Privacy policy

The data controller

Compagnie des Blasons, 6 rue du Château, 12190 Estaing, France, SIREN 944 919 968. For any question about your data: contact@posterdeblonde.com.

What we collect, and why

Your order

name, delivery and billing address, e-mail address, telephone number if you give one, the items and their personalisation. Needed to perform the contract of sale.

Your photograph

if you compose a print with a photograph — the birth print with photo, the star map with photo, the star map and photo side by side, the city map with photo, the “Musée de Nous” print, the magazine cover, the birthday newspaper front page, the family tree (one optional photo per person), the birth year poster (one optional photo), the “photos in the letters” posters (one to twelve photos), the “photo collage” posters (one to twenty-four photos), the “Mon premier Noël” poster (one optional photo), the “Skipper’s Rules” poster (the skipper’s photo, optional), your pet’s wanted poster, the watercolour portraits (dog, cat, couple, family, baby, children or house), the 3D animated movie portraits (mum, dad, couple, family, baby or child, grandparents), the single-line portraits (couple, family or one person), the retro motorbike posters, the vehicle posters (car, motorbike, scooter, pick-up, tractor), the street art posters or the “best friends” posters (a photograph of a group of friends) — the photograph you upload is stored privately with our host so that we can make your print file. It is never published, never used as an example or as marketing imagery, and we strip the data cameras slip into it — the location of the shot in particular. Without a photograph these designs cannot be made; the others require none. For the watercolour portraits, the single-line portraits, the retro motorbike posters, the vehicle posters, the street art posters and the “best friends” posters, the photograph is also sent to an artificial intelligence service run by Google, from our server, to be transformed; the resulting image is kept in the same private storage as the photograph, never published or used as an example, and follows its retention period. For the “Skipper’s Rules” poster, the skipper’s photo is sent in the same way so that a captain’s cap can be put on, and the resulting image is kept for the same period.

Your sound

if you create the “Onde sonore” (sound wave) print: your browser reads the audio file you pick, on your own device, and draws the waveform from it. The file is neither sent to us nor stored. Only the numbers that draw the wave (240 values) and the length of the sound travel with your order.

Your review

if you leave a review from your order page, we record your first name, your rating, your text and the language it is written in, linked to the order. The workshop reads it before publication; once published, it appears on the product page and the home page, signed with your initial and dated by month, and in the page’s structured data. A few days after delivery, a single email invites you to leave one; it is not repeated. Your email address is never published. You can ask us to remove it at any time at the address above.

Your basket

an identifier held in a cookie named “cart”, linking your browser to the basket kept on our server. Without it the basket does not survive a page change.

Your design in progress

when you design a poster without ordering it, your browser keeps what you entered — place, date, wording, size — in its local storage, on your device, for seven days, so that the page can offer to let you pick it up again on your next visit. Nothing is sent to our server unless you choose to continue it. “Start again” deletes it, and it is also deleted when the poster is added to the basket.

Your recent searches

the search screen keeps the last five things you searched for in your browser’s local storage, on your device, so that it can offer them again on your next visit. They never leave your device. What you type is sent to our server only to answer you — like any page requested, it appears in the server logs — and is not linked to you (see “What you search for”). “Clear all” deletes them.

What you search for

when you run a search, the text of the query is recorded on our server with a simple counter per day: no IP address, no identifier, no link to a person or an order. It is used to see what visitors look for and do not find, so that search can be improved. It is deleted after six months. Please do not type personal data into it; a query containing an email address or a long number is not recorded, nor are those from robots.

Your Strava account

if you choose to connect your Strava account on a route or marathon poster, Strava — on its own site and with your consent — gives us permission to read your activities. We read the list of your last fifty activities and the track of the one you pick; only that track, simplified, and its figures (distance, time, elevation gain — and, on a marathon poster, the elevation profile) go into your order. The permission is stored encrypted in a cookie in your browser named “strava_session”, for an hour at most, and is never saved on our server; a second cookie, “strava_etat”, lasts only for the round trip to Strava. We revoke the permission as soon as the track is imported, “Disconnect Strava” deletes both cookies straight away, and you can withdraw access at any time from your Strava account settings. Your Strava data is shown to no one but you.

Where you came from

if you arrive through a tagged link — a pin, a post — we add one to that day’s counter for the network’s name (“pinterest”), without storing anything in your browser and with no link to your order: one number per day and per network, tied to no one. The click identifier the platform adds to the address is never kept. During a visit that arrived through such a link, the time spent on screen is also counted: a seconds counter kept in the browser tab — not in a cookie —, sent with no page address and no identifier, and added up per day and per network. This seconds counter stays silent if your browser signals “Do Not Track” or “Global Privacy Control”.

Your messages to us

the content of what you send and our reply, to provide customer service.

Server logs

IP address, date, page requested, browser type. Kept for security and for the proper running of the site.

What we do not do

• no advertising tracker, no social network pixel, no profiling;
• a single cookie, ours, the basket one — two more, for an hour at most, if you connect your Strava account — and none set by a third party;
• the “share” buttons are plain links: nothing is loaded from Pinterest, Facebook or WhatsApp until you click;
• videos are links to YouTube: nothing is loaded from them until you press play; from then on, the video is served by YouTube (Google) in privacy-enhanced mode, which receives your IP address and applies its own rules;
• no font or image loaded from another domain: everything is served by us;
• no selling, sharing or renting of your data.

Audience measurement, without cookies

We measure traffic with Snorklee, a European service built to count visits without cookies and without a visitor identifier. It tells us which pages are read and where visitors come from — nothing more. It does not follow you from one site to another.

What is sent

the page address, without anything after the “?”; the domain name you arrive from, never the full address; how far down the page you scrolled; how long you stayed; and the fact — never the content — of a form submission, a download or a click to another site; and, on a product page, the fact of having started to personalise, opened the review screen and added to the cart — never what you typed.

What is not kept

neither your IP address nor your browser string. They are used for the length of the request to derive a country, a browser family and a device type, then discarded: they never enter the database.

What is never measured

pages carrying a private link — your order, your invoice, your files to download — and the administration. They are not counted at all.

How to refuse

your browser’s “Do Not Track” or “Global Privacy Control” signal is enough: measurement stops on its own, with nothing to click.

Who processes data for us

We use processors, strictly for the purposes above:

Clever Cloud SAS

hosting of the site and the database. A French company, 4 rue Voltaire, 44000 Nantes.

Mollie B.V.

payment processing, in the Netherlands. Your card details are entered on their systems and never pass through ours.

La Poste

carrying parcels: name and delivery address.

OpenStreetMap Foundation

looking up a place in the poster editor. The address you type is sent to their geocoding service from our server, never from your browser, and with nothing that identifies you.

World Weather Online and NASA POWER

the weather of a past day, for the “What was the weather like?” poster: the coordinates of the place you searched for and the date are sent to their services from our server, never from your browser, and with nothing that identifies you. World Weather Online is run by Zoomash Ltd, a British company; NASA POWER is a NASA service, in the United States.

Snorklee

audience measurement, without cookies and without a visitor identifier. European service, hosted in the Union.

Brevo

sending order and shipping e-mails, and messages from the contact form: your e-mail address and the content of the message. French company.

Boxtal

buying shipping labels: name, delivery address and phone, passed on to the carrier. French company.

Google

creating the image of the posters made from your photograph (watercolour portraits, 3D animated movie portraits, single-line portraits, retro motorbike posters, vehicle posters, street art posters, “best friends” posters): the photograph you upload is sent to their artificial intelligence service from our server, never from your browser, with the sole instruction to transform it. The same applies to the cap on the “Skipper’s Rules” poster. Google LLC, a US company; its servers may be located outside the European Union.

How long

Orders and invoices

ten years, as accounting and tax law requires.

Unconfirmed basket

thirty days, then deleted.

Customer service messages

three years after the last exchange.

Photographs uploaded for a print

thirty days after the order ships — or after payment, for a print-ready file — then deleted. A photograph uploaded that never leads to an order is deleted after the same thirty days. The image made from it (portrait or poster) is deleted along with it.

Server logs

twelve months at most.

Where the data is

The site, the database and the orders are hosted by Clever Cloud, in Europe. Our processors are established in the European Union. No data is transferred outside the European Union.

Your rights

You have the right of access, rectification, erasure, restriction, objection and portability over your data, and the right to give instructions on what happens to it after your death.

To exercise them, write to contact@posterdeblonde.com. We answer within one month. If our answer does not satisfy you, you may complain to the French data protection authority, the CNIL: www.cnil.fr.

Changes

This policy may change, in particular when a new payment or delivery method goes live. The update date at the top of the page is the one that counts.