SOUSHI
This privacy policy describes how your personal data is collected, used and protected when you use the SOUSHI Graphics website. The data controller is Lucas Lenhart, sole proprietor (entrepreneur individuel), 22 Chemin de Beauvais, 77410 Charny, France, who can be reached at soushi.officiel@gmail.com.
I am committed to processing your data fairly, transparently and securely, in accordance with the General Data Protection Regulation (GDPR, Regulation EU 2016/679) and the French Data Protection Act (loi Informatique et Libertés of 6 January 1978, as amended). Only the data strictly necessary for the operation of the service is collected: no data is ever sold.
The following categories of data may be collected:
Banking data (card number, security code) never passes through our servers: it is collected and processed directly by Stripe, our PCI DSS certified payment provider.
Your data is processed for the following purposes:
Each processing operation relies on a legal basis provided for in Article 6 of the GDPR. Performance of the contract is the basis for processing the data needed to manage your account, purchases and downloads. Legitimate interest is the basis for processing relating to Site security (logging, rate limiting, fraud prevention) and usage statistics. Consent is the basis for optional processing: non-essential cookies and, where applicable, a future newsletter, from which you will be able to unsubscribe at any time.
Your data is accessible only to the data controller and, for the technical needs of the service, to the following processors:
Each of these providers acts in accordance with its own privacy policy and the contractual guarantees required by the GDPR. No data is sold, rented or passed on to third parties for commercial or advertising purposes.
Some providers (Vercel, Supabase) are companies established in the United States, and part of the data may be hosted or processed outside the European Union. These transfers are governed by the Standard Contractual Clauses (SCCs) adopted by the European Commission, which guarantee a level of data protection equivalent to that required within the EU, together with any applicable certification mechanisms.
Your account data is kept for the duration of the commercial relationship, then for 3 years from your last activity, for prospecting and customer relationship purposes. Payment and invoice data is kept for 5 years, in accordance with accounting and tax obligations. Security logs (logs, audit) are kept for 12 months. At the end of these periods, the data is deleted or anonymised.
You may request the deletion of your account at any time: data not subject to a legal retention obligation will then be erased.
Appropriate technical and organisational measures are implemented to protect your data: encryption of exchanges via HTTPS, password hashing with bcrypt, HTTP security headers (CSP, HSTS, protection against clickjacking and content sniffing), an append-only audit log of sensitive actions, limits on the number of login attempts and requests (rate limiting), and secure session cookies (HttpOnly, SameSite, Secure prefix in production).
In accordance with Articles 15 to 21 of the GDPR, you have the following rights over your data: right of access (obtain a copy of the data concerning you), right to rectification (correct inaccurate data), right to erasure (request the deletion of your data), right to portability (receive your data in a structured, machine-readable format), right to object and right to restriction of processing.
To exercise these rights, simply send your request by email to soushi.officiel@gmail.com, specifying the right you wish to exercise. You will receive a reply within one month. If you believe your rights are not being respected, you may lodge a complaint with the CNIL (cnil.fr), the French data protection authority.
This policy may be updated to reflect changes to the service or to regulations. In the event of a substantial change (new purpose, new recipient), you will be informed by a visible notice on the Site or by email. The date of the last update is shown at the top of this page.
For any question about the protection of your personal data or to exercise your rights, contact the data controller at: soushi.officiel@gmail.com.
