Politique de confidentialité
Privacy Policy
This policy explains what we do with your personal information when you visit or buy from arippula.com. We've written it in plain language, because a privacy policy nobody can read isn't really a privacy policy.
Who we are
We are the data controller for the information described here. For anything on this page, email support@arippula.com.
What we collect
When you place an order
Your name, email address, delivery and billing address, phone number, and what you bought.
When you pay
We never see or store your card number. Payment details go directly to our payment providers (Shopify Payments, PayPal, and any other method shown at checkout). We receive only a confirmation that payment succeeded, plus the last four digits and card type.
When you contact us
Your email address and whatever you write to us, so we can help and keep a record of the conversation.
When you browse
Your IP address, browser and device type, pages viewed, referring site, and how you move through the shop. This is collected through cookies and similar technologies — see the cookies section below.
When you subscribe
Your email address, and if you give it, your first name.
Why we use it, and our legal basis
| What we do | Why | Legal basis |
|---|---|---|
| Process and ship your order | To fulfil the contract you entered into | Performance of a contract |
| Handle returns and refunds | Same | Performance of a contract |
| Answer your support emails | To help you | Legitimate interest |
| Send order and shipping updates | So you know where your bag is | Performance of a contract |
| Send marketing emails | To tell you about new bags | Consent — you opted in, and can opt out anytime |
| Prevent fraud | To protect the shop and our customers | Legitimate interest |
| Keep accounting records | Tax and commercial law require it | Legal obligation |
| Measure and improve the site | To understand what works | Consent, via cookie settings |
Who we share it with
We don't sell your data. We never have and we won't.
We do share it with the companies that make the shop run:
- Shopify — our store platform, which hosts the site and processes orders
- Payment providers — Shopify Payments, PayPal, and others shown at checkout
- Shipping carriers — your name, address and phone number, so they can deliver your parcel
- Our email platform — [e.g. Klaviyo / Shopify Email], to send order confirmations and newsletters
- Analytics and advertising — [e.g. Google Analytics, Meta] where you've consented to it
- Our accountant and, if legally required, tax or law-enforcement authorities
Edit this list before publishing. Name only the tools actually installed on your store — an inaccurate processor list is itself a compliance problem.
Cookies
Cookies are small files stored on your device.
Essential cookies keep the shop working — your cart, your login, security. These can't be turned off, because without them there's no shop.
Analytics cookies tell us which pages people visit and where they leave. Marketing cookies let us show you our bags on other sites and measure whether our ads work.
Analytics and marketing cookies are only set if you accept them. You choose when you first visit, and you can change your mind anytime through the cookie settings link in our footer, or by clearing cookies in your browser.
Cookies we set are stored for no longer than 13 months, and we'll ask you again after that.
Marketing emails
We only email you marketing if you asked us to.
Every email has an unsubscribe link at the bottom, and it works immediately. You can also just reply and tell us to stop, or email support@arippula.com.
Unsubscribing from marketing doesn't stop order and delivery emails — you'll still hear from us about a bag you've actually bought.
How long we keep things
- Order records: 10 years, because tax and commercial law require it
- Customer account data: as long as your account is open, plus 3 years
- Marketing contacts: 3 years from your last interaction with us, then deleted
- Support emails: 3 years
- Analytics data: 14 months
Where your data goes
Some of our providers are based outside the European Economic Area, including in the United States.
When your data is transferred there, it's protected by the European Commission's Standard Contractual Clauses, or by the provider's certification under the EU–US Data Privacy Framework. You can ask us for details of the safeguards in place for any specific provider.
Your rights
Under the GDPR, you can:
- Access — get a copy of everything we hold about you
- Correct — fix anything wrong
- Delete — ask us to erase your data, where we're not legally required to keep it
- Port — receive your data in a machine-readable format, or have it sent elsewhere
- Object — tell us to stop processing based on legitimate interest
- Restrict — ask us to pause processing while a dispute is sorted out
- Withdraw consent — anytime, for anything based on consent
- Set instructions — tell us what should happen to your data after your death, as French law provides
To use any of these, email support@arippula.com. We'll respond within one month. It's free, and we won't ask why.
If you're unhappy with how we've handled it, you can complain to the CNIL (Commission Nationale de l'Informatique et des Libertés) at , or to the data protection authority in your own country.
Security
Our site runs entirely over HTTPS. Card details never touch our servers — they go straight to our payment providers, who are PCI-DSS certified. Access to customer data is limited to the people who need it to do their job.
No system is perfectly secure, but if a breach ever affected your data, we'd tell you and the CNIL as the law requires.
Children
Arippula isn't intended for children under 16, and we don't knowingly collect their data. If you believe a child has given us information, email us and we'll delete it.
Changes
If we change this policy we'll update the date at the top, and for anything significant we'll tell you by email or a notice on the site.
Contact
support@arippula.com