Privacy Policy

This explains what Atelier Surface Couture collects, why, and what you can ask us to do with it. It covers this website and the orders placed through it.

What we collect

When you create an account

Your name, email address and phone number, and a password that is stored only as a scrypt hash — we cannot read it, and neither could anyone who obtained a copy of our database. If you sign in with Google we store the account identifier Google gives us instead of a password.

When you place an order

Your name, email, phone number and delivery address, along with what you ordered, the wall measurements you entered, the amount charged and the order's status history. We keep this because it is the order — we cannot deliver, invoice or refund without it.

We never see or store your card details. Payment happens inside Razorpay's own window; we receive only a payment reference and whether it succeeded.

When you contact us, review a design, or ask for a refund

The message, review or request you wrote, with the name and email you gave. A review shows the name you chose publicly; nothing else from your account is shown alongside it.

When you subscribe to the newsletter

Your email address, and nothing else.

When you use the Live Studio

Your room photo stays on your device. The Studio composes the preview in your browser. If you ask it to detect the wall for you, the photo is sent to our own scanner, used to work out where the wall is, and not retained afterwards. We do not publish, share or train anything on your photos.

Cookies

Only the ones that make the site work: a sign-in session cookie, and an admin session cookie for staff. Both are httpOnly and same-site. Your shopping bag and saved designs are kept in your browser's own storage, not on our servers.

We run one advertising tag — Google Ads — and only if you agree to it first. It tells Google that a visit happened, so we can measure whether an advert we paid for brought you here and show our own papers to people who have already looked at them. It sets Google advertising cookies and shares your IP address and the page you are on with Google.

We ask before any of that runs. Until you accept, the tag is not loaded at all — no request is made to Google and no advertising cookie is set. Declining, or simply ignoring the question, leaves it off. The shop behaves identically either way; nothing is withheld and no feature is degraded.

We run no analytics product — no Google Analytics, no Meta pixel — and nothing profiles what you buy. Browser “do not track” settings, an ad blocker, or Google's own Ads Settings stop it as well.

Why we are allowed to hold it

• To perform our contract with you — your account, your orders, delivery, refunds and support.
• Our legitimate interest — keeping the site secure, preventing fraudulent orders, and rate-limiting sign-in attempts.
• Your consent — the newsletter, and only the newsletter. You can withdraw it at any time and we act on it.
• Legal obligation — tax and accounting records for completed orders.

Who else sees it

We do not sell your data, and we do not share it for anyone else's marketing. We use:

• Razorpay — to take payment and issue refunds. They receive your name, email, phone and the amount, and are bound by their own privacy policy.
• Resend — to send order confirmations, fulfilment updates and password resets. They handle your email address and the contents of those emails.
• Google — the advertising tag described above sends your IP address and the page you are viewing on every visit. Additionally, your Google account identifier if you choose to sign in with Google.
• Our delivery partner — the name, address and phone number needed to bring your order to you.

We may also disclose information where the law requires it. Our servers are hosted in the European Union; orders are delivered in Bangalore, India.

How long we keep it

• Orders — retained while required for tax and accounting.
• Account details — until you ask us to delete the account.
• Sign-in sessions — expire on their own, and immediately when you sign out.
• Password reset links — one hour, single use.
• Newsletter — until you unsubscribe.
• Messages and refund requests — while the matter is open, and for a reasonable period after.

Your rights

You can ask us to:

• Tell you what we hold about you, and give you a copy.
• Correct anything wrong — you can edit your name and password in your account yourself.
• Delete your account and personal data, except records we must keep for tax.
• Stop sending you the newsletter.

Ask through the contact page from the email address on the account. We will respond within 30 days.

Keeping it safe

The site is served over HTTPS. Passwords are hashed with scrypt and a per-password salt. Session tokens are stored only as hashes, so a copy of our database would not let anyone sign in as you. Card details never touch our servers. No system is perfectly secure, but if a breach ever affected your data we would tell you.

Children

This shop is not intended for children under 18, and we do not knowingly collect their data.

Changes

If this policy changes we will update the date at the top of this page. Material changes affecting how we use data you have already given us will be told to you directly.

Contact

Any question about this policy, or any request about your data, goes through the contact page.