Privacy Policy

Last updated: 27 August 2026

1. Who we are

This website is operated by Sarah McKelvey, known professionally as Sarah Zelvey, trading as Hugs for Your Jugs.

For data-protection purposes, Sarah McKelvey is the data controller responsible for the personal information described in this policy.

Website: Hugs for Your Jugs

Contact email: sarah@hugsforyourjugs.com; privacy@hugsforyourjugs.com

Business location: United Kingdom

This policy explains how we collect, use, store and share personal information when you visit our website, create an account, purchase a product, join a membership, subscribe to emails or contact us.

2. Personal information we collect

The information we collect depends on how you use the website.

Information you provide directly

We may collect:

• your name;
• your email address;
• your billing address;
• your telephone number, if requested during checkout;
• your account username and login details;
• your membership level and subscription status;
• your order history and purchased downloads;
• your email subscription preferences;
• information included in messages, reviews, forms or support requests;
• measurements, photographs or fitting information that you voluntarily provide when requesting support;
• any other information you choose to send to us.

Order, checkout and payment information

We use WooCommerce to operate our online shop, checkout and order-management system. When you make or attempt to make a purchase, WooCommerce may record information needed to process and administer the order, such as your name, contact details, billing address, products selected, order value, transaction status, customer notes and order history. It may also temporarily store cart and session information so that the checkout works correctly.

Payments are processed by Stripe or PayPal, depending on the payment method you select. To process a payment, refund or dispute, and to prevent fraud and comply with legal and payment-network requirements, the selected payment provider may receive information including:

• your name and contact details;
• your billing address;
• the payment amount, currency and transaction date;
• information about the product or service purchased and an order or customer identifier;
• payment-method information, such as card or bank-account details;
• your IP address, browser or device information and fraud-prevention signals; and
• information entered into Stripe- or PayPal-enabled checkout fields, including in some cases where a checkout is not completed.

Complete card details entered into payment fields provided by Stripe or PayPal are transmitted to the selected payment provider. We do not normally receive or store your complete payment-card number or card security code.

Stripe processes some information on our behalf and may also process information for its own purposes, such as fraud prevention, security, regulatory compliance and improving its payment services. Where Stripe determines those purposes and methods itself, it acts as a separate data controller. Further information is available in Stripe’s Privacy Policy and Privacy Center.

PayPal may process personal, transaction, payment and technical information to provide its payment services, authenticate transactions, prevent fraud and loss, manage risk, analyse and improve its services and comply with legal and regulatory requirements. PayPal determines some of these purposes and methods itself and acts as a separate data controller for that processing. Further information is available in PayPal’s Privacy Statement.

WooCommerce is the software we use to collect and manage checkout and order information; it is not itself the card-payment processor. Information is not sent to WooCommerce.com merely because we use the core WooCommerce software, although an enabled WooCommerce extension or connected service may send relevant information to its named provider.

Membership and account information

If you create an account or purchase a membership, we may collect and use:

• your account details;
• your membership level;
• payment and renewal status;
• dates on which your membership begins, renews, expires or is cancelled;
• content or downloads associated with your account;
• records of account and membership administration.

The website currently uses WordPress, WooCommerce and Paid Memberships Pro to provide these functions.

Course and learning information

If you enrol in or purchase an online course, we may collect and use:

• the courses in which you are enrolled;
• enrolment, access and completion dates;
• lessons and course content you have completed;
• course progress and completion status;
• quiz attempts, answers, results and feedback;
• assignments or other work you submit;
• questions, comments and discussion contributions;
• course reviews and ratings;
• certificates or records of completion;
• communications relating to your course participation.

We use this information to provide the course, maintain your progress, assess submitted work, answer course-related questions, issue certificates where applicable and administer access to purchased course content.

The website uses Paid Memberships Pro to provide and administer online courses.

Fit Session emails and records

If you purchase or participate in a Fit Session, you may provide information before, during or after the session by email. This may include:

• body and garment measurements;
• photographs submitted for fitting assessment;
• information about fit, comfort, posture, garments, patterns and alterations;
• session notes, fitting observations and recommendations;
• questions, messages and follow-up information;
• records of fitting rounds and changes made; and
• other information you choose to provide for the purpose of receiving fitting support.

We retain these communications to prepare for and provide fitting support, assess fit, make recommendations, maintain continuity across fitting rounds, keep a record of the advice provided, respond to later questions or complaints and improve our fitting knowledge and services.

Fit Session information and photographs may be retained within our business email account. We currently use Google Workspace to provide and secure our business email services.

Fit Session emails and attachments are treated as private and are not published, used in marketing, included in public teaching materials or shared publicly without separate, explicit permission.

Please only provide photographs and information that are reasonably necessary for fitting support. Do not include your face or other identifying features unless necessary, and do not send nude photographs. Please do not send medical information or other particularly sensitive information unless it is necessary for us to deal with your request.

Email subscriptions

If you subscribe to emails, we may collect:

• your name and email address;
• the lists or types of communication you selected;
• the date, time and method of subscription;
• records of consent;
• unsubscribe and preference information;
• email-opening or link-clicking information, where email analytics are enabled.

We currently use MailPoet to manage email subscriptions.

You may unsubscribe at any time using the link included in our marketing emails.

Technical and website-use information

When you use the website, we or our service providers may automatically receive technical information such as:

• your IP address;
• browser and device type;
• operating system;
• approximate location derived from your IP address;
• pages visited and actions performed;
• referral source;
• dates and times of visits;
• error, security and diagnostic information;
• cookie and consent preferences.

For more information, see our Cookie Policy.

3. How we use personal information

We may use personal information to:

• provide the website and its functions;
• create and administer customer accounts;
• process purchases and provide digital downloads;
• administer memberships and subscriptions;
• provide and administer online courses, record learning progress, assess submitted work where applicable, issue certificates where applicable and provide course-related support;
• prepare for and provide Fit Sessions, assess fit, make recommendations and maintain continuity across fitting rounds;
• retain an appropriate record of Fit Session advice and use past cases privately to improve our fitting knowledge and services;
• process payments, renewals, refunds and cancellations;
• operate checkout, shopping-cart and order-management functions;
• communicate about orders, accounts and memberships;
• respond to questions and support requests;
• send requested newsletters and marketing communications;
• remember cookie and privacy preferences;
• prevent fraud, misuse and security incidents;
• diagnose technical problems;
• maintain business, accounting and tax records;
• establish, exercise or defend legal claims;
• comply with legal and regulatory requirements;
• understand and improve our website, products and services.

4. Our lawful bases

We only process personal information where we have a lawful basis for doing so.

Contract

We use personal information where it is necessary to:

• process an order;
• provide a purchased product or download;
• create and manage an account;
• provide a paid membership;
• administer renewals, refunds or cancellations;
• respond to a request made before entering into a contract.

Legal obligation

We may use and retain information where necessary to comply with legal obligations, including accounting, taxation, consumer-protection and regulatory requirements.

Legitimate interests

We may use information where it is necessary for our legitimate business interests, provided those interests are not overridden by your rights and interests.

These interests may include:

• operating and securing the website;
• preventing fraud and misuse;
• assessing payment and transaction risk;
• maintaining appropriate Fit Session records and improving our fitting knowledge and services;
• responding to customers;
• maintaining appropriate business records;
• improving our products and services;
• protecting our legal rights.

Consent

We may rely on your consent for:

• email marketing where consent is required;
• optional cookies and similar technologies;
• any other processing for which we specifically request consent.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that took place before consent was withdrawn.

5. Marketing communications

We may send marketing emails when you have actively requested them or where another lawful permission applies.

Marketing consent is separate from service communications. You may therefore continue to receive essential messages about an order, account or membership after unsubscribing from marketing.

Every marketing email will include an unsubscribe option. You may also contact us at privacy@hugsforyourjugs.com to change your preferences.

When someone unsubscribes, we may retain limited information on a suppression list so that we can respect the opt-out and avoid sending further marketing.

6. Cookies and similar technologies

We use cookies and similar technologies to provide essential website functions and, where permitted, to understand website use or provide optional features.

Strictly necessary technologies may be used without consent where they are required to provide a service requested by the visitor.

WooCommerce uses cookies or similar storage to maintain carts, sessions and checkout functions. Stripe and PayPal may also use cookies, scripts and similar technologies to process payments, display available payment methods, authenticate transactions and detect or prevent fraud. Details of the technologies currently used, their purposes and duration should be listed in our Cookie Policy. Further information is available in Stripe’s Cookie Policy and PayPal’s cookie information.

Optional technologies are controlled through our cookie-consent system. You can accept, reject or manage these technologies using the cookie banner or the Manage cookie preferences control on the website.

Further details are available in our Cookie Policy.

7. Who we share information with

We may share personal information with trusted service providers where necessary to operate the website and provide our services.

These may include:

• website and database hosting providers;
• WordPress and website-management providers;
• WooCommerce extensions and connected ecommerce-service providers, where enabled;
• Paid Memberships Pro and membership-service providers;
• course-platform, video-hosting and learning-management service providers, where used;
• MailPoet and email-delivery providers;
• Google Workspace, which provides our business email service and may process Fit Session messages, photographs, attachments and other information sent to our business email addresses;
• Stripe, which receives relevant personal, technical, transaction and payment information to process payments, refunds and disputes, prevent fraud, secure its services and meet legal and regulatory obligations;
• PayPal, which receives relevant personal, technical, transaction and payment information to process payments, refunds and disputes, authenticate transactions, prevent fraud and loss, manage risk and meet legal and regulatory obligations;
• accounting, bookkeeping and professional advisers;
• security, fraud-prevention and technical-support providers;
• analytics providers, if analytics are introduced;
• government authorities, regulators, courts or law-enforcement bodies where required by law.

These organisations may act as processors working on our instructions or as separate controllers responsible for their own use of personal information.

We use WooCommerce software on our website to collect and manage orders. Use of the core software does not by itself mean that customer information is shared with WooCommerce.com or Automattic. If we enable a connected WooCommerce service or extension, information may be shared with the provider where necessary for that service.

We do not sell personal information.

8. International transfers

Some of our service providers may process personal information outside the United Kingdom. This includes Stripe, PayPal and Google, together with their respective affiliates and service providers.

Where personal information is transferred internationally, we take appropriate steps to ensure that the transfer is lawful. Depending on the destination and provider, these measures may include:

• UK adequacy regulations;
• approved contractual safeguards;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved standard contractual clauses;
• another legally permitted transfer mechanism.

Stripe explains its international-transfer arrangements in its Privacy Policy and Privacy Center. PayPal explains its processing and international-transfer arrangements in its Privacy Statement. Google explains its data-processing and transfer arrangements in its applicable Google Workspace privacy and contractual information. The exact arrangements for our other providers will be reviewed when our hosting and analytics services are finalised.

9. How long we retain information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security and dispute-resolution requirements.

The retention period depends on the type of information:

• Order, transaction and accounting records: retained for the period required by applicable tax, accounting and legal obligations.
• Payment information held by Stripe or PayPal: retained by the relevant payment provider in accordance with its own legal, regulatory, fraud-prevention and record-keeping requirements, as explained in that provider’s privacy information.
• Account and membership information: retained while the account or membership remains active and afterwards where needed for transaction records, disputes or legal obligations.
• Course enrolment and progress records: retained while your account or course access remains active and afterwards where reasonably needed to maintain purchase, completion and support records.
• Fit Session emails, photographs and records: retained while they remain reasonably useful for providing fitting support, maintaining continuity, keeping a record of the advice provided, responding to later questions or disputes and improving our fitting knowledge and services. We periodically review retained Fit Session records and delete or anonymise them when they are no longer reasonably necessary. You may request deletion, although information may still be retained where required for legal obligations or the establishment, exercise or defence of legal claims.
• Email-marketing information: retained until you unsubscribe or we stop the relevant mailing activity. Limited suppression information may be retained afterwards.
• Customer-service correspondence: retained for as long as reasonably needed to resolve the request and maintain appropriate records.
• Security and technical records: retained for as long as needed to maintain security, diagnose faults and investigate misuse.
• Cookie and consent records: retained in accordance with the settings and periods described in our Cookie Policy.

We may retain information for longer where a complaint, dispute, investigation or legal claim is ongoing.

10. Security

We use appropriate technical and organisational measures intended to protect personal information against accidental loss, unauthorised access, alteration, disclosure or destruction.

Access to personal information is restricted to people and service providers who need it for legitimate business purposes.

No internet-based system can be guaranteed to be completely secure. You should use a strong, unique password for your account and avoid sharing it with anyone else.

11. Your data-protection rights

Depending on the circumstances, you may have the right to:

• request access to your personal information;
• request correction of inaccurate or incomplete information;
• request deletion of your information;
• request restriction of its use;
• object to certain processing, including direct marketing;
• receive certain information in a portable format;
• withdraw consent where processing is based on consent;
• complain to the Information Commissioner’s Office.

These rights are not absolute and may be subject to legal conditions or exemptions.

To exercise a right, contact us at privacy@hugsforyourjugs.com. We may need to request information reasonably necessary to confirm your identity.

12. Automated decision-making and fraud checks

Stripe and PayPal use automated systems, including fraud and risk tools, to assess transactions. Depending on the result, a payment may be declined, blocked, subjected to additional authentication or referred for review. Further information is available in Stripe’s Privacy Center and PayPal’s Privacy Statement.

We do not otherwise use personal information to make solely automated decisions that produce legal or similarly significant effects.

13. Third-party websites and services

Our website may contain links to websites, payment services, embedded content or other services operated by third parties.

Those organisations are responsible for their own privacy practices. You should review their privacy information before providing personal information to them.

14. Complaints

Please contact us first if you have concerns about how we use your personal information:

Email: privacy@hugsforyourjugs.com

You also have the right to complain to the Information Commissioner’s Office, the United Kingdom’s data-protection regulator.

15. Changes to this policy

We may update this Privacy Policy when our services, providers or legal obligations change.

The current version will be published on this page with a revised “Last updated” date. Where appropriate, we may also notify registered users or subscribers of significant changes.