypted using industry-standard TLS/SSL.

Cookies

Necessary browser storage keeps your basket, security controls, accessibility settings and privacy choice working. It is always on. Cloudflare Turnstile performs a necessary, short-lived security check on protected forms to prevent automated abuse. Optional analytics includes Google Analytics 4 and Microsoft Clarity; optional marketing measurement includes Google Ads and Meta. Those services are denied by default and their tags load only after you grant the relevant category. You can accept, reject or change either category at any time without affecting checkout.

Ecommerce Measurement

With analytics permission, we measure shopping actions such as viewing an item, adding it to the basket, beginning checkout and completing a paid purchase. With marketing permission, a paid purchase may also be attributed to an advertising click. We store the applicable choice on the Shopify basket so the paid-order webhook can enforce it. A purchase is the only GA4 key event we use as a business conversion.

Service Providers

Shopify supports our catalogue, basket, checkout and orders. Cloudflare provides delivery and security. Our configured transactional email provider delivers support, confirmation and stock-alert messages. Google Analytics, Microsoft Clarity, Google Ads and Meta receive measurement data only for the optional category you allow on this storefront. The Shopify-hosted checkout may present and apply its own privacy controls. These providers process data under their own terms and applicable transfer safeguards.

Aqua, our optional voice and text assistant, is provided through ElevenLabs. The ElevenLabs service is contacted only after you choose to open Aqua. If you use it, ElevenLabs processes the text or audio you submit and the page and basket context needed to answer your request; do not provide payment details, passwords or sensitive personal data in the assistant.

Your Rights

Under UK GDPR, you have the right to access, correct, or delete your personal data. You can unsubscribe from marketing emails at any time using the link in every email. To request data access or deletion, please contact us.

Data Retention

We retain order records for up to 6 years where required for tax and legal purposes. Support data is kept only as long as needed to resolve the enquiry and meet legal obligations. Unconfirmed newsletter requests and their email addresses expire after 48 hours and are removed immediately after successful confirmation. Unconfirmed stock-alert requests expire after 48 hours; confirmed requests expire after 180 days and are removed earlier when cancelled or successfully notified. The connected GA4 property is configured for 14-month event-data retention. Other providers apply their published retention controls, and withdrawing consent stops new optional collection from this storefront.

Contact

For any privacy-related questions, email us at hello@tropicalfishco.co.uk or visit our contact page. Our registered address is 20 Wenlock Road, London, England, N1 7GU.