Privacy policy

Last updated: 8 October 2026

1. Data controller

Sara Mammola. Contact: email saramammola00@gmail.com, phone and WhatsApp +39 331 950 0718.

2. What data we process

• Order data: name, email, phone number and shipping address, which you enter at checkout.
• Payment data: processed directly by Stripe; we never see your card details.
• Preferences you write when you request a made-to-order piece.
• Messages you send us on WhatsApp, by email or by phone.
• Technical browsing data (for example your IP address), recorded by the servers for security.

3. Why we process it

• To handle your order, shipping and customer care: performance of a contract (Art. 6(1)(b) GDPR).
• For tax and accounting obligations: legal obligation (Art. 6(1)(c) GDPR).
• For website security and fraud prevention: legitimate interest (Art. 6(1)(f) GDPR).

We do not use your data for advertising, profiling or newsletters.

4. Who we share it with

Only with the providers needed to get your piece to you: Stripe (payments), Supabase (order records), Cloudflare (website hosting), the courier for delivery, WhatsApp if you choose to message us there, and the tax advisor. Some of these providers may process data outside the European Union, with the safeguards required by the GDPR (adequacy decision or standard contractual clauses).

5. How long we keep it

Order data is kept for 10 years, as required by law for accounting records. Other data is kept only for as long as needed to answer your requests.

6. Your rights

At any time you can ask to access, correct or delete your data, to restrict its use, to object to its processing and to receive it in a readable format, by writing to saramammola00@gmail.com. You can also lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (garanteprivacy.it).