Privacy Policy

1. Data controller

The controller of personal data collected on myplaceposter.com is:
Delaunoy Théo
Email: contact@myplaceposter.com

2. Data we collect

We collect the following data:

• Account: email address, name (if provided via Google OAuth or sign-up)
• Orders: first name, last name, postal address, phone number
• Payment: card details are processed directly by Stripe, we never have access to them
• Uploaded photos: stored on Supabase Storage to create your posters
• Browsing: technical logs (IP address, browser) for the security of the service

3. Purposes of processing

• Creating and managing your account
• Processing and delivering your orders
• Sending transactional emails (order confirmation, shipping)
• Automatic moderation of submitted content
• Service improvement and security

4. Legal basis

The processing of your data is based on:

• Performance of the contract (order processing)
• Consent (account creation, community publication)
• Legitimate interest (security, fraud prevention)

5. Service providers

We rely on the following providers:

• Supabase: database and file storage
• Stripe: online payment (PCI-DSS certified)
• Prodigi: printing and delivery of the posters
• Resend: transactional email delivery
• OpenAI: AI stylization of your photos
• Vercel / Railway: hosting

These providers process your data solely to deliver their services and are bound by confidentiality obligations.

6. International data transfers

myPlacePoster is a French company subject to the GDPR. Some of our providers are established outside the European Union, notably in the United States. These transfers are covered by appropriate safeguards in accordance with the GDPR:

• Supabase: data and file storage. Transfers covered by the European Commission's Standard Contractual Clauses (SCCs).
• OpenAI: photo processing for AI stylization. Your photos are sent to OpenAI only for the duration of processing and are neither retained nor used to train models (in accordance with the OpenAI API terms of use). Transfers covered by SCCs.
• Stripe: online payment. PCI-DSS certified. Transfers covered by the EU-US Data Privacy Framework.
• Vercel / Railway: application hosting. Transfers covered by SCCs.

Prodigi and Resend also operate under GDPR-compliant transfer mechanisms. For any question about these transfers, contact us at contact@myplaceposter.com.

7. Data retention

• Account data: until account deletion or after 3 years of inactivity
• Order data: 10 years (accounting obligation)
• Uploaded photos: deleted 30 days after the order if not published in the community gallery

8. Your rights

Under the GDPR, you have the following rights over your data:

• Right of access
• Right to rectification
• Right to erasure
• Right to data portability
• Right to object

To exercise these rights, contact us at contact@myplaceposter.com. You may also lodge a complaint with the French data protection authority, the CNIL.