Privacy policy
What we collect, why, how long we keep it, and the rights you have over it.
Last updated on 2 October 2026
Data controller
CARTHANET, registered office at 60 rue François Ier, 75008 Paris, France, is the controller for the processing described below. For any question about your data: contact@aveorparis.com.
What we collect, and why
We collect only what we need to sell and deliver. Each purpose rests on a specific legal basis:
- Order and delivery
- Name, postal address, email address. Legal basis: performance of the contract.
- Payment
- Handled by Stripe. We neither receive nor store your card details — only a transaction identifier and the payment outcome. Legal basis: performance of the contract.
- Customer account
- Email address, order history, favourite pieces. Legal basis: performance of the contract and our legitimate interest in offering you order tracking.
- Invoicing and accounts
- Billing data. Legal basis: statutory retention obligation.
- Newsletter
- Email address, only if you sign up. We also keep the date and IP address of your sign-up: that is the proof of your consent, which we must be able to produce. Legal basis: your consent, which you may withdraw at any time.
- Availability alert
- Email address and IP address, when you ask to be told a piece has become available. It is used for that message and, if the piece is still available a few days later without having been ordered, for a single reminder; it signs you up to nothing else. Legal basis: your consent.
- Cart
- The pieces you have added to your cart, attached to your account when you are signed in, so you find it again from another device. Legal basis: performance of the contract, at your request.
- Reviews
- The rating and comment you publish after a purchase, together with the link to the order concerned — that link is what shows the review comes from a buyer. The review is published on the product page. Legal basis: your consent, and our legal duty to state where reviews come from.
- Contact form and questions about a piece
- Name, email address, order number where given, and the content of your message. These reach us by email and are not stored in our database. Legal basis: our legitimate interest in answering you.
- Gift message
- The message you write at checkout when a piece is prepared as a gift. It is kept with the order and copied onto the card slipped into the parcel. Legal basis: performance of the contract, at your request.
- Review invitation
- Email address, for a single message sent a few days after your order is delivered. Legal basis: our legitimate interest in hearing from our customers. You can object at any time by writing to us.
- Server logs
- IP address, date and pages requested, recorded by the server on each visit. Legal basis: our legitimate interest in keeping the site secure and diagnosing faults.
Who receives your data
Your data is neither sold nor rented. It is passed only to the providers strictly needed to run the service:
- OVHcloud
- Site hosting, in France. Does not access the content of the data.
- Supabase
- Database and account management. Your data is stored in France (European Union).
- Stripe
- Payment processing and invoicing.
- Resend
- Sending confirmation emails, invoices and the newsletter. Provider established in the United States.
- Colissimo (La Poste)
- Name, delivery address and email address, to deliver the parcel and send delivery notices.
The site is hosted in France and the database in France (European Union): your orders, your account and your favourites are stored there.
Some providers are US companies: Supabase, Stripe, Resend and, if you accept audience measurement, Google. Any access to your data from the United States is governed by the European Commission's standard contractual clauses, supplemented where applicable by the EU–US Data Privacy Framework.
These providers act on our instructions and are bound by contractual confidentiality and security obligations. No data is sold or rented.
How long we keep it
- Customer account
- Until you delete it, then erased.
- Orders and invoices
- Ten years, under accounting obligations.
- Newsletter
- Until you withdraw consent. The address and proof of consent are then kept for five years, and erased.
- Availability alert
- Erased within thirty days of the last message being sent.
- Cart
- Erased twelve months after your last visit, or at your request.
- Published reviews
- For as long as the piece is on sale, then three years — the period during which the law requires the date of a review to be shown.
- Contact messages
- Three years after the last exchange, in our inbox.
- Return requests
- Three years after the case is closed.
- Unconfirmed sign-up
- Erased thirty days after the request if the confirmation link has not been used.
- Server logs
- Fourteen days.
Your rights
Under the General Data Protection Regulation, you have the right to:
- access the data we hold about you;
- have it corrected if it is inaccurate;
- ask for it to be erased, subject to our statutory retention obligations;
- object to processing, or ask for it to be restricted;
- receive your data in a machine-readable format, and have it transferred;
- withdraw your consent at any time, for processing that depends on it;
- set instructions for what happens to your data after your death.
To exercise these rights, write to contact@aveorparis.com. We reply within one month. If our answer does not satisfy you, you may refer the matter to the French data protection authority (CNIL), 3 place de Fontenoy, 75007 Paris — cnil.fr.
Security
Traffic to and from the site is encrypted. Access to data is partitioned by rules enforced at the database level: each account can only see its own orders, and payment details never pass through our servers.
The French version of this document is the one that governs. This translation is provided for convenience; in case of divergence, the French text prevails.