Privacy policy

The data controller is InShadow (entreprise individuelle), SIRET 914 479 027 00015, reachable at hello@inshadow.xyz (full identity in the Legal notice). This policy explains how we process personal data under the EU General Data Protection Regulation (GDPR) and the French Data Protection Act.

Contact & demo forms

Name, email, message, links you submit — to answer your enquiry and assess fit. Legal basis: pre-contractual measures / our legitimate interest in responding.

Orders & payment

Order details and the email used; card payments are processed by Stripe (we never see full card data). Legal basis: performance of the contract and legal accounting obligations.

Email correspondence

The content of emails you exchange with us, and automatic transactional confirmations sent via Resend. Legal basis: contract / legitimate interest.

Technical logs

Standard server logs kept by our host for security and reliability. Legal basis: legitimate interest.

We share data only with processors acting on our instructions:

Stripe

Payment processing.

Resend

Transactional/auto-reply emails.

Supabase

Database storage of form submissions and order records (hosted in the EU, eu-west-1).

Vercel

Website hosting and server logs (United States).

Some processors (Stripe, Vercel) may process data outside the EU; such transfers are framed by the European Commission’s Standard Contractual Clauses or an adequacy decision.

• Enquiry/form data: kept up to 3 years from the last contact.
• Order, invoicing and accounting records: kept for the legal period of 10 years.
• Technical logs: kept for a short period for security, then deleted.

You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to define directives on the fate of your data after death. To exercise them, email hello@inshadow.xyz. You may also lodge a complaint with the CNIL (www.cnil.fr).

InShadow does not use advertising or third-party tracking cookies and does not run analytics that profile you. The Site uses only strictly necessary, functional storage — for example remembering your legal-page language choice and the technical state of your cart and checkout. Under the ePrivacy rules and CNIL guidance, this strictly necessary storage does not require consent, so the Site displays no cookie-consent banner.