Data controller: Pocabase, 6 rue d'Auteuil, 31500 Toulouse, France — contact@pocabase.com.
Data collected
When ordering: name, shipping address, e-mail, phone, order contents, Stripe payment identifiers (never the card number). When browsing: anonymised audience measurement (Umami, cookie-free), technical logs. The cart is stored in your browser (localStorage) and only sent to us at checkout. With your consent only: Google Analytics 4 audience measurement (see “Cookies and audience measurement” below).
Photos of your cards (Premium): the image is resized and its metadata (EXIF, GPS position) is removed. Its address is public but impossible to guess, and search engines are told not to index it; the photo is deleted when you remove it or delete your account.
Photos shown to everyone: if you offer the photo of one of your cards to illustrate it on pocabase ("Show everyone"), you state that you took it yourself and you grant Pocabase a free, non-exclusive, worldwide licence to display it on the site, for an unlimited period. Once our team accepts it, a copy is published on public pages (indexed by search engines); it stays online even if you remove your photo or delete your account. You, a rights holder or a person visible in the photo can ask for its removal at any time at contact@pocabase.com: we remove it without delay.
Country of connection: on each visit, your IP address is used on our servers to work out your country (DB-IP “IP to Country Lite” database), to suggest the site language and show the subscription price in your currency. Neither the address nor the country is stored for this.
Purposes and legal bases
Performance of the contract (order processing and delivery, invoicing, customer service); legal obligation (invoices kept for 10 years); legitimate interest (security, cookie-free anonymous statistics); consent (Google Analytics 4 measurement cookies, withdrawable at any time). No marketing without consent.
Recipients
Stripe (payment), Resend (transactional e-mails), our suppliers and carriers (name and address, strictly for delivery), the hosting provider. Some suppliers are located outside the EU (South Korea, United States): transfers are covered by the European Commission's standard contractual clauses.
Cookies and audience measurement
Strictly necessary storage: the cart (localStorage) and the `pocabase_consent` cookie, which remembers your choice for 6 months. Neither requires consent.
Cookie-free audience measurement (Umami, self-hosted in Europe): no identifier, no cookie, no personal data — legal basis: legitimate interest.
Google Analytics 4, only if you accept it: `_ga` and `_ga_<id>` cookies, purpose: audience measurement (page views, shopping journey, traffic sources), cookie lifetime 13 months maximum, data retention 14 months, legal basis: your consent. Consent Mode v2 is active: advertising storage, ad user data and ad personalisation stay denied in all cases, and IP addresses are anonymised by default. Recipient: Google Ireland Limited; transfers outside the EU are covered by the standard contractual clauses and the EU—US Data Privacy Framework.
Until you accept, no Google script is loaded and no Google cookie is stored. You can withdraw your consent at any time through the “Manage cookies” link at the bottom of every page: the `_ga` cookies are then deleted and the tag is no longer loaded.
Retention
Order data and invoices: 10 years (accounting obligation). Tracking access: duration of the commercial relationship + 3 years. Technical logs: 12 months. Cookie consent choice: 6 months.
Your rights
Access, rectification, erasure, restriction, portability, objection: write to contact@pocabase.com. You may lodge a complaint with the CNIL (www.cnil.fr) or your local data protection authority.