Privacy policy

Last updated 5 November 2026.

Who we are. Atomic Goats (shop.atomicgoats.com) is run by Atomic Goats Ltd ("we"), 8 Roman Way, Stilton, Peterborough, PE7 3RU, a company registered in England and Wales, number 17068754. We are the controller of your personal data: we decide how it is used. We have no data protection officer; Thomas Turner answers privacy questions at thomas.turner@atomicgoats.com.

What we collect, and why

  • Your name, email, delivery address and phone number, if you give one: to take, send and support your order. Legal basis: to perform our contract with you.
  • Your order and payment record (we never see your full card number; Shopify Payments holds it): to take payment, refund, and keep accounts. Legal basis: contract, and our legal duty to keep accounts.
  • Your emails to us: to answer you. Legal basis: contract, or our legitimate interest in answering you.
  • What you type to a stylist, if you use one (an occasion, and a line about what you want): to choose outfits for you. Legal basis: our legitimate interest in giving you the service you asked for.
  • A photo of you, if the shop offers this and you choose to add one, and any AI picture of you made from it: only to show you clothes from this shop on a picture of you. Legal basis: your explicit consent, asked separately before you upload anything. We treat your photo as the most protected kind of data (biometric), whether or not the law says it is.
  • Which outfit or try-on picture a piece in your bag came from (a hidden tag on the order line), if we switch this on: to count which pictures lead to sales. Legal basis: our legitimate interest in knowing what works.
  • The steps of your visit (pages and buttons, under a random number, not your name): to see where the shop is hard to use. Only with your consent; it is switched off today.
  • Your email for news and outfit emails, if you sign up: to send them. Legal basis: your consent; you can stop at any time from any email.
  • Cookies and similar: see "Cookies" below.

We need your name, email and delivery address to take and send your order; without them we cannot sell to you. Everything else above is your choice.

Your photo: the rules we keep, for everyone

  • Adding your own photo is switched off in the shop today. When it is on, these rules apply.
  • You are asked, in plain words, before any upload: what the photo is used for, who sees it, how long it is kept. You say yes with a button of its own; nothing is ticked for you. Using a model instead is always offered.
  • Upload only a photo of yourself, never of anyone else, and only if you are 18 or over. You must be signed in to an account to add one.
  • Your photo is used for one thing: to make pictures of you in clothes from this shop. It is never used for adverts, never used to identify you or match you to anyone, never sold, and never used by us to train AI.
  • It is sent to one outside AI service, Google, to make the pictures (below). It is not shared with the suppliers, with Shopify, or with anyone else.
  • How long it is kept: a selfie used to make a full-length picture of you is deleted as soon as that picture is made, or fails, and in any case within a day. Your photo, or the picture of you made from a selfie, is deleted 90 days after you last use it, and at the latest a year after you add it. The pictures of you in outfits are deleted with the photo they were made from. The record that you said yes is deleted with the photo.
  • You can delete your photo, and everything made from it, at any time, on the "Your photos" page in the shop. Deleting it is how you withdraw your consent. A picture you saved to your own device is yours, and we cannot reach it.
  • We never use a picture of you in our marketing unless you say yes again, separately, to that one picture, after you have seen it.

Who else sees your data

  • Shopify (Shopify International Ltd, Dublin, and its group): everything about your order and account, and your payment through Shopify Payments. It runs the shop and takes the payment. For its supplier link (Shopify Collective) Shopify also uses order data as a controller in its own right, under its own privacy policy (shopify.com/legal/privacy). Where: Ireland, Canada, the United States and other countries where Shopify or its providers work.
  • The supplier who posts your order (Pamoni for men's pieces, Aftershock London for women's), through Shopify Collective: your name, delivery address, phone number and the pieces ordered. To pack and post it to you. Both are UK businesses.
  • Google (Google Cloud, Vertex AI): the garment pictures, and, if you add one, your photo and the pictures of you made from it. To make the shop's AI pictures and to draw clothes on a photo of you. Google does not train its AI on it. Where: the United States for the try-on pictures; Belgium for turning a selfie into a full-length picture.
  • Anthropic (its Claude AI): what you type to a stylist, and the shop's garment list. Never your photo, your name or your address. Anthropic deletes it within 30 days and does not train its AI on it. To choose outfits for you. Where: stored in the United States, and it may be processed in other regions.
  • Atomic Goats' own systems, which run the stylist and try-on: your photo, the pictures, the stylist's answers and the order tag. Where: stored in London (Google Cloud).
  • Our accountant, a lawyer, or the authorities: what they need, when they need it, for legal duties and advice. Where: the UK.

We do not send marketing emails today. If we start, we will name the email service here first.

Sending data outside the UK. Some of the services above are in the United States. Where data goes there, it is protected by a safeguard UK law recognises: the UK's data bridge with the US where the company has joined it, or otherwise the Information Commissioner's addendum to the standard contract clauses.

How long we keep the rest. Orders and payments: six years after the end of the financial year, for the tax records. Emails with you: two years after the last one. A visit record: 90 days. What you type to a stylist, and its answers: 90 days if you are signed in, and at most 7 days if not. An order tag: as long as the order. Your account: until you close it, then deleted except what the tax records need. Your photo: above.

Your rights. You can ask for a copy of your data, have it corrected, have it deleted, object to how we use it, ask us to limit its use, and take it elsewhere. Where we rely on your consent you can withdraw it at any time. Email thomas.turner@atomicgoats.com; we answer within a month. If you are unhappy with our answer, you can complain to the Information Commissioner's Office, ico.org.uk.

Children. The shop is not for anyone under 18, and a photo of anyone under 18 must never be added. If we learn one has been, we delete it.

Cookies. We use cookies that the shop needs to work (your bag, your sign-in, the checkout). Shopify's own cookies for counting visits are set only if you say yes in the cookie banner. We use no advertising cookies or pixels today; if we add any, they too will be set only with your yes, and we will name the company here first. You can change your mind at any time from "Cookie preferences" in the policies list at the foot of every page.

Changes. If we change this notice we date it here, and tell you by email if the change matters to you.