Privacy Policy

Data Controller

• Company SARL FAIRY CHAIR STUDIO
• Address 14 Boulevard Beaumarchais, 75011 Paris
• SIRET 913 296 893 00013
• Email [email protected]

Data Collected

• Account First name, last name, email address, hashed password, language preference.
• Orders Delivery address, order details, order history and status, Stripe payment references (no card data stored).
• Newsletter Email address, language preference, unsubscribe token.
• Contact Name, email, subject and message content.
• Reviews Review content, rating, display name.
• Technical logs IP address (standard server logs, not retained beyond 30 days).

Purposes & Legal Basis

• Order processing Contract performance (Art. 6.1.b GDPR).
• Customer account Contract performance / consent (Art. 6.1.b & 6.1.a).
• Newsletter Explicit consent (Art. 6.1.a). Unsubscribe at any time.
• Reviews Legitimate interest — service improvement (Art. 6.1.f).
• Contact Legitimate interest — handling enquiries (Art. 6.1.f).
• Legal obligations Billing data retained 10 years (French commercial law).

Retention Periods

• Active account Duration of use + 3 years of inactivity.
• Orders & invoices 10 years (legal accounting requirement).
• Newsletter Until unsubscription, then deleted within 30 days.
• Contact 3 years from last interaction.
• Reviews Until account deletion or review withdrawal.
• Technical logs Maximum 30 days.

Data Recipients

• Stripe Secure payment provider — no card data passes through our servers. Stripe Privacy Policy.
• Resend Transactional email provider. Resend Privacy Policy.
• Render API and database hosting (European servers). Render Privacy Policy.
• Cloudinary Product image storage (no personally identifiable data).

Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Access Obtain a copy of your data.
• Rectification Correct inaccurate or incomplete data.
• Erasure Request deletion of your data (subject to legal retention obligations).
• Objection Object to processing based on legitimate interest.
• Restriction Request restriction of processing.
• Portability Receive your data in a structured, machine-readable format.
• Withdrawal of consent Withdraw consent at any time (without affecting prior processing).

To exercise these rights, contact us at [email protected]. If unsatisfied with our response, you may lodge a complaint with the CNIL (French data protection authority).

Cookies

• Authentication Secure HTTP-only cookie (JWT) — session duration, required for operation.
• Cart Data stored in browser localStorage — not transmitted to the server without user action.
• No advertising cookies No third-party trackers for advertising or analytics purposes are set.

Policy Updates

This policy may be updated at any time. The date of the last modification is shown below. Material changes will be communicated by email to affected users.

Last updated: May 2026