Privacy policy

1. Data controller

The data controller is Hairynov, a brand operated by Maxence Laurent (EI), whose contact details are given in the legal notice. Contact: contact@hairynov.com.

2. Data collected

• Identity and contact details: surname, first name, email, delivery address, phone number — provided when ordering or through the contact form.
• Order data: product, quantity, amount, date, order number.
• Payment data: processed exclusively by Stripe; no card data is kept by Hairynov.
• Internal audience measurement: pages viewed and traffic source, with a hashed (non-reversible) IP address, without advertising cookies.

3. Purposes and legal bases

• Performance of the contract (art. 6.1.b GDPR): processing the order, delivery, after-sales service, returns.
• Legal obligation (art. 6.1.c GDPR): keeping accounting records for 10 years.
• Legitimate interest (art. 6.1.f GDPR): anonymised audience measurement, fraud prevention.

4. Retention period

• Customer data: 3 years from the last contact.
• Order and invoicing data: 10 years (article L.123-22 of the French Commercial Code).
• Audience measurement: 13 months maximum.

5. Recipients and processors

• Stripe Payments Europe Ltd (Ireland) — payments.
• Vercel Inc. (United States) — hosting of the site and database; European Commission standard contractual clauses.
• Brevo (France) — transactional emails.
• CJ Dropshipping (supplier) and carriers — preparing and delivering the order (name, address, phone number).

6. Cookies

Only items strictly necessary for the site to work are used (basket stored on your device, visit attribution, your language and currency choices). No advertising or third-party measurement cookie is set.

7. Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection. To exercise them, write to contact@hairynov.com ; we reply within 30 days at most. You may also contact the CNIL, the French data protection authority (cnil.fr/fr/plaintes).