Privacy policy

Data controller

The controller of your data is the seller identified below (see also the legal notice).

Company name

Mathys Thévenot AATMD

Legal form

EI

Share capital

TO BE COMPLETED

Registered office

8 rue émile masson

Registration (SIREN, RCS or RNE)

TO BE COMPLETED

EU VAT number

TVA non applicable, art. 293 B du CGI

Email

contact@orikind.com

Phone

0767257521

What we collect

Your name, email, delivery address and phone number when you order; your order history; and, if you sign in with Google or GitHub, the identifier, name and profile photo those services share. For a custom animal, the photo you send us. For the newsletter, your email. Card details are handled by Stripe and never reach our servers.

Purposes and legal bases

Preparing, delivering and tracking your orders, giving you access to your files, modelling your custom animal: performance of the contract.

Keeping accounts and invoices: legal obligation.

Securing the site and preventing fraud (rate limiting, bot checks): legitimate interest.

Sending the newsletter: your consent, collected by double opt-in (an email asks you to confirm your subscription). You can withdraw it at any time with the unsubscribe link in every email, without affecting emails already sent.

We do not sell or rent your data and we do no targeted advertising.

Cookies

A session cookie to stay signed in, a language cookie, a cookie remembering that you closed the announcement bar, and your browser's local storage to remember your cart. A “pp_src” cookie (30 days) only keeps where your visit came from (a link's utm parameters, or the name of the referring site): it is used solely to count our sales per source (Instagram, Pinterest…), with no identifier and no tracking on other sites. No advertising cookies.

Audience measurement

We measure visits to the site with Umami, open-source software installed on our own server: no measurement data is passed to a third party. It sets no cookie and writes nothing in your browser. Your IP address is not recorded: together with your browser, it is only used to compute an anonymous visit identifier that changes every month, and to derive your country and city.

We only draw aggregate statistics from it: pages viewed, the site or network you came from (Instagram, Google…) and the utm parameters of links, device type, browser, language, country, and a few actions on the site (add to cart, checkout started, purchase and its amount, newsletter sign-up, language change, click to another site). E-mail addresses, order numbers, tokens and download links are removed from page addresses before anything is sent. These measurements are used solely to improve the site: they are not combined with any other processing nor used to follow you on other sites, and are deleted after 25 months.

This processing is based on our legitimate interest and, in line with the French data protection authority's (CNIL) guidance on audience measurement, it is exempt from consent. You can object by turning on your browser's Do Not Track option or Global Privacy Control: the tool is then not loaded.

Retention periods

Customer account: up to 3 years after your last activity, then deleted or anonymised.

Orders and invoices: 10 years (accounting obligation).

Newsletter: until you unsubscribe; an unconfirmed sign-up is deleted.

Photos sent for a custom animal: deleted 90 days after delivery.

You can ask us to delete your account at any time.

Recipients and transfers outside the European Union

Stripe (payments), Cloudflare (anti-bot check), our hosting provider, the transactional email service and the carriers (Colissimo, Mondial Relay) for delivery.

Some providers are based in the United States or may process data there: Stripe (payments), Cloudflare (Turnstile, the anti-bot check on the checkout and sign-up forms, which processes your IP address and technical information about your browser) and, if you choose to sign in with them, Google and GitHub. These transfers rely on the EU–US Data Privacy Framework for certified companies or, failing that, the European Commission's standard contractual clauses.

Your rights

Under the GDPR you may access, correct, export or erase your data, restrict or object to its processing, and withdraw your consent at any time. Write to the email address given above. If you believe your rights are not respected, you may lodge a complaint with the CNIL (www.cnil.fr).