Privacy policy

Controller

LEGAL COMPANY NAME], [Str. Exemplu nr. 1, Timișoara, jud. Timiș, România], [hello@one-frame.eu.

What we process and why

• Orders — name, email, phone, delivery/billing address, items, payment status. Needed to perform the contract and for accounting (kept 10 years as required by Romanian fiscal law).
• Account — email, name (from Google or what you give us), favourites, notification preferences. Legal basis: contract / your consent. Kept until you delete your account.
• Payments — processed by Stripe; we never see your full card number. Stripe is an independent controller for fraud prevention.
• Newsletter — email and language, only after you confirm (double opt-in). Legal basis: consent; unsubscribe any time with the link in every email.
• Push notifications — a browser subscription token if you opt in; revoke in your browser or profile.
• Technical — server logs and the cookies described in our Cookie policy.

Who receives data

Hosting (Vercel, EU region), database (Supabase, EU), payments (Stripe), email delivery (Resend), couriers (FAN Courier, Sameday, international partners) — each only what's needed for their job.

Your rights

Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent — email hello@one-frame.eu. You can also complain to ANSPDCP (dataprotection.ro).

Security

TLS everywhere, row-level security on the database, least-privilege keys. No system is perfect; tell us if you spot something.