What we keep about you, and why.
Very little. An email address if you ask us to write, and what a parcel needs to reach you if you buy cards. We never sell it, and we never use it for anything you did not ask for.
Your email
If you ask us to tell you when the cards are ready, we keep your email address, the date, and the page you signed up on.
We write once, the day they are ready, and ask if you would like to hear about new sets and originals. Say yes and we keep your address for that. Otherwise, we delete it.
If you ask us to tell you when the first colouring night is booked, we keep your email address and the date. We write when it is booked, and ask if you would like to hear about the nights after it. Say yes and we keep your address for that. Otherwise, we delete it.
If you write to us, we keep your email for as long as we need it to answer you, and with your order if there is one.
If you buy cards
You pay on Stripe's own checkout page, so we never see your card number. Stripe looks after your payment under its own privacy policy.
We see your name, email, delivery address and the cards you chose, so Lisa can pack and post them. Your name and address go on the envelope, and to NZ Post if you choose tracked post. We keep order records for seven years, because the tax rules ask us to.
The checkout also asks how you found us. Answering is up to you, and it only tells us which of our efforts works.
If you buy on Etsy, Etsy passes on only what we need to post your order.
If you apply to work with us
If you apply to work with us as an artist, we keep your name, your email, where we can see your work and your answers to our questions. We use it only to look at your work and write to you about it. If we do not go ahead together, we delete it.
If your shop joins the places we trust
If your shop signs up to be one of the places we trust, the website shows only the listing you asked for: your business name, town, your line, your perk if you chose one, and any address, phone or website you ticked. Your first name, your email and your printing details stay with us and never appear on the website. We use them only to write to you about your listing. The link in our invitation carries a code so the form knows which shop you are. Ask us any time and we will change it, take it down or delete what we keep.
If you help spread the colour
On marlowren.com/spread, your browser makes a short random code and keeps it on your device, so the link you share carries it and we can see how far one share travels. Each visit, tap and share adds one to a count, with that code and the town and country your connection comes from, as Cloudflare reads it, and where Cloudflare places that town, so the map can show how far the colour has travelled. Never your name or anything else about you. The page shows only the totals and the towns. Your browser also remembers which of the three taps you have done, so the page can tick them, and which shared links have brought you there, so coming back is not counted again. Neither list leaves your device.
If we invite you as an artist
If we invite you to work with us as an artist, the postal address you give us is used only to post your box to you. If you decide not to go ahead, we delete it.
Who else sees it
This site has no cookies, ads or tracking. Like every website, the company that runs it, Cloudflare, sees your internet address when a page loads.
Cloudflare also counts how often each page is opened, without cookies and without following you from site to site. We only ever see the totals.
The addresses on our slips, profiles and ads add one to a count as you pass through, so we know which ones people use. Some, like the one on our Halloween pack card, note the town and country your connection comes from, as Cloudflare reads it. Nothing else about you goes with it.
If you came to us through a link from someone who shares our cards, your browser remembers their code for 30 days, so they earn a share if you buy, at no extra cost to you. The code is kept only on your device and goes with your order. They never see who you are.
Your details are kept for us by Cloudflare (this site and the email list), Google (our email) and Stripe (payments), mostly in the United States. Only the two of us who run Marlo Wren can see them. We never sell or share them, and would only pass them on if the law required it.
On the free resources page, your browser remembers the country you chose. On the colour wheel, it remembers your colours, and a photo you open there is only shown in your browser. None of that leaves your device.
If your details were ever lost or seen by someone who should not have them, we will tell you as soon as we can.
Seeing, changing or deleting it
Write to hello@marlowren.com and we will show you what we hold about you, correct it, or delete it. It costs nothing, and we will answer within 20 working days. Only order records stay, for the seven years the tax rules ask for.
Who we are
Marlo Wren is a small family business, from our studio in Cambridge, Aotearoa New Zealand. Marlo Wren is a trading name of Northern Rivers Group Limited, run by Lisa Hopkins, who is also our privacy officer. Our postal address is 120A TeAwa Road, Tamahere, New Zealand.
Last changed 26 October 2026.