Privacy Policy

Data controller

Sunny Sarapia is the data controller for your personal data when you use this store. You can contact us via the Contact page.

Data we collect

• Account: email and password (stored securely) to identify you and allow access to your account and checkout.
• Orders: name, shipping address, city, postal code, country and phone, needed to fulfil your order and send confirmation by email.
• Contact form: name, email, subject and message, so we can respond to your enquiry.
• Cookies: we use essential cookies (session, language, cookie preference). See our Cookie Policy.

Purpose and legal basis

We use your data to: manage your account and orders (performance of contract), respond to the contact form (consent or legitimate interest), comply with legal obligations and improve the site. The legal basis is contract performance, consent where applicable and legitimate interest.

Retention

We keep account and order data while your account is active or as needed for claims, billing or legal obligations. Contact form data is kept as long as needed to respond and resolve the enquiry.

Your rights

You can request access, rectification, erasure, restriction of processing, data portability and to object. You may also lodge a complaint with a supervisory authority (e.g. in Spain, the AEPD). To exercise your rights, contact us via the Contact page.

Recipients and transfers

We use Supabase (hosting and database), Stripe (card payments) and Resend (email delivery). Some of these may process data outside the EEA. Appropriate safeguards (e.g. standard contractual clauses) apply as required by law.

Updates

We may update this policy. The last update date will be shown at the end. We recommend checking it periodically.

Last updated: February 2025.