Privacy policy
Last updated: 23 October 2026
This policy explains what personal data is collected on gwalarn-studio.github.io/Plume-and-go, why, and what your rights are, under the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the French Data Protection Act.
1. Data controller
[FIRST NAME LAST NAME], Entrepreneur individuel (EI, French sole trader), SIRET [SIRET], [ADDRESS]. Contact: [CONTACT EMAIL].
2. Data collected and purposes
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Processing and delivering your order | Name, email, brief and files you send, message history | Performance of the contract | Files and brief: 30 days after delivery, then deleted. Order data: 5 years (civil limitation period) |
| Invoicing and accounting obligations | Name, email, amount, date, order number, country | Legal obligation | 10 years (Article L.123-22 of the French Commercial Code) |
| Answering your questions | Name, email, message | Legitimate interest | 3 years after last contact |
| Preventing fraud and securing the site | IP address, technical connection data | Legitimate interest | [12 months] maximum |
| Newsletter / offers (if enabled) | Consent | Until you unsubscribe, or 3 years without interaction | |
| Audience measurement (if enabled) | Anonymised or pseudonymised browsing data | [Consent / CNIL exemption for anonymised tools] | 13 months maximum (cookies), 25 months (data) |
Card details are collected directly by Stripe; we never have access to them.
Fields marked as required when ordering are needed to perform the order; without them, the order cannot be processed.
3. Recipients and processors
Your data is never sold. Only the Provider and the processors needed to run the service can access it:
- Payments: Stripe Payments Europe Ltd — Ireland
- Website hosting: GitHub, Inc. — United States
- Email: [EMAIL PROVIDER, e.g. Google Workspace / Proton] — [COUNTRY]
- AI tools used to produce deliverables: Anthropic PBC — United States. Content you send is used only to perform your order and is not used to train models [check against the provider's terms].
- Public authorities where required by law.
4. Transfers outside the European Union
Some processors are located outside the EU (notably in the United States). These transfers rely on an adequacy decision (EU–US Data Privacy Framework, for certified companies) or on the European Commission's Standard Contractual Clauses.
5. Cookies
The site only uses cookies that are strictly necessary for it to work (cart, security, payment), which do not require your consent. [If non-exempt analytics or advertising cookies are added, a consent banner will be shown before any are set, with a "Reject all" button as visible as "Accept all".]
6. Your rights
You have the right to access, rectify, erase, restrict, object to the processing of, and port your data, to withdraw your consent at any time, and (under French law) to give instructions about what happens to your data after your death.
To exercise these rights: [CONTACT EMAIL]. We reply within one month. Proof of identity may be requested if there is reasonable doubt.
If you believe your rights have not been respected, you can lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the data protection authority of your country.
7. Security
The site is served over HTTPS, access to data is limited to the Provider and protected by strong authentication, and customer files are deleted at the end of the retention period stated above.
8. Minors
The services are intended for people aged 18 and over, or for minors with the consent of their legal guardian.
9. Changes
This policy may be updated. The date at the top shows the latest version.