Privacy policy

1. Controller

The controller responsible for personal data used by this store is:

SIREN 100 629 401. Privacy enquiries and rights requests: privacy@iyrallicious.com.

2. Data we use

• Contact and delivery details, including name, email, optional phone number, and postal address.
• Order information, including products, quantities, prices, delivery country, order status, and support history.
• Payment status, transaction references, and limited fraud-prevention information supplied by Stripe. Iyrallicious does not receive or store your full card number.
• Technical and security information that hosting and payment services generate, such as IP address, request time, browser or device information, and diagnostic logs.
• Information you choose to save in this browser, including your bag, selected house shade, and saved checkout details.
• Messages you send to Customer Care or when requesting newsletter updates.

3. Why we use it and legal bases

Order and delivery

To prepare, accept, pay, deliver, support, return, or refund an order. The legal basis is performance of the purchase contract or steps you request before it.

Accounting and legal duties

To keep invoices, transaction evidence, and compliance records. The legal basis is a legal obligation.

Security and service reliability

To prevent fraud, protect checkout, diagnose failures, and defend legal claims. The legal basis is our legitimate interest in operating a secure and reliable store.

Customer Care

To answer enquiries and resolve complaints. The basis is the contract, steps requested by you, or our legitimate interest in customer service.

Marketing

To send optional updates only where consent is required and obtained, or where another lawful basis specifically permits it. You may unsubscribe at any time.

4. Local browser storage

The bag, house-shade choice, and optional saved checkout profile use local storage on your own device. The saved profile is a convenience record, not an online account, and stays in that browser until you delete it through the Saved details page or clear browser data. It is sent to Iyrallicious only when you use it to submit checkout information.

The store does not currently use non-essential advertising or audience-measurement trackers. Stripe may use cookies or similar technology on its hosted payment pages under its own notice.

5. Service providers and recipients

Personal data is shared only as needed with service providers supporting the store: Vercel for website hosting, Supabase for the private commerce database, Stripe for hosted payment, email providers such as Resend for transactional messages when enabled, Zoho for Customer Care mail, and delivery or fulfilment providers used for an order.

Information may also be disclosed to professional advisers, regulators, courts, law enforcement, or another recipient where required by law or necessary to establish, exercise, or defend legal rights. Personal data is not sold.

6. International processing

Some providers or their subprocessors may process data outside France or the European Economic Area. Where required, transfers are covered by an adequacy decision, approved contractual safeguards, or another lawful transfer mechanism. You may request information about the relevant safeguard by contacting the privacy address above.

7. Retention

• Order, invoice, payment, and accounting records are kept for the period required by French tax and commercial law, generally up to 10 years for accounting evidence.
• Customer Care correspondence is kept only as long as needed to resolve the request and manage or defend legal claims.
• Marketing prospect information is deleted or reviewed after no more than three years of inactivity, unless renewed consent or another lawful reason applies.
• Security and diagnostic records are retained for a proportionate period based on the event, security need, and provider configuration.
• Local browser data remains under your control until you delete it or clear the browser.

Data can be kept longer where litigation, a regulatory request, fraud prevention, or a legal hold requires it, and is then restricted to that purpose.

8. Your rights

Depending on the circumstances, you may request access, correction, deletion, restriction, objection, or portability of your personal data, and may withdraw consent without affecting earlier lawful processing. You may also give instructions concerning personal data after death where French law provides.

Email privacy@iyrallicious.com. We may request proportionate information to confirm identity. You also have the right to complain to the Commission nationale de l’informatique et des libertés (CNIL).

9. Security and required information

Checkout and payment use encrypted HTTPS connections and access-controlled providers. No online service can promise absolute security, but measures are reviewed in proportion to the risk.

Fields marked as required at checkout are necessary to prepare the contract, deliver the order, or meet legal duties. Without them, the order cannot be completed. Optional fields are identified as such.

10. Updates

This notice may change when the store, providers, or legal requirements change. The current version and effective date remain available on this page.