Privacy Policy

1. Who processes your data

The fluffme.design website and brand process personal data necessary to receive and fulfil orders.

The data controller and seller is a professional income tax payer, UNP AE5363607.

2. Data we process

When placing an order, you may provide your name, email address, phone number, Telegram or Instagram contact, delivery address, and order details such as materials, size, colour, lining, hardware, embroidery text and parameters, and other selected options.

We also store the order status and information necessary to confirm and fulfil the order.

We do not collect payment-card details on the website. Payment is made by bank transfer. We do not ask you to provide full card details.

3. Purposes and legal bases

Application and order data are processed to prepare and confirm an order and to take steps at your request before entering into a contract.

After an order is confirmed, data are processed as necessary to perform the contract, including making the product, communicating about the order, arranging payment and delivery.

Data that must be retained under applicable accounting, tax or other mandatory rules are processed to comply with the relevant legal obligation.

Minimum technical information necessary to secure the website, prevent abuse, and establish, exercise or defend legal claims may be processed on the basis of legitimate interests where that legal basis applies.

Visit analytics is used to improve the website. Measurement using a cookie is based on your consent. The daily count of visits without cookies is based on legitimate interests: the data are anonymised and no cookies are stored in your browser.

Showing our ads and measuring them with the Meta Pixel is based on your consent (section 7).

Contact details obtained for an order are not used for subsequent direct marketing without a separate lawful basis and, where required, appropriate consent.

4. Recipients and service providers

To operate the website and fulfil orders, we may use:

Supabase — storage and technical processing of order data;
Resend — transactional email delivery;
Telegram — technical notifications relating to orders;
PostHog Inc. — visit analytics, with data stored on servers in the EU;
Meta Platforms Ireland Ltd. — showing and measuring our ads on Instagram, Threads and Facebook, only with your consent (section 7);
postal and courier services — information necessary for delivery;
banks and other service providers — to the extent necessary for payment, order fulfilment or compliance with legal obligations.

We do not sell personal data.

If you contact us through Telegram, Instagram or another social network, that platform also processes information under its own terms and privacy policy.

Some service providers may process data outside your country. Where applicable law requires specific safeguards for such transfers, those safeguards must be applied as required.

5. Retention

An application or order that is not paid and does not enter production is kept for no more than 30 days and is then removed from the working database.

Data relating to a completed order are retained for as long as necessary to fulfil it and afterwards for mandatory record-keeping periods and for the period necessary to establish, exercise or defend legal claims under applicable law.

Correspondence on third-party social networks may also be retained by the relevant platform under its own rules.

6. Your rights

Depending on applicable law, you may have rights to information and access, rectification, erasure, restriction of processing, data portability and objection to certain processing.

Where a particular processing activity is based on consent, consent may be withdrawn. Withdrawal does not affect processing already carried out lawfully or processing based on another lawful basis.

To exercise applicable rights, contact hello@fluffme.design. We may request reasonable information to verify your identity and will respond within the period required by applicable law.

You may also have the right to lodge a complaint with the competent data-protection authority.

7. Cookies, local storage and analytics

Technical cookies and your browser's local storage are used for functions necessary for the website to work: the delivery country and the website language are stored in cookies, the cart and saved designs in localStorage, and a draft product configuration in sessionStorage until the tab is closed.

To analyse traffic, the website uses PostHog (PostHog Inc., servers in the EU). It collects events about activity on the website: page views and how long a page stays open, constructor steps, adding a piece to the cart or to saved designs, how far the order form was filled in (field names only, never what was typed) and the delivery method chosen, placing an order and its number, as well as device and browser type, market and language. Your name, phone number, email address, messenger contact, delivery address and embroidery text are not sent to analytics.

With your consent, the website also uses the Meta Pixel (Meta Platforms Ireland Ltd.) to show our ads on Instagram, Threads and Facebook and to measure how they perform. Meta receives six events: a page view, opening the designer for a piece (which piece), saving a design (which piece), adding a piece to the cart (which piece), opening checkout (how many items) and a placed order (the total, the currency and which pieces), together with the page address, the address of the previous page, your IP address and browser details. The order number, your name, phone number, email address, messenger contact, delivery address and embroidery text are not sent to Meta. The pixel does not run on order pages, on the order confirmation page or on designs opened from a shared link. The pixel sets a first-party cookie, _fbp, to recognise returning visits, and, if you came from a link on Instagram, Threads or Facebook (an ad or a post), _fbc, which marks that click; both cookies expire after 90 days. Meta also processes this data under its own privacy policy. If you are signed in to Meta (Instagram, Threads, Facebook), Meta may link these events to your account using its own cookies.

For visitors from Belarus: this data is transferred to Meta outside the Republic of Belarus, including to countries that may not ensure an adequate level of protection of personal data subjects' rights. This cross-border transfer is made on the basis of your consent (Article 9 of Law of the Republic of Belarus No. 99-Z of 7 May 2021 "On Personal Data Protection").

On your first visit we ask for your consent, one for both analytics and advertising. Until you answer, neither analytics nor the Meta Pixel sends anything. With your consent, PostHog sets a first-party cookie and a localStorage entry to recognise returning visits; the cookie expires after 365 days. Without consent, no cookies are set and the Meta Pixel is not loaded; visits are counted using an irreversible hash of the IP address and browser with a salt that changes daily, which does not allow you to be identified. Your answer, consent or refusal, is remembered in your browser's localStorage.

The website has no separate control for changing your choice. To withdraw consent or change your answer, clear this website's data in your browser settings (cookies and local storage); the banner will then appear again. This also clears your cart and saved designs.

8. Security

We use reasonable technical and organisational measures to protect data against unauthorised access, alteration, disclosure, loss or destruction. No method of storage or transmission can guarantee absolute security.

9. Changes

This Policy may be updated when the website, order process, service providers or applicable requirements change. The current version is published on this page.

Last updated: 1 November 2026.