1. Controller

The data controller is [TO COMPLETE], publisher of lynajade.com. Contact: lynajade.official@gmail.com.

2. Data collected

• Identification: first name, email, optional phone.
• Purchase: reference, amount, product type, status (via Stripe).
• Shipping (physical items only): postal address.
• Account: email and hashed password.
• Technical: hashed IP, user-agent, timestamps (GDPR audit trail).

We do not store any banking data — payments are processed by Stripe (PCI-DSS Level 1).

3. Purposes & legal basis

• Contract performance (Art. 6.1.b GDPR): bookings, content delivery, account management.
• Legal obligation (Art. 6.1.c GDPR): invoice retention (10 years).
• Legitimate interest (Art. 6.1.f GDPR): fraud prevention, 18+ audit trail.
• Consent (Art. 6.1.a GDPR): newsletter, content watermarking.

4. Retention

• Account: lifetime + 12 months after last login.
• Purchase records: 10 years (French accounting law).
• Technical logs: max 12 months.
• Contact messages: 3 years.
• Newsletter: until unsubscription.

5. Recipients

Your data is never sold. It may be shared with:

• Supabase (EU — DB & auth)
• Stripe Payments Europe Ltd. (EU — payments, DPF certified)
• Bunny.net (EU — video CDN)
• Resend (US — transactional emails, DPF certified)

6. International transfers

Some sub-processors (Stripe, Resend) may process data in the US, covered by the EU-US Data Privacy Framework or standard contractual clauses, ensuring GDPR-equivalent protection.

7. Your rights

Under Articles 15-22 GDPR, you have the right to access, rectify, erase, object, restrict, and obtain portability of your data, and to withdraw consent at any time.

Exercise your rights at lynajade.official@gmail.com. Response within one month.

8. Complaints

You may file a complaint with the French CNIL: cnil.fr/en.

9. Security

TLS encryption, password hashing, role separation, HttpOnly cookies, signed temporary URLs for private content, Postgres RLS, encrypted backups in the EU.

10. Minors

The Site is adult-only. We do not knowingly collect data from minors.

11. Cookies

See our Cookie Policy.

12. Changes

Substantial changes will be notified by email to logged-in users.