Last updated 30 September 2026
This policy explains what personal information we collect, why, who helps us process it, how long we keep it, and the rights you have. We collect only what we need to sell and deliver tea — nothing more.
Mt. Peak is the data controller for personal information collected through this website. You can reach us by replying to any email we have sent you.
| When | What | Why (lawful basis) |
|---|---|---|
| You place an order (with or without an account) | Name, email, delivery and billing address, items, gift message, promo code | To fulfil the order — contract. Order records are also kept for tax — legal obligation. |
| You create an account | Name, email, a one-way hashed password (we can never read it), saved addresses | To let you sign in, reorder and see your history — contract. |
| You opt in to bag reminders | The contents of your bag while signed in | To send at most two reminders if you leave tea behind — consent, withdrawable at any time. |
| You join the newsletter | Email address | Occasional news from the mountain — consent. |
| You ask to hear when a tea is back in stock | Email address and the tea | To tell you once it returns — consent. |
| You leave a review or request a refund | Your rating, words and reason | To publish verified reviews and handle refunds — contract / legitimate interests. |
| Security | Your IP address, briefly, when you sign in or submit forms | To block password-guessing and spam — legitimate interests. Deleted within 24 hours. |
Site analytics. We use Vercel Web Analytics to count page views and see which pages are popular. It sets no cookies and stores nothing on your device; it does not record your IP address or identify you, and it cannot follow you across other websites. We strip anything after the “?” in page addresses before they are counted, and our back office is never tracked. Lawful basis: legitimate interests in understanding how the shop is used.
We do not use advertising trackers or social-media pixels, we do not profile you, we make no automated decisions about you, and we never sell or rent your data.
| Provider | Purpose |
|---|---|
| Vercel | Website hosting, and anonymous cookieless page-view analytics |
| Neon | Database for accounts and orders |
| Resend | Sending order, password-reset and reminder emails |
| Zoho | Our email inbox, for messages you send us |
| Stripe | Card payments, when enabled — your card details go directly to Stripe and never touch our servers |
| Photon (komoot) | Address suggestions: the text you type in the street-address field is sent to find matching addresses |
| postcodes.io | UK postcode suggestions: the postcode you type is sent to look it up |
Some of these providers are based in, or use servers in, the United States or the EU. Where your data leaves the UK, it is protected by appropriate safeguards such as UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, or the UK International Data Transfer Addendum. Our fonts are hosted on our own site, so browsing does not send your details to Google.
Under UK data protection law you can ask to access, correct, delete or restrict your data, object to how we use it, take a copy of it, and withdraw any consent at any time. Every marketing or reminder email has a one-click unsubscribe link.
To get a copy of your data, use Download my data on your account page. To delete your data: if you have an account, use Delete my account on your account page. Without an account, use our data request form. We respond within one month.
If you are unhappy with how we handle your data, please tell us first — but you also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
This website is not directed at children. You must be 18 or over to create an account or place an order, and we do not knowingly collect information from anyone under 18. If you believe a child has given us their details, contact us and we will delete them.
We use only essential cookies and browser storage — see our Cookie Policy.
If we change this policy we will update the date at the top of this page, and tell account holders by email about any significant change.