Privacy

This notice explains what Maison Maxille collects, why, and what we do not do. It is written to be read, not to be survived.

What we hold

• Your account — email address and a one-way cryptographic hash of your password. We never store the password itself and cannot recover it.
• Details you choose to save — name, telephone, shipping address. These are encrypted at rest with AES-256-GCM; the key is stored separately from the database, so a copy of the database alone reveals nothing.
• Orders — the pieces, sizes, amounts, reference and status, kept for accounting and for your order history.

What we never hold

Card numbers never reach our servers. Payment is handled end to end by Stripe, who are PCI-DSS certified; we receive only a confirmation that a payment succeeded.

Cookies

We set one strictly necessary cookie to keep you signed in and to hold your bag. It is httpOnly and same-site, and carries no advertising identifier. We do not use tracking or advertising cookies, and we do not sell or share data with brokers.

Your rights

Under the GDPR you may request a copy of your data, correct it, or have it erased. Deleting your account removes your personal data permanently; orders are retained in anonymous form because tax law requires it. Write to atelier@maisonmaxille.com and we will act within 30 days.

Retention

Account data is kept while your account exists. Order records are kept for the statutory accounting period. Server logs are kept briefly for security and then discarded.

Controller

The data controller is Maison Maxille, at the address below. For any question about this notice, or to complain, write to atelier@maisonmaxille.com. You also have the right to complain to your national data protection authority.