Privacy policy
What we collect, why, for how long, and how to take back control. Without the usual jargon.
Last updated August 16, 2026
Data controller
[À COMPLÉTER], [À COMPLÉTER]. For any question about your data: hello@pawraa.com.
What we collect and why
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Email, name, delivery address, phone | Process and deliver your order, keep you informed | Performance of the contract | 10 years (accounting obligation) |
| Photos of your pet | Create the portrait you ordered | Performance of the contract | Deleted 12 months after delivery |
| Order history, chat messages | Follow-up, after-sales, evidence in case of dispute | Performance of the contract | 10 years |
| Payment data | Take payment | Performance of the contract | Held by Stripe/PayPal, never by us |
| Reviews and attached photos | Publish your review on the site | Consent (voluntary submission) | Until you ask us to remove it |
| Audience measurement (pages viewed, journey) | Understand what helps people find the right style | Consent | 13 months |
| Newsletter email address | Send you our new styles | Consent | 3 years after last contact |
Who else sees this data
Only the providers needed to run the shop, each for their own part:
- Stripe and PayPal — taking payment;
- Gelato and Printful — printing and shipping (name, address and artwork only);
- Resend — sending order emails;
- Cloudflare R2 — storing photos and artwork;
- Vercel and Neon — hosting the site and the database.
- An independent illustrator, bound by confidentiality, receives your photos to draw the portrait.
Transfers outside the European Union
Some providers are established in the United States (Stripe, Vercel, Cloudflare, Resend, Printful). These transfers rely on the European Commission's standard contractual clauses and, where applicable, the Data Privacy Framework.
Orders delivered within Europe are printed in Europe.
Your rights
You have the right to access, rectify, erase, restrict, object to and port your data, and to set instructions for what happens to it after your death.
To exercise them, write to hello@pawraa.com: we reply within one month. No justification is needed to withdraw consent.
If our answer does not satisfy you, you may complain to the CNIL (www.cnil.fr), the UK Information Commissioner's Office (ico.org.uk), or the data protection authority where you live.
Security
Traffic is encrypted (HTTPS). Back-office access is protected by password and a signed session. Photos are stored in dedicated storage with unguessable file names.
Automated decisions
No decision with legal effect on you is taken automatically. Every portrait is drawn by a human, and every published review is read by a human.