Your data
Privacy policy
What the site actually collects, why, and who this information is shared with.
This English version is a translation provided for convenience. In case of any difference, the French version prevails.
What we collect
Lunéa only collects the information needed for an order and the messages that go with it. No data is sold or passed on for advertising.
Order
Why: Processing and shipping an order
Name, email address, phone number when given, delivery address or chosen pickup point, items, amounts, shipped weight, Stripe payment identifiers, status and provider identifier of transactional emails, and the language of the order.
Back-in-stock alert
Why: Letting you know when a colour is back in stock
Email address and the colour concerned, with a token to unsubscribe from each message.
Newsletter
Why: Sending the welcome code, then new pieces, new collections and a few little surprises
Email address, where you signed up, sign-up and unsubscribe dates, with a token to unsubscribe from each message.
Review
Why: Publishing your review on the piece’s page, after it is read
Displayed name, email address (never published), rating, text, declared place of purchase and any photos. Each photo is analysed automatically when sent by a Cloudflare artificial intelligence model, to remove shocking images: a removed photo is not saved. The email address is used to find an order and to reply to you if needed.
Custom request
Why: Looking at your project and replying to you
First name, email address, type of project, description, colours, dimensions, preferred date, approximate budget and any inspiration photos. Each photo is analysed automatically when sent by a Cloudflare artificial intelligence model, to remove shocking images: a removed photo is not saved. The others are kept with the request, seen only by Léa, and never published.
Contact form
Why: Replying to a request sent to Lunéa
First name, email address, subject, message and order reference when given. The message is sent by email and is not saved in the site’s database.
Customer account
Why: Finding your orders
Email address, managed by Supabase. You sign in with a link sent by email: there is no password.
Form protection
Why: Preventing repeated submissions on public forms
IP address, used for the duration of the limit and then not kept by Lunéa.
Card details
No card number or security code is entered, sent or kept by Lunéa. Card details are entered directly with Stripe, and the site only receives a transaction identifier in return.
Who receives this information
These providers help run the shop. Each one only receives what it needs.
| Provider | Role | Data received | Location |
|---|---|---|---|
| Stripe | Taking payment | Email address, delivery address, amount, card details entered directly with Stripe | Ireland and United States |
| Supabase | Database and accounts | Orders, email addresses, delivery addresses, reviews, custom requests and their photos, alert and newsletter subscriptions | Paris, France (eu-west-3) |
| Resend | Sending order, alert, contact and newsletter emails | Recipient’s email address and message content | Ireland (eu-west-1) |
| Sendcloud | Pickup point search and shipping | Postcode entered in the search, then the delivery address when a label is created | Netherlands |
| Cloudflare | Hosting and protecting the site, automatic filtering of photos sent | IP address, used to limit repeated submissions; photos attached to a review or a custom request, analysed when sent | Worldwide network |
How long we keep it
We keep each piece of information for as long as it is needed, then for as long as the legal obligations attached to it require. Nothing is kept forever.
Orders and invoices, 10 years
Legal accounting obligation to keep supporting documents, set by the French Commercial Code.
Customer account, As long as the account exists, then 3 years without signing in
The account is used to find your orders. After a long silence, keeping it no longer serves any purpose.
Back-in-stock alert, Until you unsubscribe, or 3 years without a purchase
An alert only makes sense while it is awaited. The unsubscribe link is in every message.
Newsletter, Until you unsubscribe; archiving period after unsubscribing to be confirmed
The sign-up date keeps a record of consent. How long this proof is kept is still to be confirmed.
Contact messages, In the mailbox for as long as needed to deal with it; archiving period to be confirmed
The message is only used to reply to the request. No copy is saved in the site’s database.
Reviews, As long as the piece is in the catalogue for a published review; 3 years for a refused review
A published review goes with the piece it describes. A refused review is kept with its reason, to be able to justify the refusal. After these periods, the review and its photos are deleted.
Custom requests, 3 years after the request
Time to discuss the project, then to be able to find a piece made for you. After this period, the request and its photos are deleted.
IP address, For the duration of the limit, then not kept
The IP address is only used to prevent repeated submissions on public forms.
Your rights
You can ask to access your data, correct it or delete it, and object to its processing. A back-in-stock alert is removed with the link in each message, without having to write.
For any other request, write to bonjour@lunea-crochet.fr.
Trackers and audience measurement
Since 18 September 2026, this site has used Google Analytics, loaded by Google Tag Manager, to count visits and understand the purchase journey. Two cookies are placed in your browser, _ga and _ga_B1YLWZ63PW. They are used to tell visitors apart without identifying them: neither your name, nor your email address, nor your delivery address is sent to Google.
These cookies are set for two years, which current browsers reduce to about thirteen months. The measurements are sent to Google, which acts here as a processor.
Everything else is strictly necessary for the site to work, such as keeping your basket in your browser, and is not used for any measurement.
This section is not finished yet. Information needed: the name of the consent tool and how a visitor can refuse measurement or change their choice.