Privacy
policy.

When you place an order, create an account or contact us, we collect your name, email, shipping address, billing address, and any messages you send us. Payment details are handled by our payment processor and never stored on our servers.

We also collect basic technical information about your visit (device, browser, pages viewed) to help us improve the site.

• To process and ship your orders.
• To communicate with you about your orders and our services.
• To send you marketing communications, only if you have opted in.
• To improve our website, products and customer experience.
• To comply with legal obligations.

We rely on a small number of named service providers to operate the store. Each processes only the data needed for its role:

• Shopify — product catalogue, inventory and order fulfilment records.
• Whop — payment processing and checkout as merchant of record. Card data is handled entirely by Whop.
• Supabase — our database and authentication layer, storing account and order records.

We do not currently run any third-party analytics or advertising tracking on this site. We do not sell your personal information.

We keep order and transaction records for as long as needed to fulfil the order and to meet tax, accounting and legal obligations — typically seven years. Account data is kept while your account remains open and deleted within 30 days of a verified deletion request, unless we are required to retain it. Contact-form messages are kept for up to 24 months, and marketing contacts until you unsubscribe.

Beyond the processors named above, we share information only with shipping carriers needed to deliver your order, and where required by law. We do not sell your personal information.

You have the right to access, correct or delete your personal information, to object to or restrict processing, and to data portability. To exercise these rights, write to privacy@atelierveylora.com.

EU / UK visitors (GDPR). If you are in the European Economic Area or the United Kingdom, you have the rights above under the GDPR, plus the right to withdraw consent at any time and to lodge a complaint with your local data protection authority. Our lawful bases are contract performance (orders), legitimate interests (site security and improvement), consent (marketing), and legal obligation (tax records).

California residents (CCPA/CPRA). You have the right to know what personal information we collect and how it is used and shared, to request deletion or correction, to opt out of any sale or sharing of personal information (we do not sell or share it), to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. Requests can be sent to the address above.

This site is not directed at children. We do not knowingly collect personal information from anyone under 16 years of age. If you believe a child has provided us with personal information, contact us and we will delete it promptly.

We use essential cookies to keep your basket, session and sign-in working. We do not currently use advertising or third-party analytics cookies. You can control cookies through your browser settings.