Privacy Policy

Wall Art Frame processes your personal data in accordance with the EU General Data Protection Regulation (GDPR) and the French Data Protection Act (Loi Informatique et Libertés).

Data controller

Data we collect

Account: e-mail address (login identifier), public pseudonym, password (stored as an Argon2 hash, never in clear text), language preference and e-mail notification preferences.
Purchases: payments are handled by Stripe — no card data ever reaches or is stored on our servers. We keep a Stripe customer identifier and the history of your credit / pass purchases and artwork unlocks.
Usage: artworks you unlock and download, collections, custom crop coordinates (plus a low-resolution preview regenerated from them) and Studio settings.
Contact form: e-mail address, category, message and the anti-spam reCAPTCHA score.
Cookie-consent ledger: an append-only record of your cookie choices (timestamp, choices, version of the text accepted, language, browser user-agent and a salted hash of the IP address) kept as proof of consent. Raw IP addresses are never stored.
Technical data: server logs and application error reports needed to keep the Service secure and reliable. Error monitoring runs on a self-hosted instance on our own infrastructure — error data is never sent to a third-party analytics service.

Personal photos cropped with the free cropping tool are processed entirely in your browser and are never uploaded to our servers.

Purposes and legal bases

Performance of the contract: account management, downloads, purchases, customer support.
Legal obligation: invoicing and accounting records.
Legitimate interest: security, fraud and bot prevention (Google reCAPTCHA v3 on the sign-up, login and contact forms), error monitoring.
Consent: analytics and advertising cookies, plus optional e-mails (news, tips); you can opt out at any time from your profile or via the link included in every such e-mail.

Cookies

Essential (always active): session, CSRF protection, language and your cookie choices.
Analytics / Advertising (only with your consent): Google Tag Manager and Google AdSense, governed by Google Consent Mode v2. Without consent, ads shown to free accounts remain contextual and non-personalised, and no advertising cookie is set.

You can change your choices at any time via the Cookie settings link in the footer. If the purposes or wording of the banner change, you will be asked again.

Recipients and processors

Stripe (payments) — e-mail address and transaction data
Resend (transactional e-mails) — e-mail address
OVH (hosting and media storage, France)
Google (reCAPTCHA anti-bot protection; advertising via AdSense / Tag Manager, subject to your consent)
Google Gemini (AI enrichment of artwork descriptions — no personal data is ever sent to this service)

Data is hosted in France (OVH). Some processors (Stripe, Resend, Google) may process data outside the European Union; such transfers rely on European Commission adequacy decisions or standard contractual clauses.

Retention

Active account: for as long as your account exists.
Account deletion: the account is deactivated immediately, with a 7-day grace period to change your mind, then permanently anonymised within 30 days (crops, collections and unlocks are deleted).
Billing records: 10 years (statutory accounting obligation).
Contact-form reports: anonymised after 18 months.
Cookie-consent records: 3 years (proof of compliance).

Your rights

You have the rights of access, rectification, erasure, portability, restriction and objection. You can exercise them directly from your profile (full data export in JSON, account deletion) or by writing to contact@wall-art-frame.com. You may also lodge a complaint with the French supervisory authority, the CNIL (www.cnil.fr).

Security

All traffic is encrypted (TLS). Passwords are hashed with Argon2. Original artwork files and your personal data live in private storage accessible only through signed, expiring URLs, and administrative access is restricted and rate-limited.