Privacy policy

This page describes how Soulencia collects, uses and protects the personal data of the site's visitors and users.

Data controller

Jérémy Puteaux EI, sole trader (French entrepreneur individuel, micro-entreprise), 100 rue des hauts puits, 16590 Brie, France. contact@soulencia.com

Data collected

Depending on how you use the site, the following data may be collected:

• Date, time and place of birth: needed to calculate the self-discovery systems (Human Design, Astrology, Numerology, Dreamspell). No identity check is carried out on this information.
• Birth data of other people: if you order a portrait for someone else, you give us their first name and their birth information (the date and, depending on the portrait chosen, their full birth name, time and place of birth). Only the information that this portrait requires is requested.
• First name: used to personalize your result or your portrait.
• Full name (all your first names and your surname): requested when you place an order, needed to calculate your numerology.
• Email address: requested when you place an order, to send you the payment confirmation, your portrait and, if the order is not paid, a single reminder; to ask you once, two days after delivery, what you thought of your portrait; and to sign you in to your account (a sign-in link is sent to this address).
• Country of residence, and state if you reside in the United States: requested when you place an order, because the offers are reserved for people who reside in certain countries (see the terms of sale).
• Withdrawal statement: if you use the "Withdraw from contract here" function (reachable from the terms of sale), your first name, your last name, the order or invoice number you give and the email address to which the acknowledgement of receipt is sent, with the date and time of your statement.

Soulencia does not ask you to create an account or a password. Your account brings together the orders paid with your email address: you sign in to it through a sign-in link sent to this address. The data of an order is kept for the periods given in the "Retention period" section.

Purposes and legal basis

• Calculating and displaying your result: performance of a service requested by the user.
• Processing the order (payment, preparing and sending the portrait, payment confirmation), access to your account and to your portraits: performance of the sales contract.
• Portrait ordered for another person: the legitimate interest of Soulencia and of the buyer in preparing the portrait ordered (Article 6(1)(f) of the GDPR). This data is used to write this portrait and, in the buyer's account, to order another portrait for the same person without entering everything again.
• People from your paid orders offered in your account and on the "My order" page (first name and birth data, yours as well as those of your loved ones), to order another portrait without entering them again: the legitimate interest of Soulencia and of the buyer (Article 6(1)(f) of the GDPR). This reuse is compatible with the preparation of the portrait ordered (Article 6(4) of the GDPR): same data, same buyer, no new recipient. This information is shown only after you sign in to your account, is never modified and follows the retention period of the order.
• Feedback request after delivery: a single email, two days after your order is delivered, to find out what you thought of your portrait and to improve it. You answer if you wish, simply by replying to the email; nothing you write is published. Legal basis: the legitimate interest of Soulencia in improving its portraits (Article 6(1)(f) of the GDPR). To not receive this email, or to stop receiving it for your next orders, a word to contact@soulencia.com is enough, or a reply to the email itself. Your address is then added to an opt-out list, not in plain text but as a fingerprint (hash) calculated from it.
• Withdrawal statement: to process it, send you its acknowledgement of receipt and keep proof of it. Legal basis: compliance with a legal obligation (Article 6(1)(c) of the GDPR), namely the obligation to offer this function and to acknowledge receipt (Articles L221-21 and D221-5 of the French Consumer Code).
• Audience measurement: your consent, given through the cookie banner (Article 82 of the French Data Protection Act, loi Informatique et Libertés). You can withdraw it at any time (see the Cookies section).

Processors

Some data is passed to the following providers, strictly to the extent needed for their function:

• Stripe (payment): receives your email address and the payment details you enter on its payment page. The service is provided by Stripe Payments Europe, Limited, a company established in Ireland. Under its data processing agreement, personal data is transferred to Stripe, LLC, in the United States. These transfers rely on the mechanisms provided for in that same agreement, including the EU-U.S. Data Privacy Framework and the European Commission's standard contractual clauses.
• Resend (transactional email): sends the emails related to your order (payment confirmation, portrait ready, reminder for an unpaid order, feedback request after delivery), the sign-in link to your account and the acknowledgement of receipt of a withdrawal statement. The emails are sent from the European Union, in Ireland. The service is provided by Plus Five Five, Inc. (Resend), a company established in the United States. According to its documentation, Resend stores the data related to the emails (recipient address, message content, delivery logs) in the United States, whatever the sending region. These transfers are governed by the European Commission's standard contractual clauses, provided for in its data processing agreement, and by its participation in the EU-U.S. Data Privacy Framework.
• Netlify (hosting): the site's pages are served by Netlify's global network. Server-side processing (order form, payment, portrait generation, sign-in to your account, withdrawal statement) runs in the United States (Ohio): order data, including birth data, therefore passes through the United States. The service is provided by Netlify, Inc., a company established in the United States. Under its data processing agreement, these transfers rely on the EU-U.S. Data Privacy Framework and, should it cease to apply, on the European Commission's standard contractual clauses.
• Supabase (database): stores your orders, that is your first name, your email address, your country of residence (and your state if you reside in the United States), the first names and birth data of the people you order for (including yourself) and the generated portraits. It also stores the requests for a sign-in link to your account (email address and date of the request) and the sign-in sessions (email address, dates of creation, last visit and expiry), as well as withdrawal statements (first name, last name, number given, email address, date and time sent). The data is stored in the European Union, in Ireland. The service is provided by Supabase Pte. Ltd., a company established in Singapore. Under its data processing agreement, Supabase stores and primarily processes the data in the chosen region, except where the law or the provision of the service requires otherwise: in those cases, Supabase and its sub-processors may therefore access it from outside the European Economic Area. These transfers are governed by the European Commission's standard contractual clauses, provided for in that same agreement.
• Anthropic (portrait generation): receives the first name and birth data (date and, depending on the portrait, name, time and place) of the person the portrait is about, to write their portrait. The service is provided by Anthropic Ireland, Limited. The data is stored in the United States, and the portrait may be written in the United States or in other countries outside the European Economic Area. These transfers are governed by the European Commission's standard contractual clauses, provided for in Anthropic's data processing agreement.
• Pushover (internal notifications): sends the site owner a notification when a sale is made, when an order runs into a problem or when a withdrawal statement is sent. This notification contains your first name, never your birth data; it contains your last name, the number given and your email address only for a withdrawal statement, so that the statement can be processed even if it could not be recorded. The service is provided by Pushover, LLC, which processes data on servers located in the United States. Pushover states that, where required by law, it relies on appropriate legal mechanisms, such as standard contractual clauses, for transfers of data outside the European Economic Area.
• Google Analytics (audience measurement): measures traffic on the site, only if you have given your consent through the cookie banner. The data is processed by Google LLC (United States), which involves a transfer of data outside the European Union governed by Google's standard contractual clauses.

Soulencia does not share any data with a third-party CRM or for commercial purposes unrelated to the running of the site.

Retention period

• Free results shown on the site: the data entered (first name, date, time and place of birth) is not saved in a database. It is contained in the address of the result page, which recalculates it each time it is displayed.
• Paid orders: the order data (first name, full name, email address, birth data, generated portrait) is kept for 3 years after the purchase (counted from the confirmation email sent after your payment). During that time, your portrait remains available on the tracking page of your order. It is then erased automatically. Only the information needed for accounting remains: order number, dates, amount, currency, language, payment identifiers at Stripe, version of the terms of sale accepted and dates of your agreements.
• Tracking page of your order: it can be opened without a password by anyone who has its link. This link is a unique address that is hard to guess, which you receive by email: do not share it. The page remains available for 3 years after the purchase, then the order data and the portrait are erased.
• Unpaid orders: the data entered is erased in the same way 30 days after the order was created.
• Requests for a sign-in link to your account: the email address and the date of the request are deleted within 48 hours after the link expires (it is valid for 15 minutes), because deletion runs once a day. Sign-in sessions are deleted within 24 hours after they expire.
• Your replies to the feedback request after delivery: kept for 2 years at most from when they are received, then deleted. The fingerprint of your address on the opt-out list is kept for as long as your refusal applies.
• Withdrawal statements: kept for 5 years from when they are sent, the period during which legal action relating to the contract remains possible (Article 2224 of the French Civil Code), then deleted automatically.
• Accounting records: they are kept for ten years from the end of the financial year, as required by Article L123-22 of the French Commercial Code.

Cookies

The site uses:

• _ga and _ga_<identifier> (Google Analytics, audience measurement): set only if you accept them through the cookie banner. They last 13 months (390 days) from when they are set, without being extended on each visit. If you refuse or withdraw your consent, the site erases them. In Google Analytics, event data is kept for 2 months and user-level data for 14 months, a period reset with each new activity.
• Your choice about these cookies (accept or refuse): saved with its date in your browser (local storage), so as not to ask you again on each visit. It is kept for 6 months, then the banner asks you again.

You can change your choice at any time through the "Manage cookies" link at the bottom of the page.

If you choose a display currency with the currency selector, a cookie named soulencia_currency remembers that choice for one year. It contains only the chosen currency and is used only to show prices in that currency. We consider that it falls within the user interface personalization trackers that the CNIL exempts from consent (guidelines of 17 September 2020, which give the choice of language or of the presentation of a service as examples, where this personalization is an intrinsic and expected part of the service).

Until you choose a currency, prices are shown in the currency of the country from which you are viewing the site (US dollar, Canadian dollar, Swiss franc, otherwise euro). That country is derived from your IP address by our host, Netlify, when the page is sent to you. Only the country is used, solely to choose the currency: it is not recorded, not kept and not stored in a cookie. It does not decide whether you can buy, which depends on the country of residence you state and on the country of your card.

When you put together an order, two cookies keep it in memory: soulencia_cart contains the number of your current order, and soulencia_cart_count the number of portraits it contains, to show it in the menu. They last 30 days, a period that starts again each time the order is changed. Once the order is paid, they are erased as soon as you open its tracking page (the one you land on after payment) or the "My order" page; otherwise, they expire on their own after those 30 days. They fall within the trackers that the CNIL exempts from consent: trackers intended to keep in memory the content of a shopping cart on an online store.

If you sign in to your account, a cookie named soulencia_session keeps you signed in on this device. It contains only a random identifier, without your email address. It lasts 180 days, a period that starts again when you come back to your account (at most once a day), and it is erased when you sign out. It falls within the trackers that the CNIL exempts from consent: trackers intended for authentication with a service, including those intended to ensure the security of the authentication mechanism.

If your browser is set to a different language than the page, a banner offers you the same page in your language. If you close it, a cookie named soulencia_language_banner remembers this choice for one year so that it is not shown again. It contains only the value "closed". As it only serves to respect your display choice, it does not require your consent.

If someone has ordered a portrait about you

A person can order from Soulencia a portrait about you, for example to give it to you as a gift. In that case, the information about you does not come from you but from that person (the buyer). Soulencia has no means of contacting you: this section informs you, as permitted by Article 14(5)(b) of the GDPR.

• Data controller: the one given at the beginning of this page.
• Data: your first name and your birth information (the date and, depending on the portrait, your full birth name, your time and your place of birth), provided by the buyer.
• Purposes: writing the portrait ordered, and allowing the buyer, after signing in to their account, to order another portrait about you without entering your information again. Nothing else.
• Legal basis: the legitimate interest of Soulencia and of the buyer in preparing the portrait ordered (Article 6(1)(f) of the GDPR).
• Recipients and transfers: the same processors as for any order ("Processors" section).
• Retention period: the same as the order that concerns you ("Retention period" section).
• Your rights: access, rectification, erasure, restriction, and objection to this processing on grounds relating to your particular situation, by writing to the contact address in the "Your rights" section. You can also lodge a complaint with the CNIL.

Your rights

In accordance with the General Data Protection Regulation (GDPR), you have the right to access, rectify, erase and port your data, as well as the right to object to its processing. To exercise these rights, contact contact@soulencia.com. You can also lodge a complaint with the CNIL (the French data protection authority).