Privacy notice.

Who we are

Cylocybe is the shop name of Mylocybe, a partnership in Scotland. We decide how your information is used, so under UK data protection law we're responsible for it.

For anything about your personal information, email privacy@cylocybe.com or write to us at PO Box 8156, Cumnock, KA18 9AR, United Kingdom.

What we collect

• When you order: your name, delivery and billing address, email address, phone number if you give one, what you ordered, and any notes you add.
• When you pay: the details that come with your payment, such as the name on a bank transfer. We don't take card payments, so we never see card details. Bitcoin payments go through our own BTCPay Server, and like every Bitcoin payment they're recorded on the public Bitcoin blockchain.
• If you make an account: your sign-in details, your orders, your email preferences and your replacement claims.
• When you contact us: what you write to us through the contact form, your account messages, chat or email, and any photos or videos you send.
• When you visit: your IP address, which our server keeps in its logs for security and uses to work out your country so we can show prices in your currency. Our own ethical analytics also records how you move around our site: the pages you look at, how far you scroll and how long you stay, what you click, what's in your basket and how far you get through the checkout, the site that sent you, your device, browser and screen size, your IP address and the town and country it points to, and whether you're signed in. It uses no cookies. Scans of the prize codes on our labels are counted with a code that changes every day and can't be turned back into your address.

You must be 18 or over to buy from us, and we don't knowingly collect information about anyone younger.

Why we use it

• To sell to you and send your order, handle returns, replacements and refunds, and run your account. We need your information to do what you've asked us to, so this is part of our contract with you.
• To keep records the law asks for, such as our accounts and tax records.
• To keep the shop safe, stop fraud and misuse, and refuse orders we think are meant for something illegal. This is in our legitimate interest, and in our customers' too.
• To keep the shop safe, improve it and catch bugs, using our ethical analytics (below). This is in our legitimate interest.
• To send you news and offers, only if you've said yes. You can change your mind at any time from the email preferences in your account or the link at the bottom of every email.

Ethical analytics

We run our own ethical analytics across our site. It doesn't get shared with anyone other than us, and we use it for security, for improving the user experience and for catching bugs.

It runs on our own server, not Google's or anyone else's, and it uses no cookies. If your browser sends Global Privacy Control or Do Not Track, we don't measure your visit at all. You can also turn it off for this browser here:

Turn our analytics off for this browser

IP geolocation by DB-IP.

Who we share it with

• Royal Mail and Parcelforce, to deliver your order: your name and address, and your email or phone number so they can send you tracking. If you'd rather they didn't have your email, say so in your order note and we'll leave it off.
• Customs, for orders going abroad: what's in the parcel and what it's worth, as every country asks.
• Suppliers and service providers who help us run the shop, such as the company whose servers the website runs on (in the UK) and our email provider. They only use your information to provide their service to us. Some of our service providers are based outside the UK.
• The police or other authorities, only when the law requires us to (has never happened once in all of the years we've been going).

We never sell your information or pass it to anyone for their own marketing.

Reviews are collected on TheSporeScore (thesporescore.com), a separate review site. What you write there is handled under their own privacy notice.

How long we keep it

• Orders and payments: six years, because UK tax law asks us to keep business records that long.
• Your account and messages: for as long as you keep your account, or until you ask us to delete them. We still have to keep order records for the six years above.
• Server logs: 14 days.
• Ethical analytics: the pages, clicks and errors of each visit for 6 months, and the visit itself, with its IP address, for 13 months. Then they're deleted automatically.

Your rights

You can ask us to:

• send you a copy of the information we hold about you,
• correct anything that's wrong or incomplete,
• delete your information (apart from records the law says we must keep),
• stop or limit how we use it,
• give you the information you gave us in a form you can take elsewhere, and
• stop sending you marketing, whenever you like.

Just email privacy@cylocybe.com. It's free, and we'll reply within one month.

Cookies

Our Cookie Policy lists every cookie this site can set. There are no advertising or tracking cookies, and nothing is stored on your device until you do something that needs it, like adding to your basket or signing in.

If you're not happy

Please tell us first at privacy@cylocybe.com and we'll put it right if we can. You can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk/make-a-complaint