Home /
Privacy Policy
_Version of 15.09.2026 — DRAFT_
1. Controller
The controller of your personal data is [Company legal name], [Registered address], registration number [Registration number], e-mail: [Contact e-mail] (the "Controller", "we"). [If applicable: our EU representative / data protection contact is [name, e-mail].]
This policy explains how we process personal data of visitors and customers of american-creator.store (the "Shop") in accordance with the EU General Data Protection Regulation (GDPR) and, where applicable, US state privacy laws (e.g. the California Consumer Privacy Act).
2. What data we process and why
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Processing and delivering your order | name, e-mail, phone, delivery address, order contents, payment status (not card numbers) | Art. 6(1)(b) — contract | duration of the contract, then as required by accounting law ([7–10] years) |
| Customer account | name, e-mail, phone, password (hashed), saved addresses, order history | Art. 6(1)(b) — contract | until you delete the account, then [30] days |
| Customer support, returns, warranty claims | contact details, order data, correspondence | Art. 6(1)(b), 6(1)(c) | [3] years after the request is closed |
| Loyalty programme (when offered) | account data, points/cashback balance, order totals | Art. 6(1)(b) — programme rules | duration of membership |
| Transactional e-mails (order confirmation, shipping, password reset) | e-mail, order data | Art. 6(1)(b) | as the order data |
| Marketing e-mails | e-mail, name | Art. 6(1)(a) — consent, withdrawable at any time | until you unsubscribe |
| Contact and partnership forms | data you enter in the form | Art. 6(1)(f) — legitimate interest in answering your request | [1] year |
| Security, fraud prevention, technical logs | IP address, browser data, timestamps | Art. 6(1)(f) — legitimate interest | [12] months |
| Legal obligations (accounting, tax, consumer law) | invoices, order records | Art. 6(1)(c) | statutory period |
Providing the data marked as required at checkout is necessary to conclude and perform the contract; without it we cannot ship your order.
3. Recipients and processors
We share personal data only as needed with:
- Stripe (Stripe Payments Europe, Ltd. / Stripe, Inc.) — payment processing; card details are entered on Stripe's own form and are not received by us. Stripe's privacy policy: https://stripe.com/privacy
- FedEx (Federal Express Corporation and its affiliates) — delivery of parcels; receives name, address, phone and e-mail for delivery notifications and customs documents.
- E-mail delivery provider ([Resend / provider name]) — sending transactional and, with consent, marketing e-mails.
- Hosting and IT providers operating our servers and the Shop's software ([hosting provider, location]).
- Warehouse / fulfilment partners that pick and pack orders at our EU warehouse ([EU fulfilment partner]) and US warehouse ([US fulfilment partner]).
- Professional advisers and authorities (accountants, lawyers, tax and customs authorities) where required by law.
Processors act under data processing agreements and only on our instructions.
4. International transfers
Depending on your location, your data may be transferred to the United States or other countries outside the EU/EEA (for example to Stripe, FedEx or our US warehouse). Such transfers rely on the European Commission's adequacy decisions (including the EU–US Data Privacy Framework where the recipient is certified) or on Standard Contractual Clauses. You can request a copy of the safeguards at [Contact e-mail].
5. Cookies
The Shop uses only strictly necessary (functional) cookies and local storage — to keep your basket, your session and your preferences (e.g. currency). We do not use advertising or third-party analytics cookies. Because these cookies are necessary for the Shop to work, no consent banner is shown. You can delete them in your browser settings; the Shop may then not work correctly.
6. Your rights
Under the GDPR you have the right to:
- access your data and receive a copy;
- rectify inaccurate data;
- erase your data ("right to be forgotten"), subject to legal retention duties;
- restrict processing;
- data portability;
- object to processing based on legitimate interest and to direct marketing at any time;
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
- lodge a complaint with a supervisory authority — in particular in the EU member state of your habitual residence ([Supervisory authority of the Controller's country]).
Residents of California and other US states with privacy laws have the right to know, delete and correct personal information, and to opt out of the "sale" or "sharing" of personal information — we do not sell or share personal information for cross-context behavioural advertising.
To exercise your rights write to [Contact e-mail]. We answer within one month (extendable by two months for complex requests). We may ask you to verify your identity.
7. Security
We protect personal data with technical and organisational measures: encrypted connections (HTTPS), hashed passwords, access control, logging, and regular backups. Payment data is handled by Stripe, a PCI DSS Level 1 certified provider.
8. Children
The Shop is not intended for persons under 16. We do not knowingly collect data of children; if you believe a child has provided us data, contact us and we will delete it.
9. Changes
We may update this policy. The current version is always available at /legal/privacy; material changes are announced in the Shop or by e-mail to account holders.
10. Contact
[Company legal name], [Registered address], e-mail: [Contact e-mail].