Privacy policy

Data controller

The data controller is SBCA CONSULTING, operator of the ARTIFYME website, a French SAS with share capital of €1,000, registered with the Versailles Trade and Companies Register under SIREN 939 852 117, head office SIRET 939 852 117 00018, registered office: 2 Mail des Tilleuls, 78180 Montigny-le-Bretonneux, France. Contact us through the contact form or by email at contact@artifyme.fr.

Data processed

ArtifyMe processes information required for orders and support: identity, email, addresses, cart content, payment handled by Shopify, messages, submitted photos, previews, production files, customization choices, technical logs and pseudonymous security or attribution identifiers. With your consent, browsing and advertising data may also be processed: pages and products viewed, cart additions, checkout steps, purchases, value, currency, product and campaign identifiers, and hashed contact details when advanced matching is enabled. Photos and customization files are not intended for advertising platforms; their exclusion from data flows must be verified before launch. Browser-cached drafts and previews remain on the device until deletion or browser data is cleared.

Purposes

Performance of the contract: product customization, creation of previews and production files, payment, order management, production, shipping and customer service.

Legal obligations: accounting, invoicing, tax, statutory guarantees and responses to requests from authorized public bodies.

ArtifyMe's legitimate interests: site security, fraud prevention, incident diagnosis, service improvement and establishment, exercise or defence of legal claims, while ensuring that these interests do not disproportionately affect individuals' rights.

Consent: non-essential analytics, campaign attribution and measurement, advertising personalization and direct marketing where required by law; consent can be refused or withdrawn at any time as easily as it was given.

Required and optional information

Fields marked as required are necessary to process the request or perform the order. Without the required contact details, address and order information, ArtifyMe cannot sell or deliver the product. A photo is required to create a personalized photo product. Other information is optional.

Recipients and partners

Within their respective duties, data can be accessed by authorized ArtifyMe staff and by Shopify, Printful, OpenAI, Brevo, OVHcloud, Telegram, payment providers and carriers, as well as authorized public bodies. If advertising tools are enabled, and with your consent, Meta Platforms Ireland Limited and TikTok Technology Limited may receive browsing, cart, checkout and purchase events, values, currencies and product identifiers, plus hashed name, location, email or phone details for advanced matching. Depending on the service and purpose, these partners act as processors, joint controllers or independent controllers under their own terms. ArtifyMe configures integrations to exclude photos, previews, free-form text and customization files, then audits data flows before launch. ArtifyMe does not sell personal data.

Retention

Data required to manage orders is retained for the duration of the commercial relationship. The opaque attribution identifier attached to a cart can follow the order in Shopify; after the journey logs are deleted, it can no longer be used to retrieve the corresponding campaign parameters. Invoices and accounting records are archived for ten years. Data used for marketing is retained during the commercial relationship and then for three years from the last purchase or last active contact.

In active storage, a daily cleanup deletes contact attachments older than thirty days, private source photos whose last modification was more than sixty days ago, consented first-party customization-journey logs and their UTM parameters as soon as they exceed ninety days and, within no more than three calendar days, the pseudonymous identifiers used for the daily anonymous AI-transformation quota. A copy deleted from active storage may remain in a rotating backup for up to fourteen additional days.

Messages, previews, final production files, metadata and technical logs are retained according to their usefulness for manufacturing, quality control, after-sales service, reprints, security and the establishment, exercise or defence of legal claims. Their cleanup schedule is being formalized; a deletion request can be exercised where provided by law.

Payment data is handled by Shopify and its payment providers; ArtifyMe does not retain full payment-card numbers.

Transfers outside the European Economic Area

Some providers may process data outside the European Economic Area. Shopify's transfers to Shopify Inc. in Canada rely on the applicable adequacy decision. Where another transfer is made to a country without an adequacy decision, it must be covered by the European Commission's approved Standard Contractual Clauses or another safeguard recognized by law. Information about applicable destinations and safeguards can be requested through the contact form.

Your rights

Subject to the conditions provided by law, you have rights of access, correction, erasure, restriction, objection and data portability. You can withdraw consent at any time without affecting earlier processing. ArtifyMe does not make decisions producing legal effects based solely on automated processing. To exercise your rights, use the contact form or email contact@artifyme.fr. Proof of identity may be requested only where there is reasonable doubt. You can also lodge a complaint with the French data protection authority, the CNIL.

Last updated: August 26, 2026.