Privacy policy

Last updated: 10 August 2026

This Privacy Policy explains how Grainwolf collects, uses, stores and shares personal information when you visit our website, join the Grainwolf Founding Pack, contact us, create an account, place an order or otherwise use our services.

In this Privacy Policy, “personal information” means information relating to an identified or identifiable person. It is also referred to as personal data under UK data-protection law.

Grainwolf is operated by:

Mark Hoskins trading as Grainwolf
41 Brockworth Crescent
Bristol
BS16 1HQ
United Kingdom

Email: info@grainwolf.com

For the purposes of applicable UK data-protection law, Mark Hoskins trading as Grainwolf is the data controller of personal information collected and used by Grainwolf, except where another organisation, such as Shopify, acts as an independent controller for its own processing.

Please read this Privacy Policy carefully.

1. WHO WE ARE

Grainwolf is a UK-based matcha and ritual brand.

Our website is hosted by Shopify. Shopify provides the ecommerce platform that allows us to operate our website and, when sales are enabled, manage products, customer accounts, orders, payments and related ecommerce services.

2. PERSONAL INFORMATION WE COLLECT

The personal information we collect depends on how you interact with Grainwolf.

CONTACT INFORMATION

This may include:

• your name;
• email address;
• postal address;
• billing address;
• delivery address;
• phone number where you choose to provide it or where it is reasonably required for an order or delivery.

Our general Contact form is intended to collect your name, email address and message.

Submitting the Contact form does not add you to the Grainwolf marketing list.

ORDER AND TRANSACTION INFORMATION

When sales are enabled, this may include:

• products viewed;
• products added to your basket;
• products purchased;
• order details;
• payment confirmation;
• billing and delivery information;
• delivery status;
• cancellations;
• returns;
• refunds;
• replacement requests;
• customer-support records.

PAYMENT INFORMATION

Payment-related information may include:

• payment method;
• billing information;
• transaction identifiers;
• payment status or confirmation information.

Payment-card information is processed by Shopify and/or our payment providers. Grainwolf does not itself store full payment-card numbers.

ACCOUNT INFORMATION

If customer accounts are enabled, this may include:

• login or authentication information;
• saved addresses;
• account preferences;
• account activity.

FOUNDING PACK AND MARKETING INFORMATION

If you join the Grainwolf Founding Pack or otherwise specifically consent to marketing, this may include:

• your email address;
• marketing preferences;
• waitlist or Founding Pack sign-up information;
• the date, time and method of consent;
• email engagement information;
• unsubscribe status;
• suppression records.

COMMUNICATION INFORMATION

This includes information you provide when communicating with Grainwolf through:

• our Contact form;
• email;
• customer-support channels;
• another communication method we make available.

DEVICE AND TECHNICAL INFORMATION

When you use our website, information may be collected automatically, including:

• IP address;
• browser type;
• device type;
• operating system;
• approximate location derived from technical information;
• cookie or similar identifiers;
• pages viewed;
• referring website;
• website activity;
• other technical and usage information.

3. HOW WE COLLECT PERSONAL INFORMATION

We may collect personal information:

• directly from you when you join the Founding Pack, contact us, create an account, place an order or complete a form;
• automatically when you use our website, including through cookies and similar technologies;
• from Shopify and other service providers that help us operate the website, process payments, manage orders, deliver products, send communications, analyse website performance or protect our services;
• from payment, fraud-prevention, delivery or other providers where reasonably necessary to administer an order, provide our services or protect Grainwolf.

4. WHY WE USE PERSONAL INFORMATION AND OUR LAWFUL BASES

We only process personal information where we have an appropriate lawful basis.

The lawful basis depends on why the information is being used.

TO OPERATE AND SECURE THE WEBSITE

Information may include technical, device, security and essential-cookie information.

Our lawful basis may include:

• legitimate interests in operating, protecting and maintaining our website;
• legal obligation where applicable;
• consent where required for non-essential technologies.

TO RESPOND TO GENERAL ENQUIRIES

Information may include your name, email address and the contents of your message.

Our lawful basis may include:

• legitimate interests in responding to enquiries and operating Grainwolf;
• taking steps at your request before entering into a contract where relevant;
• performance of a contract where an enquiry relates to an existing order.

We do not add you to our marketing list merely because you contact us.

TO PROCESS AND FULFIL ORDERS

Information may include:

• your name;
• email address;
• billing address;
• delivery address;
• order details;
• payment confirmation;
• delivery information.

Our lawful basis is generally:

• performance of a contract.

TO PROCESS PAYMENTS

Information may include payment-related information, billing information and transaction details.

Our lawful basis may include:

• performance of a contract;
• legal obligation where applicable.

TO MANAGE CANCELLATIONS, RETURNS, REFUNDS AND ORDER ISSUES

Information may include contact details, order details, return information, refund information and communications.

Our lawful basis may include:

• performance of a contract;
• legal obligation;
• legitimate interests in resolving customer-service issues, preventing fraud and maintaining appropriate business records.

TO SEND FOUNDING PACK AND MARKETING EMAILS

Information may include:

• your email address;
• marketing-consent information;
• marketing preferences;
• email engagement information.

Our lawful basis is:

• consent.

Where we rely on consent, you can withdraw that consent at any time.

TO MANAGE UNSUBSCRIBES AND MARKETING PREFERENCES

Information may include your email address, consent record, unsubscribe status and suppression information.

Our lawful basis may include:

• legal obligation;
• legitimate interests in ensuring that your marketing preferences continue to be respected.

TO IMPROVE OUR WEBSITE AND CUSTOMER EXPERIENCE

Information may include website-usage information, analytics, feedback and aggregated information about how visitors use Grainwolf.

Our lawful basis may include:

• legitimate interests where appropriate;
• consent where required for non-essential analytics or similar technologies.

TO PREVENT FRAUD AND PROTECT OUR SERVICES

Information may include technical data, payment-related information, order information, account activity and security records.

Our lawful basis may include:

• legitimate interests in preventing fraud and protecting Grainwolf, our customers and our services;
• legal obligation where applicable.

TO COMPLY WITH ACCOUNTING, TAX, LEGAL AND REGULATORY REQUIREMENTS

Information may include order records, invoices, payment records, customer information and relevant communications.

Our lawful basis is generally:

• legal obligation.

Where we rely on legitimate interests, we consider whether those interests are overridden by your rights and freedoms.

5. FOUNDING PACK AND MARKETING EMAILS

The Grainwolf Founding Pack is our consent-based marketing and early-access list.

If you join, we may send you emails about:

• Grainwolf launch updates;
• early access;
• product news;
• future releases;
• Grainwolf guides and content;
• selected founder-only content;
• other relevant Grainwolf news.

Marketing consent is obtained separately from general enquiries and ordinary customer-service communications.

Submitting the Contact form does not subscribe you to marketing.

You can unsubscribe at any time using the unsubscribe link included in our marketing emails or by contacting info@grainwolf.com.

If you unsubscribe, we may retain a limited suppression record containing your email address and unsubscribe status so that your preference continues to be respected.

We do not sell our email list.

6. COOKIES AND SIMILAR TECHNOLOGIES

Our website uses cookies and similar storage or access technologies.

Some are necessary for the website to operate. Others may be used for analytics, personalisation or marketing where enabled.

ESSENTIAL TECHNOLOGIES

These may support functions including:

• website security;
• customer login or account functions;
• basket and checkout functions;
• fraud prevention;
• remembering privacy preferences.

ANALYTICS TECHNOLOGIES

Where enabled, these may help us understand:

• how visitors use the website;
• which pages are visited;
• how the website performs;
• how we can improve the website and customer experience.

MARKETING AND ADVERTISING TECHNOLOGIES

Where enabled, these may be used to:

• measure advertising performance;
• understand marketing activity;
• personalise advertising or marketing;
• provide more relevant advertising or content.

PERSONALISATION TECHNOLOGIES

Where enabled, these may remember preferences or support a more relevant website experience.

Where consent is required by law, we use privacy and consent controls before using non-essential technologies for purposes that require consent.

You can change or withdraw applicable cookie choices using the cookie-preference controls available on the Grainwolf website.

You can also manage cookies through your browser settings, although disabling certain technologies may affect website functionality.

7. SHOPIFY AND SHOPIFY NETWORK INTELLIGENCE

Our website is powered by Shopify.

Shopify collects and processes personal information relating to visitors and customers in order to provide ecommerce, hosting, checkout, account, payment, security and related services.

Depending on the processing involved, Shopify may:

• process personal information on Grainwolf's behalf; or
• act as an independent controller for processing it carries out for its own purposes.

Information processed through Shopify may include information about:

• your device;
• your use of the Grainwolf website;
• products viewed;
• basket activity;
• account activity;
• checkout;
• orders;
• payments;
• transactions;
• interactions with Shopify services.

SHOPIFY NETWORK INTELLIGENCE AND ENHANCED SERVICES

At the date of this Privacy Policy, Shopify Network Intelligence is enabled for the Grainwolf store.

When Shopify Network Intelligence is enabled, Shopify may securely process information about your interactions with Grainwolf together with information from your interactions with Shopify and other Shopify merchants in order to provide, develop and improve Enhanced Services.

Depending on the services being used, this may support functions such as:

• product and store personalisation;
• analytics;
• understanding customer interactions with stores and advertising;
• advertising and marketing services;
• fraud prevention;
• security;
• service and performance improvements.

Shopify states that customer information is not provided directly to other merchants. Instead, information across Shopify's network may be used to generate insights that power Shopify's Enhanced Services.

Information about your activity on Grainwolf may be shared with Shopify and with authorised service providers or other third parties, including organisations located outside the United Kingdom, where necessary to provide Shopify services and Enhanced Services.

You can read Shopify's consumer privacy information here:

Shopify Consumer Privacy Policy

Shopify also provides privacy controls that may allow you, depending on your location and the processing involved, to access data, request deletion, object to or limit certain processing, or manage the use of information for advertising:

Shopify Privacy Portal

Shopify's own Consumer Privacy Policy explains how Shopify processes personal information when it acts as an independent controller.

8. WHO WE SHARE PERSONAL INFORMATION WITH

We may share personal information with service providers where reasonably necessary to operate Grainwolf and provide our services.

These may include:

• Shopify;
• payment processors;
• fraud-prevention and security providers;
• delivery, courier and fulfilment providers;
• email-marketing and communications providers;
• email-hosting providers;
• website, IT and security providers;
• analytics and cookie providers where enabled;
• professional advisers, including accountants, legal advisers and insurers;
• government, regulatory, law-enforcement or tax authorities where required by law.

We only share personal information where there is an appropriate lawful basis and where the sharing is reasonably necessary for the relevant purpose.

Grainwolf does not sell customer personal information or its marketing list.

9. INTERNATIONAL TRANSFERS

Some service providers, including Shopify and other technology providers, may process personal information outside the United Kingdom.

Where UK data-protection law requires safeguards for an international transfer, we take steps designed to ensure that an appropriate lawful transfer mechanism is used.

Depending on the circumstances, this may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to the EU Standard Contractual Clauses;
• another contractual or legal safeguard permitted by UK law.

10. HOW LONG WE KEEP PERSONAL INFORMATION

We do not keep personal information for longer than reasonably necessary for the purpose for which it was collected, subject to legal, tax, accounting, regulatory, fraud-prevention and dispute-resolution requirements.

Typical retention periods may include the following.

ORDER AND TRANSACTION RECORDS

Usually up to 6 years where reasonably required for accounting, tax, legal, fraud-prevention or dispute-resolution purposes.

CUSTOMER ACCOUNT INFORMATION

For as long as the account remains active, or until deletion is requested, subject to information we need to retain for legal, contractual or legitimate business-record purposes.

GENERAL ENQUIRIES AND CUSTOMER-SUPPORT MESSAGES

Normally for the period reasonably required to resolve and administer the enquiry, and usually no longer than 3 years after the enquiry is resolved, unless a longer period is reasonably required for legal, regulatory or dispute purposes.

FOUNDING PACK AND MARKETING INFORMATION

Until you unsubscribe, withdraw consent or we otherwise remove an inactive contact.

After an unsubscribe request, we may retain a limited suppression record for as long as reasonably necessary to ensure your marketing preference continues to be respected.

COOKIE AND ANALYTICS INFORMATION

For the period determined by the relevant technology or service, subject to your consent choices and applicable retention settings.

LEGAL AND COMPLIANCE RECORDS

For as long as reasonably necessary to comply with legal obligations or to establish, exercise or defend legal rights.

11. YOUR DATA-PROTECTION RIGHTS

Depending on the circumstances and applicable law, you may have rights including:

• the right to be informed about how your personal information is used;
• the right to request access to personal information we hold about you;
• the right to request correction of inaccurate or incomplete personal information;
• the right to request deletion of personal information in certain circumstances;
• the right to request restriction of processing;
• the right to object to certain processing;
• the right to object to direct marketing at any time;
• the right to data portability where applicable;
• the right to withdraw consent where processing is based on consent;
• rights relating to certain forms of automated decision-making where applicable;
• the right to make a data-protection complaint.

These rights are not absolute and may be subject to legal conditions or exceptions.

To exercise a right, contact:

info@grainwolf.com

We may need to verify your identity before acting on a request.

We will respond within the timeframe required by applicable data-protection law.

12. DATA-PROTECTION COMPLAINTS

If you believe Grainwolf has not handled your personal information appropriately or has not complied with data-protection law, you can make a complaint directly to us.

Please contact:

info@grainwolf.com

It is helpful if you state that you are making a data-protection complaint and provide enough information for us to understand and investigate your concern.

We will acknowledge a data-protection complaint within 30 days, unless we provide the outcome of our investigation within that period.

We will investigate the complaint appropriately and communicate the outcome without unjustifiable or excessive delay.

If you are unhappy with our response, or otherwise wish to raise the matter with the UK data-protection regulator, you may complain to the Information Commissioner's Office.

Information Commissioner's Office complaints page

The ICO's current guidance confirms that people can complain to an organisation about how their personal information has been handled and, if necessary, take the matter to the ICO.

13. CHILDREN

Our website and services are not intended for children.

We do not knowingly collect personal information from children for marketing purposes.

If you believe that a child has provided personal information to Grainwolf inappropriately, contact:

info@grainwolf.com

We will take appropriate steps where required.

14. SENSITIVE PERSONAL INFORMATION

We do not ask visitors to provide medical information or other special-category personal information through our general website forms.

Please do not include unnecessary sensitive personal information in a general enquiry.

If you voluntarily provide sensitive information because it is genuinely relevant to an enquiry, we will only use it where reasonably necessary to deal with that enquiry and where we have an appropriate lawful basis and, where required, an appropriate condition under applicable data-protection law.

We will not use sensitive information supplied for an enquiry for marketing without separate valid consent where that consent is required.

15. SECURITY

We use reasonable technical and organisational measures designed to protect personal information.

However, no internet transmission, website or electronic-storage system can be guaranteed to be completely secure.

Where customer accounts are available, you are responsible for keeping your login or authentication information confidential.

If we become aware of a personal-data breach, we will take the steps required by applicable data-protection law.

16. THIRD-PARTY LINKS

Our website may include links to third-party websites, platforms or services.

We do not control the privacy practices, content or security of third-party websites.

You should review their privacy information before providing personal information to them.

17. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in:

• Grainwolf's business;
• our website or services;
• service providers;
• Shopify functionality;
• privacy or cookie settings;
• legal requirements;
• privacy or data-handling practices.

The updated version will be posted on this page with a revised Last updated date.

Where required by law, we will provide additional notice of material changes.

18. CONTACT US

If you have questions about this Privacy Policy, want to exercise a data-protection right, make a data-protection complaint or ask how Grainwolf handles personal information, contact:

Mark Hoskins trading as Grainwolf
41 Brockworth Crescent
Bristol
BS16 1HQ
United Kingdom

Email: info@grainwolf.com