Privacy policy

7Dreams is run by Elitte Ltd, registered in England and Wales under company number 17451127, registered office 167-169 Great Portland Street, 5th Floor, London W1W 5PF. Elitte Ltd is the controller of the personal data described here. Write to [email protected] for anything in this policy; there is no separate data protection officer.

This policy covers the website and everything you do on it: browsing, opening an account, buying walls and paying. It is a draft prepared with the owner's solicitor and is dated at the foot of the page.

Your account: the email address you sign in with, your legal first and last name, the country you live in, a handle shown on public surfaces (your initials unless you change it), a city if you add one, the time you accepted the terms and finished your profile, and the language the site was in when you signed up or last chose one, so emails and alerts reach you in it. A phone number and a postal address are held only if you add them in your settings.

Signing in: a magic-link token or six-digit code that expires with the email it came in; a record of each signed-in session with the IP address and browser it came from; a link to your Google or Apple account if you chose to sign in that way, holding only that provider's identifier for you and an encrypted sign-in token; and a passkey's public key if you registered one. We never hold a password.

Buying: each wall in each order, and each wall you own, with the order that bought it.

Paying: each order with its amount, reference, the IP address it was placed from, and the country on your account; each payment with the reference our payment provider gives it, the amount, its status, and a minimised copy of the provider's notification holding only the fields we need to fulfil the order. We never see or hold your card number: the card form belongs to the payment provider.

Messages: the emails we have queued or sent you by category, your notification switches, and whether you have agreed to or refused marketing emails, with the date and the place you chose. Email changes keep both the old and the new address for a year. We do not hold a record of what you write to us by email beyond the mailbox it arrives in.

Running the site: a log of every action a member of staff takes on your account, with any reason they typed; and keyed digests of email addresses and IP addresses used to rate-limit sign-ins.

To sell you walls and keep them in your library (UK GDPR Article 6(1)(b), our contract with you): your account, orders, payments and the walls you own, and the service emails that come with those steps, such as the sign-in email, the order confirmation and a refund notice.

To meet our legal obligations (Article 6(1)(c)): keeping accounting and payment records, and answering a request about your data.

For our legitimate interests (Article 6(1)(f)): keeping the site secure and detecting fraud and account farming (session records, the keyed IP digests, rate limits, the Turnstile check), fixing faults (error reports), understanding how the site is used in aggregate (the analytics described on the cookies page), and keeping a record of staff actions on accounts. You may object to any of these; see your rights below.

With your consent (Article 6(1)(a)): the email about new collections where you switched it on yourself, and analytics cookies. You can withdraw each of these at any time, and withdrawing does not affect what was done before. Customers are emailed about new collections unless they refuse; see Marketing and service messages below.

We hold nothing in the special categories of Article 9 and no criminal-offence data under Article 10. We make no decision about you by automated means that has a legal or similarly significant effect.

Your handle is your initials unless you change it, and a city appears only if you add one. You may choose to appear as an anonymous member instead, at any time, from your settings. From that moment every surface that reads your account live (feed) shows Anonymous member with no city.

We never publish your name, email address, phone number or postal address.

Our staff. The site has a single admin account, protected by a second factor, and no staff member can read any member record without being signed in to it. The member screens show your email, handle, name, city, country, standing, orders and walls. The admin does not see your IP addresses.

Our processors, listed below, see only what each needs. Nobody else sees your data unless the law requires it of us, for example HM Revenue & Customs, the police, a court, or the Information Commissioner's Office. Where we lawfully can, we tell you.

Our database and email, error and analytics processors are in the United Kingdom or the European Union, which the UK recognises as adequate. Cloudflare, Google, Apple and DNA Payments may process data in the United States or elsewhere; where they do, the transfer rests on the UK's International Data Transfer Agreement or Addendum, or on an adequacy regulation, under each provider's own terms.

Every connection to the website is encrypted. We never hold a password or a card number. Member records can be opened only through the single admin account, which needs a second factor.

Our processors are bound by contract to protect what they handle for us. If a security breach puts your data at risk, we report it to the Information Commissioner's Office within 72 hours where the law requires it, and tell you without undue delay where it is likely to put your rights at high risk.

We send one kind of marketing email: a notice that a new collection has gone on sale. If you have bought walls, we send it unless you said no. We ask once, with a ticked box at payment that you can untick, and we do not ask again or switch it back on after you have refused. If you have only signed up, we send it only if you switch it on in settings.

You can stop it at any time: switch off New collections in your account settings, or use the unsubscribe link in any of these emails.

The sign-in email, order confirmation, refund notice, email-change and details-changed notices, and the notice that a collection you bought from was withdrawn are part of running your orders and cannot be switched off.

We never share your details with anyone else for their marketing, and we do not use your data to target you on other sites.

The site is for adults.

You may ask for a copy of your data, ask us to correct it, ask us to erase it, ask us to restrict or object to a use of it, and ask for it in a portable form. Write to [email protected] from the address on your account and we answer within one month. Name and address can be corrected in your settings.

A copy of your data: our admin produces a JSON file from the database with everything above that is yours, including your sessions' IP addresses and the staff actions recorded against your account. It leaves out staff working notes that are about our process rather than you.

Erasure: your account is anonymised in place rather than deleted, because your orders and walls hang off it. Your name, email, handle, city, phone, country, address, photo, sessions, sign-in links, Google or Apple links, passkeys, notification switches and marketing consent are removed or overwritten, the IP address on your orders is removed, and nothing is ever sent to the old address again. What stays is the money record (orders, payments, refunds and the walls you own) and the record of staff actions, each for the reason given above.

We cannot erase an account while it holds a live checkout or an unpaid order, or a refund or dispute still open. We will tell you which, and erase as soon as it clears.

You may complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113 at any time, and you do not have to raise it with us first. We would rather hear it first.

The date at the foot of this page is the date this policy was last changed. A change that affects what we collect or why is announced on this page before it takes effect, and where it touches something you consented to, we ask again.