Your personal data
We use the information necessary for your account, your orders and your conversations with us.
On this page
Data controller
ARTJOURNEYAI, 11 allée Roger Salengro, 34800 Clermont-l’Hérault, France. For a question or request about your data: contact@proxycardstock.com.
What we use and why
- Account: name, email and authentication information, to sign you in and retrieve your purchases. If you choose Google, Google sends us the information needed for that sign-in.
- Order: cart contents, delivery address, contact details, payment amount and reference, to fulfil and track your order.
- Contact: your contact details and message, so we can reply.
- Security: technical information and logs needed to protect the site and prevent abuse. The IP address and browser are kept with your sign-in session; a technical guest account with a generated placeholder email address is created when you first add to the cart, so the cart can be retrieved.
- Orders placed on Etsy: Etsy sends us your name and delivery address so we can ship your parcel; your email address reaches us through our shipping provider for delivery tracking.
- Email offers: our promotional campaigns, newsletter, welcome messages and abandoned-cart reminders require your explicit, current newsletter consent. Buying on this site or on Etsy without subscribing does not currently put you in our marketing audience. An Etsy delivery email address is not used for marketing without a separate subscription. Every promotional message has an unsubscribe link; you may also withdraw consent or object by writing to us. Our new campaign emails have no individual open pixel or click tracking, and old tracking links no longer record opens or clicks.
- Proxy Studio workshop: without an account, your projects and images stay in your browser. With an account, the projects and images you save are stored on our servers until you delete them; a shared project is visible to anyone who has the link.
- Paper advisor: the messages you write to Proxy, the AI paper advisor, and its answers are recorded for 12 months to improve the advice and to follow what visitors ask. Email addresses, phone numbers and links are masked before storage; no IP address or account is attached. The message, the printer you chose and your clicked answers are processed by Google (Gemini) to produce the answer, and the printer model, or the paper characteristics the advisor needs, may be searched on the web through Google Search, used by Gemini, or through Exa (the search query never contains your contact details). Do not give private information in this chat.
- Replies to your messages: we may use an artificial intelligence tool to prepare a draft reply from your message and your order; every reply is reviewed and sent by us.
This processing is based on performance of a contract or pre-contractual measures, our legal obligations and our legitimate interest in securing the service. Required fields are identified in the forms.
Payment and service providers
Bank card details are entered on Stripe. Our application retains payment references and amounts, not your full card number or security code. Vercel, Supabase and Hostinger provide the application hosting, database and email services respectively. Sendcloud and the carriers (Mondial Relay, Chronopost, Colissimo and their partners) receive the name, address, email and phone number needed to deliver and track your order. The pickup point map shown at checkout loads OpenStreetMap map tiles; the map server receives connection information, including the IP address. Google is involved for Google sign-in if you choose it and, through its Gemini service, for preparing draft replies from the message, conversation context and relevant order information.
Some providers operate outside the European Economic Area. Their published information describes processing and transfer arrangements; it does not by itself prove which agreement applies to our account: Vercel, Supabase, Stripe and Hostinger, Sendcloud, Google, OpenStreetMap.
AI Studio
To supply the AI Studio, bill credits, prevent abuse and follow costs, we process: the image you supply, the image generated, the sharpness you chose, the history of your images and of your credits (purchases, bonuses, loyalty level, expiry), the technical cost of each image, and the acceptance of the AI Studio terms with its date and version. The image you supply and the instruction that goes with it are sent to OpenAI, whose service may process data outside the European Economic Area, to create the result. Do not supply an image that identifies a person without their consent. Generated images are kept in your library as long as your account exists, up to 5,000 images; you can delete them at any time, and may request erasure through our contact address. Credit pack payments go through Stripe, like orders. To prevent abuse of the offers reserved for new customers, we keep a keyed fingerprint (HMAC) of your email address, including after account deletion. It permits matching an address to benefits already granted: this is pseudonymised personal data, not anonymous data, used on the basis of our legitimate interest in preventing repeated claims. OpenAI publishes its data processing addendum; the agreement applicable to our account, transfer safeguards and provider retention settings still require verification. We do not claim that a specific agreement has been signed or that data is processed exclusively in the EU.
Retention
Our retention policy sets these objectives: account data for the service relationship; accounting documents for ten years; withdrawal case files for five years where necessary to establish or defend rights; messages for the time needed to handle the request and any related dispute. Marketing audiences are limited to newsletter subscribers whose account was created less than three years ago; withdrawal of consent or an objection stops promotional use. Unsubscribe and consent records are retained separately to respect your choice and establish its history. These objectives do not currently trigger an automatic purge of all account, order, message or historical campaign records. Erasure requests are handled individually; documents subject to a legal retention obligation remain restricted to that purpose.
Your rights
You may request access, rectification, erasure, restriction or portability of your data and object to processing based on legitimate interest. You may ask for your account to be deleted in the same way. You may withdraw consent at any time without affecting earlier lawful processing; objection to direct marketing stops it. Write to our contact email, preferably from the address concerned; holding an account is not required. We request additional identity information only if reasonably necessary. Under Article 12 GDPR, we respond within one month of receipt; if complexity or the number of requests requires up to two additional months, we inform you and explain the reason within the first month. You may also lodge a complaint with the CNIL.
Make a request about my data