Privacy Policy
Last updated: 24/08/2026
Message Mugz (“we”, “our”, “us”) operates the website www.msgmugz.com is committed to protecting your privacy and ensuring your personal data is handled safely, responsibly, and transparently.
This Privacy Policy explains how we collect, use, store, and protect your information when you purchase a personalised product or interact with our website.
By using our website or placing an order, you agree to the terms of this policy.
1. Information We Collect
1.1 Personal Information You Provide
When you place an order or contact us, we may collect:
• Your name
• Email address
• Billing and shipping address
• Order details
• Information submitted via our contact form
1.2 Media Content You Submit
When you purchase a personalised Message Mug, you may upload a video or audio message (“personal message”).
This may include:
• Video footage
• Audio recordings
• Images
• Any personal information visible or spoken within the video
By uploading content, you confirm you have the right to share that material.
1.3 Automatic Website Data
When you visit our website, certain data may be collected automatically through analytics tools, including:
• IP address
• Browser type
• Device information
• Pages viewed
• Time spent on site
This information helps us improve website performance and user experience.
2. How We Use Your Information
We use your information to:
2.1 Fulfil Your Order
• Process and create your personalised product
• Generate your unique QR code
• Link your uploaded video to your mug
• Communicate with you about your order
2.2 Customer Service
• Respond to enquiries
• Provide support
• Resolve issues
2.3 Website Improvements
• Analyse site usage
• Improve user experience
• Enhance our services
We do not sell, rent, or trade your personal data.
3. How Long We Keep Your Data
3.1 Personal Messages (Video/Audio)
Your uploaded video message is securely stored for 12 months from the date of upload.
Before deletion, you may receive a reminder email giving you the opportunity to extend storage.
After 12 months:
• Your video is permanently deleted
• The QR code and short link will no longer link to the original video
Once deleted, the message cannot be recovered.
3.2 Order Information
We retain order-related personal data for up to 6 years to comply with UK tax and legal obligations.
3.3 Contact Form Submissions
Messages sent via our contact form may be stored for up to 24 months for customer service purposes.
4. Legal Basis for Processing (UK GDPR)
Under UK GDPR, we process your information based on:
• Contractual necessity — to fulfil your order
• Legitimate interest — to operate and improve our website
• Consent — when you upload a personalised message
• Legal obligation — for tax and record-keeping requirements
5. Sharing Your Information
We only share your information with trusted service providers necessary to operate our business. This may include:
• Print-on-demand production partners
• Payment processors
• Website hosting providers
• Cloud storage services
• Order management tools
These partners are required to safeguard your data and may not use it for their own marketing purposes.
We do not sell or trade your personal information.
6. How We Store & Protect Your Data
We take data security seriously and implement safeguards including:
• Encrypted storage of personal messages
• Secure access controls
• Limited access granted only to authorised personnel
• Encrypted file transfer
• Regular security monitoring
However, no online service can guarantee absolute security.
7. Your Rights Under UK GDPR
You have the right to:
• Access your personal data
• Correct inaccurate data
• Request deletion (where legally applicable)
• Object to processing
• Restrict processing
• Request a copy of your data (“data portability”)
• Withdraw consent at any time
To exercise any of these rights, please contact us via our Contact page.
8. Children’s Privacy
We do not knowingly collect or process personal data from individuals under 18 without parental consent.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page and take effect immediately upon publication.
10. Contact Us About Privacy
If you have any questions about this policy or wish to exercise your data rights, please contact us via the Contact page on our website.
11. Google and YouTube API Data
11.1 YouTube data we access
The Message Mugz Analytics Collector uses YouTube API Services after the Google account holder has given explicit permission.
The collector accesses read-only YouTube channel information and analytics, including the channel identity, views, watch time, average view duration, likes, comments, and subscriber changes. It does not publish, edit, or delete YouTube content, and it never accesses or stores a YouTube password.
This collector is operated solely for the Message Mugz YouTube account and is not offered as a public service to third parties.
11.2 How we use the data
YouTube data is used only to create private weekly analytics reports, measure content performance, identify trends, and support Message Mugz’s internal content and marketing planning.
By authorising the collector, the Google account holder also agrees to the YouTube Terms of Service. Google’s handling of information is described in the Google Privacy Policy.
11.3 Storage, security and retention
Imported YouTube analytics are stored in a private Google spreadsheet accessible only to authorised Message Mugz personnel and service providers acting on our behalf where necessary to operate the collector.
The Google authorisation token is stored separately in a protected local credentials folder. Reasonable technical and organisational safeguards are used to protect this information against unauthorised access, alteration, disclosure, or loss.
YouTube analytics records are retained for up to 24 months for business trend analysis and are then deleted or anonymised. The authorisation token is retained only while the connection remains active.
11.4 Sharing and Limited Use
Message Mugz does not sell YouTube or Google user data. We do not use it for advertising, retargeting, credit decisions, or disclosure to data brokers.
Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.
11.5 Revoking access and requesting deletion
The Google account holder can revoke the collector’s access at any time through their Google Account connections.
A request to disconnect the collector or delete stored YouTube API data may also be submitted through our Contact Us page. We will remove the stored authorisation token promptly and delete or anonymise the associated YouTube API data within 30 days unless retention is required by law.