⚖️ Template document, awaiting review by a lawyer.
Privacy Policy
Last updated: [DATE]. Template document, to be reviewed by a lawyer before going live.
Data controller
[COMPANY NAME], [ADDRESS]. Contact for personal data: [DPO/CONTACT E-MAIL].
Data collected and purposes
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Buyer's e-mail | Order, receipt, access to the customer area | Performance of the contract | Lifetime of the account, then accounting obligations (10 years for invoices, anonymised) |
| Photos, first names, texts of the Gift | Producing and displaying the Gift | Performance of the contract | Photos: 12 months after creation (adjustable), or deletion on request |
| Unpaid drafts | Saving the personalisation | Legitimate interest | 48 hours |
| Recipient's replies and selfies | Forwarding to the buyer | Recipient's consent | Deleted with the Gift |
| Opening statistics (opened on…, number of games) | Informing the buyer | Performance of the contract | Deleted with the Gift |
| Anonymous audience measurement | Improving the service | Legitimate interest (no cookies) | 13 months |
We do not ask for any other personal data. No advertising trackers are used, and no trackers are placed on Gift pages.
Photo processing
Face cut-out is performed in your browser, without sending anything to a third-party server. Photos are stored in the European Union, in a private space accessible only through time-limited signed links. Share previews (WhatsApp, Messenger…) never show the photo or the message.
Processors
- Hosting of the application, database and files: [SERVER HOSTING PROVIDER] (server located in the EU).
- Payment: Stripe (payment service provider).
- E-mails: Brevo (Sendinblue SAS, France).
- Content moderation and custom proposals: Anthropic (Claude models). Texts and photos are sent there for review; they are not used to train the models.
- Cartoon version (option): [PROVIDER], which undertakes not to train its models on the photos sent.
- Audience measurement: Umami, self-hosted on our server, with no cookies and no personal data.
Some processors may process data outside the European Union; these transfers are governed by the European Commission's standard contractual clauses or an equivalent mechanism. [List and safeguards to be checked by a lawyer.]
Your rights
You have the right of access, rectification, erasure, restriction, objection and portability. From your customer area, you can delete a Gift or your entire account and data in one click. For any other request: [E-MAIL]. You can lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).
People in photos
Anyone appearing in a Gift can request its deletion via the "Report" button or at [E-MAIL]. Photos of minors are prohibited.