Privacy policy.Plainly put.

Who we are

XUFU is a cultural health company based in London, and the maker of XUFU Original. We decide how your information is used, which makes us the "controller" under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Questions about this policy, or your information, go to info@xufu.co.uk.

What we collect

When you join the list. Your email address, which list you joined (for example the XUFU Original waitlist), and when. We use it to send you the 10% code, tell you when XUFU Original launches, and send occasional notes from us.

When you use the contact form. Your name, email address and message, so we can reply.

When you email us. Whatever you choose to send.

When you browse. If you accept cookies, Google Analytics records how the site is used: pages visited, how you moved through the gallery (for example which pictures you opened), device and browser type, and approximate location worked out from your IP address. It uses cookies to do this, and only runs if you say yes. Vercel Web Analytics counts page visits without cookies and without identifying you, so it runs either way.

On your own device. The site remembers a few things in your browser: whether you turned the sound off, what is in your bag, and whether you have already seen or closed the list popup. These stay on your device and are not sent to us.

When you order. Checkout is not live yet. When it is, we will collect what we need to deliver your order, such as your name and address. Payments will be handled by a payment provider; we will not see or store your full card details. We will update this policy before checkout opens.

Why we use it, and on what basis

The list: your consent. You can withdraw it at any time by emailing us, and we will stop.

Replying to you: our legitimate interest in answering the people who write to us.

Google Analytics: your consent, given in the cookie banner. Vercel Web Analytics: our legitimate interest in knowing, in aggregate, how the site is used.

Orders, once live: to perform our contract with you, and to meet our legal obligations, such as keeping accounting records.

We do not sell your information, and we do not use it to make automated decisions about you.

Who helps us

We use a small number of trusted providers, who handle your information only on our instructions:

Resend sends our emails and keeps the list of email addresses. Vercel hosts the website and provides Vercel Web Analytics. Google provides Google Analytics.

Some of these providers are based in, or use servers in, the United States. Where your information leaves the UK, it is protected by the safeguards UK law requires, such as the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum.

Cookies

We only use one kind of cookie: Google Analytics, which sets cookies named _ga and _ga_*, lasting up to two years, to tell visits apart. They are only set if you choose Accept in the cookie banner. Choose Reject and they are never set; the site works the same either way.

You can change your mind at any time: open cookie settings, also at the bottom of every page. We remember your choice on your device, and the browser storage described above (sound, bag, popup) is not used for tracking.

How long we keep it

List: until you ask to leave it. Contact messages and emails: up to two years, then deleted, unless they relate to an order. Analytics: up to 14 months in Google Analytics. Order records, once live: six years, as UK tax law requires.

Your rights

You can ask us for a copy of the information we hold about you, and ask us to correct it, delete it, restrict how we use it, object to how we use it, or send it to you in a portable form. Where we rely on your consent, you can withdraw it at any time.

Email info@xufu.co.uk. We will reply within one month.

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put it right first.

Under 18s

XUFU Original is for adults, and this site is not aimed at anyone under 18. We do not knowingly collect information from children.

Changes

If we change this policy, we will update it here and change the date at the top. This version is dated 25 September 2026.