Privacy policy

Data controller

The data controller is [TO BE COMPLETED: company name] ([TO BE COMPLETED: legal form]), whose registered office is at [TO BE COMPLETED: registered office address] (“we”).

Contact: [TO BE COMPLETED: contact email].

Data protection contact (data protection officer, if any): [TO BE COMPLETED: data protection contact / DPO].

In short

• Your full photo never leaves your device: face detection and cut-out run in your browser.
• Only the face you choose (cropped) and its cut-out mask are sent to our servers, to make your design.
• No facial recognition, no AI training, no publication.
• Designs without an order are deleted 72 hours (3 days) after your last activity; unfinished payments: 48 hours (2 days); print files are deleted 120 days after the order; faces of paid orders are kept 760 days (legal guarantee period).
• You can delete everything immediately from the “Delete my data” page.
• No advertising cookies and no third-party audience measurement tools.

1. Photos and faces

When you upload a photo, face detection and cut-out are performed directly on your device, in your browser, using models that run locally (MediaPipe). The original photo is not sent to our servers.

Only the following are sent and stored: the crop around the face you chose, the cut-out face and its mask, reduced-size previews, and technical metadata (dimensions, crop position, detection confidence score, number of faces detected). We also record the date and version of the text by which you confirmed that you hold the necessary permissions.

Purposes: these images are used exclusively to create the design you request (pattern, previews, product mock-ups), to generate print files, to manufacture and ship your order and to handle any claim.

What we do not do: we perform no facial recognition and no identification of individuals; no biometric template is created or stored; images are not used to train artificial intelligence models; they are not published, sold or used for advertising.

Legal bases: performance of the contract or of pre-contractual steps taken at your request (Article 6(1)(b) GDPR), based on your confirmation that you hold the necessary rights and permissions over the photo. For people depicted other than you, processing is based on our legitimate interest in fulfilling the order you placed with their consent (Article 6(1)(f) GDPR); you undertake to have obtained that consent (and that of the holders of parental authority for a minor) and to inform those people of this policy. They may exercise their rights with us.

Retention: designs that are not ordered (crops, faces, previews, pattern settings and cart) are automatically deleted 72 hours (3 days) after your last activity. If you start a payment without completing it, the faces involved are kept for 48 hours (2 days) at most. For a paid order, print files are deleted 120 days after the order, and the cut-out face and pattern settings are kept for 760 days from the order — the legal conformity guarantee period, during which they allow a defective item to be remade identically — and then deleted.

Immediate deletion: at any time, the “Delete my data” page (https://preprod.whatdaface.com/en/privacy) immediately deletes the cropped photos, faces, previews and cart of your session. Items already linked to an order are kept until the period above expires, as they are needed to fulfil it; you may ask us by email to delete them earlier.

2. Share links (optional)

If you choose to create a share link for a generated image, that image is stored and accessible to anyone who has the link, for up to 7 days. It is not indexed by search engines and is not listed anywhere on the Site.

Legal basis: your consent (Article 6(1)(a) GDPR), collected when the link is created. You can withdraw it at any time by deleting your data from the “Delete my data” page. The image is deleted when the link expires or when your session is deleted.

3. Orders and customer service

Data processed: first and last name, email address, delivery and billing addresses, phone number, order contents and amount, payment status, shipping and tracking information, exchanges with customer service. No customer account is needed to order.

Purposes: order management and follow-up, production and delivery, order-related emails (confirmation, shipping, tracking), customer service, handling of legal guarantees and claims, accounting and tax obligations.

Legal bases: performance of the contract (Article 6(1)(b) GDPR) and compliance with our legal obligations, in particular accounting and tax obligations (Article 6(1)(c) GDPR).

Your phone number is only used for delivery and, if necessary, to contact you about your order. We do not send you marketing without your prior consent.

Retention: order data is kept for as long as needed to manage the order and the legal guarantees, then archived for the applicable limitation period (in principle five years, Article 2224 of the French Civil Code and Article L. 110-4 of the French Commercial Code). Accounting records and supporting documents (including invoices) are kept for ten years (Article L. 123-22 of the French Commercial Code). Copies of emails sent and technical notifications from our providers are kept for 90 days.

4. Payment

Payment is processed by Stripe (Stripe Payments Europe, Ltd., Ireland). Your card details are entered directly on Stripe's payment page: we never have access to them and do not store them. We only receive the information needed to follow up the order (payment status and amount, transaction references, addresses and phone number entered on the payment page).

Stripe also acts as a separate controller for certain purposes of its own, in particular fraud prevention and compliance with its regulatory obligations. This processing is described in Stripe's privacy policy, available at stripe.com.

5. Audience measurement

When enabled, we use in-house audience measurement, without any third-party tool, to count the steps of the user journey (for example: photo uploaded, face chosen, product added to cart, order paid) and to improve the Site. No cookie is set for this purpose.

Each event is associated with a pseudonymous identifier computed by hashing the technical identifier of your session (or, failing that, your IP address) combined with the current date: this identifier changes every day and cannot be used to follow your browsing from one day to the next. Neither your IP address nor your session identifier is recorded for this purpose, and no images are involved.

Legal basis: our legitimate interest in measuring traffic and making sure the Site works properly (Article 6(1)(f) GDPR). Data is kept for a maximum of 13 months. You can object by writing to us.

6. Security and technical logs

To keep the Site secure, prevent abuse and diagnose incidents, technical data is processed: IP address, date and time, functions called, browser type, error codes. IP addresses used to limit the number of requests are processed in memory and not stored persistently. Back-office logins are logged.

Legal basis: our legitimate interest in securing the Site and preventing fraud (Article 6(1)(f) GDPR). These logs are kept for a limited period, in principle no more than twelve months, unless a security incident or a legal obligation justifies longer retention.

Recipients and processors

Your data is accessible only to authorised members of our team and to the following service providers, which process it on our behalf, on our instructions and only as needed for their tasks:

• Printful (Printful Inc. and its production facilities, including in Europe) — production and shipping of products. Printful receives the print files (which contain the chosen face), the order contents and the name, delivery address and contact details needed for delivery, which it passes on to the carriers.
• Stripe (Stripe Payments Europe, Ltd., Ireland) — online payment and fraud prevention.
• Resend — sending transactional emails (order confirmation, shipping, tracking).
• Website hosting — [TO BE COMPLETED: hosting provider name], [TO BE COMPLETED: hosting provider address and phone number].
• File storage (faces, previews, print files), in a private space — [TO BE COMPLETED: file storage provider (e.g. Cloudflare R2 or S3-compatible service) and data location].
• Carriers — delivery of parcels, depending on the destination.

Recipients (continued)

We do not sell or rent your data. It may be disclosed to administrative or judicial authorities where required by law.

Transfers outside the European Union

Some service providers (in particular Printful, Stripe and Resend and, depending on the configuration chosen, the host or the storage provider) are established, or use sub-processors, outside the European Economic Area, in particular in the United States. Where personal data is transferred outside the European Economic Area, such transfers are covered by the safeguards provided for in Articles 44 et seq. GDPR: an adequacy decision of the European Commission (for example the EU–US Data Privacy Framework, for certified companies) or standard contractual clauses adopted by the European Commission, supplemented where necessary by additional measures.

You can obtain information about these safeguards by writing to us.

Your rights

Under the conditions laid down by the GDPR, you have the following rights:

• right of access to your data (Article 15);
• right to rectification (Article 16);
• right to erasure (Article 17);
• right to restriction of processing (Article 18);
• right to portability of the data you provided to us (Article 20);
• right to object to processing based on our legitimate interest (Article 21);
• right to withdraw your consent at any time, for processing based on consent;
• right to give instructions regarding the fate of your data after your death (Article 85 of the French Data Protection Act).

Exercising your rights

To exercise these rights, write to us at [TO BE COMPLETED: data protection contact / DPO]. If we have reasonable doubts about your identity, we may ask for additional information, such as your order number. We reply within one month, which may be extended by two months for complex requests (Article 12 GDPR).

For the data of your design session, the “Delete my data” page (https://preprod.whatdaface.com/en/privacy) lets you erase it immediately, with no request needed.

No decision producing legal effects concerning you is taken solely on the basis of automated processing.

You have the right to lodge a complaint with the French data protection authority (Commission nationale de l'informatique et des libertés, CNIL): www.cnil.fr.

Minors

The shop is not aimed at children under 15, who must not place orders or send us any data.

Using a photo of a minor requires the prior consent of the holder(s) of parental authority, which you confirm before uploading. If you believe that an image of a minor has been used without such consent, contact us and we will delete it.

Security

We implement appropriate technical and organisational measures, including:

• storage of photos and files in a private space that is not publicly accessible;
• access to images only through signed links with a limited validity period;
• encryption of communications (HTTPS/TLS);
• signed session cookies that cannot be read by scripts (httpOnly);
• restricted, password-protected and logged access to the back office;
• automatic deletion of data according to the periods stated;
• rate limiting to prevent abuse.

Cookies

The Site only uses strictly necessary cookies. Details are on the Cookies page (https://preprod.whatdaface.com/en/legal/cookies).

Changes

We may amend this policy, in particular if the Site or the regulations change. The version in force is the one published on this page. We will inform you by appropriate means of any significant change.