Privacy policy

1. Data controller

The controller of your personal data is:

2. What data we collect

2.1 Data you provide

• Account data: name, email, password (hashed), phone (optional).
• Prescription data: sphere, cylinder, axis, PD, add power. Encrypted at rest, never shared with third parties.
• Order data: shipping address, billing address, payment confirmation token.
• Communication data: messages via our contact form, support tickets, fit-session notes.
• Reviews: ratings and review text you submit.

2.2 Data we collect automatically

• Technical: IP address, browser, device, operating system.
• Usage: pages visited, time on page, search queries.
• Location: approximate country / city, from IP.
• Referrer: the site that sent you to us.

2.3 Data from third parties

• Payment processors: transaction confirmations and fraud-prevention signals.
• Lens lab partner: grinding confirmation and shipping tracking.
• Address validation: from postal services.

3. Why we process your data

4. Legal basis

4.1 Performance of contract (Art. 6(1)(b))

Necessary to perform the sale, fulfil orders, manage your account, grind your prescription.

4.2 Consent (Art. 6(1)(a) and 9(2)(a))

When you explicitly opt in — e.g. The Letter, optional cookies, prescription storage.

4.3 Legitimate interest (Art. 6(1)(f))

Fraud prevention, site security, service improvement — balanced against your rights.

4.4 Legal obligation (Art. 6(1)(c))

Tax, accounting, EU consumer law.

5. Retention

• Order data: 10 years (tax and commercial law).
• Prescription data: until you delete your account, plus 30 days for backups. Encrypted at rest.
• Account data: until you delete your account, plus 30 days.
• Newsletter data: until you unsubscribe.
• Analytics: 26 months maximum.
• Server logs: 7 days.
• Support tickets: 3 years.

6. Your rights

Under GDPR you have the right to:

• Access (Art. 15): request a copy of your data.
• Rectification (Art. 16): correct inaccurate or incomplete data.
• Erasure (Art. 17): request deletion of your data, subject to legal retention obligations.
• Restriction (Art. 18): ask us to pause processing.
• Portability (Art. 20): receive your data in a machine-readable format.
• Object (Art. 21): object to legitimate-interest processing.
• Withdraw consent (Art. 7(3)): any time, without affecting prior processing.
• Lodge a complaint: with the CNIL (France) — 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.

To exercise any of these, write to privacy@irdae.com.

7. Cookies

We use cookies to keep your cart, remember preferences, and measure how the site is used. Types:

You can manage cookie preferences via the icon at the bottom-left, or in your browser settings.

8. Third parties

8.1 Payment processors

• Stripe (US) — card payments.
• PayPal (LU) — PayPal payments.
• Klarna (SE) — split payments.

8.2 Shipping partners

• DHL, UPS, Colissimo

8.3 Lens lab partner

• State-certified Annecy lens lab — receives your script and frame to grind. Bound by data-processing agreement.

8.4 Analytics & comms

• Plausible Analytics (privacy-friendly, cookie-less by default)
• Mailgun / Postmark for transactional email

8.5 International transfers

Some processors are outside the EEA. We use Standard Contractual Clauses or equivalent safeguards.

9. Security

• SSL/TLS in transit.
• Encrypted storage for prescription and payment tokens.
• Regular security audits.
• EU-based primary data centres.
• Role-based access for atelier staff.

10. Children

Our services are not aimed at children under 16. We do not knowingly collect data from anyone under 16. If we learn otherwise, we will delete the data without delay.

11. Changes

We may update this policy. Significant changes will be notified by email or a notice on the site.

12. Contact

For privacy questions: