Privacy policy

Last updated: [date]

1. Who is responsible for your data

The data controller is [business name], [registered address], VAT / tax ID [VAT or tax ID]. For any question about your data, write to us at [contact email].

2. What data we collect and why

When you buy, we collect your email address (to send you the product and, if needed, to resend the link) and, where applicable, the billing details you give us. The legal basis is the performance of the contract (art. 6(1)(b) GDPR) and our legal invoicing obligations (art. 6(1)(c)).

We don't collect your card details — they are entered directly on the secure Stripe page and never reach us.

3. How long we keep it

We keep order data for as long as the law requires for accounting records (currently [5 / 10] years from the end of the financial year). We don't use it for marketing without your explicit consent.

4. Who else sees the data (our processors)

For the shop to work, the data passes through a few providers that process it on our behalf, each with its own GDPR safeguards:

• Stripe — payment processing (Stripe Payments Europe, Ireland);
• Supabase — the shop's database and files (the servers are in [the region chosen when creating the project — e.g. Frankfurt, EU]);
• Resend — sending the email with the product;
• [your invoicing service — if you use one].

We never sell or rent your data to anyone.

5. Cookies

The site doesn't use tracking or advertising cookies. [If you add Google Analytics or other measurement tools, write here what you use and add a consent banner — ask Claude.]

6. Your rights

You have the right to request access to your data, its correction, erasure (within the limits of our accounting obligations), restriction or portability, and to object to its processing. Write to us at [contact email] and we'll reply within 30 days at most. If you're not satisfied, you can lodge a complaint with [your national data protection authority].

7. Security

Data is transmitted encrypted (https), stored in a protected database that only the shop's administrator can access, and payments are processed by a PCI-DSS certified provider.