Privacy Policy

Last updated: 6 October 2026

Messyface Limited operates this store and website, including all related information, content, features, tools, products and services, in order to provide you, the customer, with a curated shopping experience (the "Services"). The Services also include The Messy Kitchen, our ambassador programme, and its online portal and team app at app.messy-face.com.

Messyface Limited is powered by Shopify, which enables us to provide the store to you.

This Privacy Policy describes how we collect, use and disclose your personal information when you visit or use the Services, make a purchase or other transaction, apply to or take part in The Messy Kitchen, or otherwise communicate with us.

If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls in relation to the collection, processing and disclosure of your personal information.

Please read this Privacy Policy carefully. By using the Services, you acknowledge that you have read this Privacy Policy and understand how your information is collected, used and disclosed as described below.

Personal Information We Collect or Process

When we use the term "personal information", we mean information that identifies you or can reasonably be linked to you or another person. Personal information does not include information that has been collected anonymously or de-identified so that it cannot reasonably be linked to an individual.

Depending on how you interact with the Services, where you live and what features you use, we may collect or process the following categories of personal information:

Contact details, including your name, address, billing address, shipping address, phone number and email address.

Payment and financial information, including your payment method, transaction details, payment confirmation and other information required to process payments. Card payments are handled by Shopify and its payment providers; we do not see or store your full card details.

Account information, including account identifiers, preferences, settings and information associated with your account.

Transaction information, including products you view, add to your cart or wishlist, purchase, return, exchange or cancel, and your previous transactions.

Communications with us, including information you provide when contacting customer support or otherwise communicating with us.

Device information, including information about your device, browser or network connection, your IP address and other technical identifiers where these are processed by our website, hosting providers or service providers.

Usage information, including information about how and when you interact with or navigate the Services.

Social media information, including your public social media handles, public profile information, follower counts and public posts in which you tag, mention or collaborate with Messyface, together with public engagement information such as likes, comments and views.

Ambassador programme information, as described in the section "The Messy Kitchen Ambassador Programme" below.

Personal Information Sources

We may collect personal information:

• Directly from you, including when you create an account, place an order, apply to The Messy Kitchen, use the Services, communicate with us or otherwise provide information to us.

• Automatically through the Services, including through your device, cookies, similar technologies and browser storage used to provide features such as keeping you signed in.

• From service providers that provide technology or other services on our behalf.

• From social media platforms such as Instagram and TikTok when you tag, mention or collaborate with Messyface, or from information you have made publicly available.

• From sign-in providers such as Google or Facebook when you choose to use them to sign in to the ambassador portal.

• From partners, publicly available sources or other third parties where permitted by law.

The Messy Kitchen Ambassador Programme

If you apply to or take part in The Messy Kitchen, we may also process the following information.

Your application: your name, email address, mobile number, social media handles, follower counts and answers you provide on the application form.

Sign-in: if you sign in to the ambassador portal using Google or Facebook, we receive your name, email address and an account identifier from that provider, and we record when you sign in. We never receive your Google or Facebook password.

Your discount codes and shop link: your creator discount code, shop link and Friends & Family codes, together with orders attributed to them. For these orders, our ambassador system keeps the order amounts, dates and items needed to calculate sales and commission. We do not copy the names or contact details of customers who use your codes into the ambassador app.

Commission and payments: information about commission you have earned and payments we have made to you.

Free jars and gifts: where we send you products through Shopify, your delivery address is held as part of the Shopify order. We do not separately store that delivery address in our ambassador app.

Your posts: public Instagram and TikTok posts in which you tag, mention or collaborate with Messyface, together with public engagement figures, so that we can understand and show your results and recognise your work.

Messages and updates: ideas, questions, feedback and changes such as updated social media handles that you send to us through the portal.

Portal activity: information about which pages of the portal you open, approximately how long you spend on them and certain actions you take, such as copying your creator code or opening a post. We use this to improve the portal, understand how it is being used and provide support. This activity record does not record what you type into forms and is not intended to record your device, browser or precise location.

Creators We May Contact

We may identify creators who we think could be a good fit for The Messy Kitchen using information they have made publicly available, for example creators who post publicly about food or Messyface.

For these creators, we may keep limited information such as a public social media handle, public profile information, follower count, relevant public posts, whether we have previously contacted them or sent them a gift, and brief notes about our contact with them.

Where permitted by law, we may contact creators about The Messy Kitchen. If we contact you using information obtained from a public source, we will provide or link to this Privacy Policy so that you can understand how we use your information.

If we send you a gift, your delivery address is kept as part of the Shopify order and is not separately stored in our prospect database.

We periodically review our creator prospect information and remove information that is no longer relevant.

If you do not want us to contact you, email hello@messy-face.com. We will remove you from our active prospect list and stop contacting you. We may keep a minimal record of your request, such as your social media handle or email address, solely so that we can make sure we do not contact you again.

Emails We Send and Email Tracking

We send administrative and programme-related emails to customers, ambassadors and applicants where necessary, for example about orders, applications, accounts, codes, commission, payments and programme administration.

We may also send marketing or programme news where you have agreed to receive it or where we are otherwise permitted by law to do so.

Marketing emails include an unsubscribe option and, where available, a link to your email preferences so that you can choose which types of emails you receive.

If you choose to allow email engagement tracking, some emails may contain a small invisible image and tracked links that allow us to record whether an email was opened, whether a link was clicked and when this happened.

We use this information to understand whether our communications are useful and to improve them.

We do not add your IP address, device information or location to your individual email engagement record. Technical service providers may nevertheless process information such as IP addresses in short-term technical or security logs when requests are made to their systems.

Email opens are not always accurate because some email applications automatically load images or protect users by loading images on their behalf.

Where individual email tracking requires your consent, we will only use it after you have agreed to it. You can withdraw that consent or switch email tracking off through your email preferences.

Emails containing sign-in or authentication links are not tracked for marketing engagement purposes.

How We Use Your Personal Information

Depending on how you interact with us and which Services you use, we may use personal information for the following purposes.

Provide, Tailor and Improve the Services

We use personal information to provide the Services, including processing payments, fulfilling orders, remembering preferences, processing purchases, returns and exchanges, arranging shipping, maintaining accounts, providing customer support, improving the Services and creating a more relevant shopping experience.

Run The Messy Kitchen

We use ambassador programme information to review applications, create and manage creator accounts, codes and shop links, send free products, understand creator activity, track attributed sales and public posts, calculate and pay commission, operate the ambassador portal and improve the programme.

Marketing and Advertising

Where permitted by law, we use personal information for marketing and promotional purposes, including sending marketing communications and showing advertising for our products or services.

This may include advertising based on interactions with our store or other websites where permitted and subject to applicable consent and privacy requirements.

Security and Fraud Prevention

We use personal information where necessary to authenticate accounts, provide secure Services, detect or investigate fraudulent, illegal, unsafe or malicious activity and protect Messyface, our users and our systems.

Like most websites and online services, our hosting providers keep short-term technical request logs for security, reliability and troubleshooting. These logs may include information such as IP addresses.

If you create or use an account, you are responsible for keeping your account credentials and access methods secure.

Communicating With You

We use personal information to respond to enquiries, provide support, administer our relationship with you and send information connected with your account, orders or participation in The Messy Kitchen.

Legal Reasons

We may use personal information where necessary to comply with applicable laws, respond to valid legal requests, resolve disputes, investigate legal claims, enforce our terms and policies and protect our legal rights or those of others.

Legal Bases for Processing in the UK and EEA

If you are in the United Kingdom or European Economic Area, we rely on one or more of the following legal bases when processing your personal information.

Contract and steps before entering into a contract: for example, to process and fulfil purchases, consider an application you have submitted to The Messy Kitchen and operate the programme for participating ambassadors, including codes, products, commission and portal access.

Legitimate interests: for example, to operate and improve our business, store and ambassador portal, understand how the Services are used, provide support, protect our systems, prevent fraud, maintain appropriate business records and identify potential creators using relevant public information. Where we rely on legitimate interests, we consider those interests against your rights and privacy.

Consent: where we ask you to agree to particular processing, including certain marketing communications and individual-level email open and click tracking where consent is required. You can withdraw your consent at any time.

Legal obligations: where processing is necessary to comply with laws that apply to us, including accounting, financial and tax requirements.

Nothing in this section overrides any additional consent requirements that apply under the Privacy and Electronic Communications Regulations or other applicable law.

How We Disclose Personal Information

In certain circumstances, we may disclose personal information to third parties for legitimate business purposes and subject to applicable law.

These may include:

• Shopify and vendors or service providers that perform services on our behalf, such as payment processing, IT management, analytics, customer support, cloud hosting, fulfilment and shipping.

• For The Messy Kitchen, service providers including Google, such as Google Cloud and Firebase for hosting and application services and Google Workspace for email; Meta, including Instagram and Facebook sign-in where used; and TikTok.

• Business and marketing partners that help us provide marketing services and advertising, subject to applicable privacy and consent requirements.

• Third parties where you ask us or consent to us sharing information, for example to fulfil an order or provide an integration you choose to use.

• Our affiliates or members of our corporate group, if applicable.

• Professional advisers, regulators, authorities or other parties where disclosure is reasonably necessary to comply with law, protect legal rights, investigate wrongdoing or deal with a business transaction such as a merger, acquisition or restructuring.

We do not sell your personal information.

Relationship With Shopify

Our online store is hosted by Shopify, which collects and processes personal information about your access to and use of the store in order to provide and improve Shopify's services.

Information you submit through our store may be transmitted to Shopify and other service providers, including providers located in countries other than where you live, where this is necessary to provide the Services.

We may also use Shopify features that use information from interactions with our store and, in some cases, interactions with other merchants or Shopify services.

Where Shopify acts independently as a controller of personal information for its own purposes, Shopify is responsible for that processing and for handling applicable privacy rights relating to it.

You can find more information about Shopify's handling of personal information in Shopify's Consumer Privacy Policy and Privacy Portal.

Third-Party Websites and Links

The Services may contain links to websites, social media platforms or other online services operated by third parties.

If you follow a link to a third-party service, you should review that service's privacy and security information. We are not responsible for the privacy or security practices of services that we do not control.

Information you make publicly available on social networks or other public or semi-public platforms may also be visible to other users and third parties.

Our inclusion of a link does not necessarily mean that we endorse the relevant third party or its services.

Children's Data

The Services are not intended for children where use would be prohibited under applicable law, and we do not knowingly collect personal information from children in circumstances where we are not permitted to do so.

If you are the parent or guardian of a child who has provided personal information to us and you believe that information should not have been collected, please contact us using the details below.

We do not knowingly sell or share, as those terms may be defined under applicable privacy laws, the personal information of children under 16.

Security and Retention of Your Information

We use appropriate technical and organisational measures designed to protect personal information.

However, no method of transmission or storage is completely secure and we cannot guarantee absolute security.

Access to ambassador information is restricted to members of our team who need it for their role, and access to our internal ambassador administration systems is protected by additional security controls, including two-step verification.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including providing the Services, maintaining accounts, administering The Messy Kitchen, meeting legal and accounting requirements, resolving disputes and enforcing our agreements.

Ambassador programme information is generally retained while you participate in The Messy Kitchen and for a reasonable period afterwards.

Financial, commission and payment records are retained for as long as required by applicable tax, accounting and legal requirements.

Information relating to prospective creators is reviewed periodically and removed when it is no longer relevant, except for minimal suppression information that may be retained to honour a request not to be contacted again.

Our system backups may be retained for up to 12 months before being deleted or overwritten.

Short-term technical and security logs maintained by hosting providers are kept according to the provider's operational and security retention practices.

Your Rights and Choices

Depending on where you live, you may have some or all of the following rights in relation to your personal information. These rights are not absolute and may be subject to exceptions under applicable law.

Right of access: you may have the right to request a copy of the personal information we hold about you.

Right to deletion: you may have the right to request deletion of personal information we hold about you.

Right to correction: you may have the right to ask us to correct inaccurate personal information.

Right to portability: in some circumstances, you may have the right to receive certain personal information in a portable format or ask us to transfer it to another organisation.

Managing communication preferences: you can unsubscribe from marketing emails using the unsubscribe option in the email. Where available, you can also change which communications you receive and manage email tracking through your email preferences.

If you unsubscribe from marketing communications, we may still send non-marketing communications that are necessary in connection with your account, purchases, applications or participation in The Messy Kitchen.

If you are in the UK or EEA, you may also have the following rights, subject to applicable law.

Right to object: you may have the right to object to certain processing based on legitimate interests, including certain forms of direct marketing.

Right to restrict processing: in some circumstances you may ask us to restrict the way we process your information.

Withdrawal of consent: where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect processing that lawfully took place before your consent was withdrawn.

You can exercise your rights by contacting us using the details below.

We may need to verify your identity before acting on certain requests.

We will not discriminate against you for exercising your privacy rights and will respond within the time required by applicable law.

For information about personal information processed independently by Shopify, please refer to Shopify's privacy information and Privacy Portal.

Complaints

If you have concerns or complaints about how we use your personal information, please contact us using the details below.

If you are in the United Kingdom, you also have the right to complain to the Information Commissioner's Office at ico.org.uk.

If you are in the European Economic Area, you may have the right to complain to the relevant data protection supervisory authority in your country.

International Transfers

Your personal information may be transferred, stored or processed outside the country in which you live.

The core Messy Kitchen ambassador application is hosted on Google Cloud infrastructure in London. Some supporting services and service providers, including Shopify, Google, Meta and TikTok, may process information in other countries.

Where personal information is transferred outside the United Kingdom or European Economic Area and applicable law requires additional safeguards, we use recognised transfer mechanisms where appropriate, such as adequacy regulations or decisions, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, or another lawful transfer mechanism.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our Services, technology, business practices or legal requirements.

When we make changes, we will publish the revised Privacy Policy, update the "Last updated" date and provide any additional notice required by law.

Contact

For questions about this Privacy Policy, our privacy practices or your personal information rights, contact:

Messyface Limited
Company number: 16318098

General enquiries: hello@messy-face.com
The Messy Kitchen: messykitchen@messy-face.com

For the purposes of applicable data protection laws, Messyface Limited is the data controller of your personal information.