Privacy Policy

1. Who processes your data

The fluff.me website and brand process personal data necessary to receive and fulfil orders.

The identifying and registration details of the person acting as data controller and seller must be provided to the extent required by applicable law. This text does not imply that the absence of such details by itself satisfies any applicable disclosure obligation.

2. Data we process

When placing an order, you may provide your name, email address, phone number, Telegram or Instagram contact, delivery address, and order details such as materials, size, colour, lining, hardware, embroidery text and parameters, and other selected options.

We also store the order status and information necessary to confirm and fulfil the order.

We do not collect payment-card details on the website. Payment is made by bank transfer. We do not ask you to provide full card details.

3. Purposes and legal bases

Application and order data are processed to prepare and confirm an order and to take steps at your request before entering into a contract.

After an order is confirmed, data are processed as necessary to perform the contract, including making the product, communicating about the order, arranging payment and delivery.

Data that must be retained under applicable accounting, tax or other mandatory rules are processed to comply with the relevant legal obligation.

Minimum technical information necessary to secure the website, prevent abuse, and establish, exercise or defend legal claims may be processed on the basis of legitimate interests where that legal basis applies.

Contact details obtained for an order are not used for subsequent direct marketing without a separate lawful basis and, where required, appropriate consent.

4. Recipients and service providers

To operate the website and fulfil orders, we may use:

Supabase — storage and technical processing of order data;
Resend — transactional email delivery;
Telegram — technical notifications relating to orders;
postal and courier services — information necessary for delivery;
banks and other service providers — to the extent necessary for payment, order fulfilment or compliance with legal obligations.

We do not sell personal data.

If you contact us through Telegram, Instagram or another social network, that platform also processes information under its own terms and privacy policy.

Some service providers may process data outside your country. Where applicable law requires specific safeguards for such transfers, those safeguards must be applied as required.

5. Retention

An application or order that is not paid and does not enter production is kept for no more than 30 days and is then removed from the working database.

Data relating to a completed order are retained for as long as necessary to fulfil it and afterwards for mandatory record-keeping periods and for the period necessary to establish, exercise or defend legal claims under applicable law.

Correspondence on third-party social networks may also be retained by the relevant platform under its own rules.

6. Your rights

Depending on applicable law, you may have rights to information and access, rectification, erasure, restriction of processing, data portability and objection to certain processing.

Where a particular processing activity is based on consent, consent may be withdrawn. Withdrawal does not affect processing already carried out lawfully or processing based on another lawful basis.

To exercise applicable rights, contact hello@fluffme.design. We may request reasonable information to verify your identity and will respond within the period required by applicable law.

You may also have the right to lodge a complaint with the competent data-protection authority.

7. Cookies and local storage

The website does not use advertising or third-party analytics cookies unless expressly stated otherwise on the website.

Technical cookies may be used for functions necessary for operation and security. A draft product configuration may be stored locally in your browser, for example in localStorage, so that your selections are not lost.

Before optional analytics, advertising or other tracking technologies are introduced, this Policy and, where required, the consent mechanism will be updated.

8. Security

We use reasonable technical and organisational measures to protect data against unauthorised access, alteration, disclosure, loss or destruction. No method of storage or transmission can guarantee absolute security.

9. Changes

This Policy may be updated when the website, order process, service providers or applicable requirements change. The current version is published on this page.

Last updated: 20 September 2026.