Free UK shipping… one less reason to say no.

The fine print

Privacy Policy

Your trust is the heart of the ritual. This policy explains how we handle your personal data when you visit, subscribe, or correspond with Ritual & Ruin.

Effective date: 27 May 2025

This Privacy Policy describes how Shelf-Made™ (trading as Ritual & Ruin and Ritual&RuinXShelf-Made™), a United Kingdom business, collects, uses, stores and protects your personal information.

By using our website, placing an order, or signing up to our subscription box, you agree to the practices described in this policy. If you do not agree, please do not use our services.

1. Who we are

The data controller responsible for your personal data is Shelf-Made™, the company behind Ritual & Ruin. We are based in the United Kingdom and operate the Ritual & Ruin subscription experience for readers of indie dark romance.

For any privacy questions, you can reach us at support@shelfmadebooks.com.

2. What information we collect

We collect information you provide directly, as well as data generated automatically when you interact with our website.

  • Account details — name, email address, password, billing and shipping addresses.
  • Order information — products purchased, subscription plans, payment status, gift options, and delivery preferences.
  • Payment data — card or payment method details are processed securely by our payment providers; we do not store full card numbers on our servers.
  • Communications — emails, support messages, survey responses, and social media correspondence.
  • Device and usage information — IP address, browser type, device type, pages visited, and referring URLs, collected via cookies and similar technologies.

3. How we use your information

We use your personal data to:

  • Process and fulfil your orders and subscriptions.
  • Manage your account and subscription preferences.
  • Provide customer support and respond to your enquiries.
  • Send order confirmations, delivery updates, and essential service messages.
  • Send marketing communications where you have opted in to receive them.
  • Improve our website, products, and customer experience.
  • Prevent fraud, abuse, and other illegal activities.
  • Comply with legal and regulatory obligations.

4. Legal basis for processing

Under UK data protection law, we process your data on one of the following legal grounds:

  • Performance of a contract — to provide the subscription box and related services you have purchased.
  • Legitimate interests — to improve our services, prevent fraud, and keep our website secure.
  • Legal obligation — to comply with tax, accounting, and other legal requirements.
  • Consent — for marketing emails and non-essential cookies, which you can withdraw at any time.

5. How we share your information

We do not sell your personal data. We may share it with trusted third parties who help us run Ritual & Ruin:

  • Subbly — our subscription and e-commerce platform, used to manage orders, subscriptions, and billing.
  • Payment processors — to handle secure transactions.
  • Shipping and fulfilment partners — to deliver your boxes.
  • Analytics and email providers — to understand how our site is used and to send communications.
  • Legal authorities — when required by law or to protect our rights.

All third parties we work with are required to handle your data securely and only for the purposes we specify.

6. Cookies and tracking

Our website uses cookies and similar technologies to remember your preferences, understand how visitors use the site, and support marketing. You can manage or disable cookies through your browser settings at any time, though some features may not work correctly if cookies are turned off.

7. Data retention

We keep your personal data only for as long as necessary for the purposes described in this policy. Account and order information is typically retained for as long as your account is active and for a reasonable period afterwards to comply with legal, tax, and accounting obligations. Marketing data is kept until you withdraw your consent or it becomes inactive.

8. Your rights

Under UK data protection law, you have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate or incomplete data.
  • Request deletion of your personal data in certain circumstances.
  • Object to or restrict certain types of processing.
  • Request a copy of your data in a portable format.
  • Withdraw consent for marketing at any time.
  • Lodge a complaint with the UK Information Commissioner's Office (ICO).

To exercise any of these rights, please contact us using the details at the end of this policy.

9. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. This includes secure hosting, encryption in transit, and access controls.

10. International transfers

Some of the third parties we use may process data outside the United Kingdom. When this happens, we ensure appropriate safeguards are in place to protect your information in accordance with UK data protection law.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated version will be posted on this page with a revised effective date. We encourage you to review it periodically.

12. Contact us

If you have any questions, concerns, or requests about this Privacy Policy or how we handle your personal data, please contact us: