This policy explains what we do with your personal data when you use this website. The data controller is Timothea Creations, France. You can reach us at timothea.creations@gmail.com.
What we collect, and why
When you buy something
We collect your name, email address, billing address and country. We need these to process the order, deliver the download, issue an invoice, and charge the correct rate of VAT for your country. The legal basis is performance of a contract, and for the tax records, a legal obligation.
Your payment card details are handled by Stripe and never reach our servers.
When you create an account
We store your email address and a hashed password so you can sign in and re-download what you bought. The legal basis is performance of a contract.
When you contact us
We keep your message and email address so we can reply and refer back to the conversation if you write again. The legal basis is our legitimate interest in answering you.
Automatically
Our host keeps standard server logs including IP addresses, for security and troubleshooting. WordPress and WooCommerce set functional cookies — for example to remember your cart and keep you signed in. These are necessary for the site to work and are not used to track you.
What we do not do
- We do not sell or rent your data.
- We do not add you to a mailing list because you bought something.
- We do not run advertising or cross-site tracking.
Who else sees your data
Only the services needed to run the shop:
- Stripe — to take payment
- OVH SAS, 2 rue Kellermann, 59100 Roubaix, France — hosting, and therefore storage of the site database
- Our email provider — to send order and support email
- Google Ireland Limited — website analytics, and only if you accepted analytics cookies
Each acts as a processor on our instructions. We do not transfer your data outside the EU except where one of these providers does so under an approved safeguard.
How long we keep it
Order and invoice records are kept for as long as tax law requires 10 years. Account data is kept until you ask us to delete the account. Support email is kept for up to three years so we can follow up sensibly.
Your rights
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or object to our using it. Write to us and we will respond within one month.
Deleting your account does not remove invoices we are legally required to retain.
If you think we have handled your data badly, you can complain to your national supervisory authority — in France, the CNIL.
Cookies
Two kinds, and only one of them is optional.
Necessary cookies
These are set as soon as you arrive, because the shop cannot work without them. WordPress and WooCommerce use them to hold your basket, to keep you signed in, and to remember which language you are reading. Stripe sets its own when you pay, to spot fraud. One more stores the choice you make in the cookie banner, so you are not asked again on every page. None of them are used to track you, and none of them follow you to other sites.
Analytics cookies
These are set only if you accept them. We use Google Analytics to count visits, to see which pages are read and roughly which country readers are in — which is how we decide what to write next. Until you accept, Google Analytics is switched off and stores nothing at all; you can arrive, read and leave without choosing, and no analytics cookie is ever set.
There is nothing else: no advertising cookies, no social media pixels, no tracking across other sites.
Changing your mind
The banner asks you on your first visit, and refusing is one click, exactly like accepting. After that, the small round button in the corner of any page reopens it, and you can change your answer whenever you like. Your choice is remembered for six months.