Legal information
Privacy policy
Who processes your data
The data controller is Jérôme Dupont, sole trader operating under the name JD Creative Studio, SIRET 107 007 874 000 12. His details appear in the legal notice.
What is collected, and why
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email, password (hashed) | Your customer account | Performance of the contract | Until the account is deleted |
| Name, postal address | Delivery of your orders | Performance of the contract | 3 years after the order |
| Order history | Follow-up and after-sales service | Performance of the contract | 3 years, then anonymised |
| Download links | Delivery of the files purchased | Performance of the contract | 30 days of use, purged after 3 months |
| Anonymous visit fingerprint | Audience measurement | Legitimate interest | 13 months |
| Name, email, phone, project description | Answering your quote request | Pre-contractual steps | 12 months |
These periods are not merely declared: an automatic purge runs every night and erases or anonymises whatever goes beyond them.
Cookies
The site sets no advertising cookie and no third-party tracker. The only cookies used are those of your login session and of protection against request forgery: strictly necessary to operation, they are exempt from consent, and are only set if you log in.
Audience measurement is carried out without cookies. Visitors are told apart by a non-reversible fingerprint, computed from your IP address and your browser, renewed every day. It allows neither identifying you, nor following you from one day to the next, nor from one site to another.
Who your data is passed on to
The studio neither sells nor rents your data. It is passed on only to the providers needed to fulfil your order:
| Provider | Role | Data | Location |
|---|---|---|---|
| Stripe Payments Europe | Payment processing | Name, email, card details | Ireland, with transfers to the United States |
| Printful | Printing and shipping of items | Name, postal address, email | Latvia and the United States |
| Resend | Sending order and quote emails | Email address, message content | Ireland (European Union) |
| Supabase | Database hosting | All of the site's data | European Union (Central Europe) |
| Vercel | Site hosting | Technical logs, IP address | United States |
Some of these providers are established in the United States. Transfers rely on the European Commission's standard contractual clauses and, where applicable, on the EU-US Data Privacy Framework.
Your rights
You have a right of access, rectification, erasure, restriction, objection and portability regarding your data.
From your customer area, you can view your orders and delete your account at any time, without having to ask.
For any other request, write to the studio at j.dupont77650@gmail.com. A reply will reach you within one month. You may also lodge a complaint with the CNIL (cnil.fr).
Security
Passwords are never kept in the clear: only their fingerprint is stored, and it is not reversible. At no point does the studio have access to your card details, which are handled directly by Stripe.