Only what we need. Here's all of it.

Who is responsible

The controller of your data is Peniel Keme Kitoko (Ateliroom), Kerselaarlaan 30, 2850 Boom, Belgium, KBO 1041.076.848. For anything in this policy: support@ateliroom.com.

What we collect, why, and on what legal basis

• Account: name, email, password (stored hashed), optional profile details. With Google sign-in: your name and email from Google. Basis: performing our contract with you.
• Orders and shipping: your address, phone number, order history, tracking numbers, delivery status. Delivery details (name, address, phone, parcel size) are shared with the shipping provider that creates the carrier label and tracks the parcel, and with the maker who ships it. Basis: performing the contract, and legal obligations (bookkeeping, consumer protection).
• Payments: handled by our payment providers (Stripe, and PayPal when active); we never see or store card numbers. We keep payment references and payout records. Basis: contract and legal obligations.
• Maker business data: seller status (private or professional), business number, payout account references, and, where EU tax rules (DAC7) require it, tax identification and sales figures we must report to the tax authorities. Basis: legal obligations.
• Messages: chats between buyers and makers, and messages with support, including photos you attach to a claim. Basis: performing the contract, and our legitimate interest in keeping the marketplace safe (automated flagging of suspicious messages, reviewed by humans).
• Activity: follows, saves, likes, drop reminders. They power your feed and alerts. Basis: performing the contract.
• Safety and moderation records: reports, moderation decisions and their reasons, and suspension history. Basis: legitimate interest and legal obligations (EU Digital Services Act).
• Usage statistics: cookieless, aggregated page analytics (Vercel Web Analytics) that cannot identify you, and our own log of what you do while signed in (signing up; the pieces and rooms you open, heart, share or click in a suggestion; what you search for; starting and completing a purchase), kept on our servers, never shared or sold, and used to make what we show you more relevant, to give makers overall numbers about their work (never who looked) and to find problems. When you are not signed in we only add to a count (“this piece was opened”) with nothing that identifies you: no cookie, no address, no profile. Basis: legitimate interest in understanding what works.
• Guest checkout: buying without creating an account still needs somewhere to keep your order, its delivery and any refund. We create a minimal account from the name and email you type at checkout, with no password and no marketing; you reach it through links we email you, and you can turn it into a normal account or ask us to delete it. Basis: performing the contract.
• Chat translation: only when you press Translate on a message, that message's text is sent from your browser to Google Translate. Nothing is translated unless you ask.

Who receives data

The processors that run the service: Supabase (database and file storage, EU region), Vercel (hosting), Stripe and PayPal (payments and payouts), Sendcloud and the carrier you choose at checkout (delivery labels and tracking: name, address, phone), Resend (email), Cloudflare (domain and email routing), Google (only if you sign in with Google), and TypeSafe AI (United States: automated checks of listings. It receives the text and details of a listing, the same words that are public on the piece's page, and nothing else: no names, contact details, addresses, payment or order data, and no messages). Some of these providers have US parent companies; where data leaves the EU, it travels under the EU's approved safeguards (standard contractual clauses or adequacy decisions). Beyond processors: tax authorities where DAC7 reporting requires it, and authorities where the law compels us. We never sell your data, and there are no advertising partners.

How long we keep it

• Your account: until you delete it.
• Order, invoice, and payout records: for as long as Belgian bookkeeping and tax law requires, even after account deletion.
• Chats: while the accounts involved exist, or as long as an open dispute needs them.
• Moderation and safety records: as long as needed to keep decisions accountable.
• Email logs: kept briefly for deliverability, then cleared.

Cookies

One essential cookie keeps you signed in; your browser's local storage remembers small preferences on your device. No advertising cookies, no third-party trackers, and our analytics are cookieless, which is why there is no cookie banner. Details on the cookies page.

Email

Transactional email (orders, shipping, refunds, security) is part of the service and can't be switched off while you have an account. Drop alerts and anything marketing-flavoured only go out with your consent, managed in settings or via the unsubscribe link in any such email.

Your rights

You can access, correct, export, and delete your data, restrict or object to processing, and withdraw any consent, without it costing anything. Export and deletion live directly in settings; for everything else, email support@ateliroom.com and we answer within a month. Deletion is processed within 30 days; records we must legally keep (orders, invoices, tax data) are kept but detached from your profile. If you believe we're handling your data wrongly, you can complain to the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be), though we'd appreciate the chance to fix it first.

No profiling

We make no automated decisions with legal or similar effects about you. Automated checks (our own rules, and for listings an AI classification service, see “Who receives data”) flag listings and messages for review and note what a listing is missing. They change nothing by themselves: a human makes every actual decision.