Privacy and cookies

Last updated 27 October 2026

Who we are

Made of Many is a trading name of Phil J Nicholls, Georgia, 0179, Tbilisi City, Vake District, Zakaria Paliashvili Street, N 41, Entrance 1, Basement Floor, who is responsible for your personal data (the “controller”). Questions about it go to help@madeofmany.app.

We’re based in Georgia, so the Law of Georgia on Personal Data Protection applies to everything we do with your data. If you live in the UK or the EU, the UK GDPR or the EU GDPR also applies, because we sell to you there; if you live in a US state with a privacy law, so does that state’s law. Where the laws differ, we follow whichever gives you more protection.

What we use, and why

The family details you type: names, nationalities and the 100% line.

• They’re saved in your browser (see “Storage on your device” below) so you don’t lose your progress.
• To draw a preview or a share card, they’re sent to our server, used and thrown away. We don’t store them.
• If you share a link to your card, the link itself carries what’s on the card: the first name at the top, the fractions and the 100% line, but none of the other names. Anyone with the link, including the site you share it on, can see the card. We still don’t store it; sharing it is up to you.
• Nationalities and some 100% lines (for example “Jewish”) can say something about ethnic origin or religion, which the law treats as special category data. We only use them to show you your design and, if you order, to print it, and when you order we’ll ask for your explicit consent to that.

When you order: your name, email, delivery address, phone number if you give one, the design and the order details.

• We use them to make, deliver and support your order (to perform our contract with you), and keep order records for 6 years because tax law requires it. The design itself is deleted 90 days after delivery.
• Payments are handled by our payment provider; we never see your full card details.

How the site is used: we count visits, started and finished trees, shared cards and gift links, by page (such as /Irish) and by the campaign a link came from. These are totals per day with nothing about who you are: no cookies, no IP addresses and no device identifiers. They help us see which pages work (our legitimate interest in running the business).

Keeping the site safe: to stop anyone flooding the site with requests, our server holds your IP address in memory for a few minutes while you use it. It isn’t written to disk or logged (our legitimate interest in keeping the site working).

If you comment on our Instagram posts: we see your username and comment. Our system sends the link by direct message when you ask for it, and hides comments containing abusive words. We keep a record of the comments we acted on for a year (our legitimate interest in running our account). Instagram and TikTok’s own privacy policies cover what they do.

If you email us: we use your message to reply, and keep it for as long as we need to help you, up to 2 years.

Who we share it with

We don’t sell your personal data or share it for advertising. We use these service providers, who may only use it to provide their service to us:

• DigitalOcean, which hosts the site on servers in Frankfurt, Germany;
• Gelato, which prints and delivers orders (with its delivery partners);
• our payment provider, to take payment;
• our email provider, to send order emails.

Your data goes from you to us in Georgia and to these providers in other countries, including the United States. Where a country isn’t recognised as protecting personal data adequately (under Georgian law, or under UK or EU law if you live there), it’s protected by the safeguards the law requires, such as standard contractual clauses or the EU–US Data Privacy Framework.

Storage on your device

We don’t use cookies. The site stores two things in your browser’s local storage, both so the wizard works the way you’d expect; they’re strictly necessary for the service you’re using, so we don’t need to ask first:

• made-of-many-v1: where you are in the wizard, so a reload or the back button doesn’t lose your progress;
• made-of-many-families: the trees you’ve entered (up to 12), so you can come back to them. Remove one with “Forget” on the welcome screen.

They never leave your device except as described above. Clearing your browser’s site data removes them.

Your rights

You can ask us for a copy of your personal data, to correct it, delete it, restrict or object to how we use it, or to send it to you or someone else in a portable form. Where we rely on your consent, you can withdraw it at any time (before your shirt is printed, that means cancelling the order). Email help@madeofmany.app; we reply within 10 working days.

If you’re unhappy with how we’ve handled your data, you can complain to Georgia’s Personal Data Protection Service (personaldata.ge) or to the data protection authority where you live: in the UK, the Information Commissioner’s Office (ico.org.uk); in the EU, your country’s authority.

If you live in a US state with a privacy law, such as California, you have similar rights to know about, correct and delete your personal information. We don’t sell it or share it for targeted advertising.

Children

The site is for adults. Parents often enter their children’s names in a family tree; if you do, you’re doing so as their parent or guardian. We don’t knowingly collect data from children under 16.

Changes

If we change this policy we’ll update the date at the top, and tell you about anything important that affects an order you’ve placed.