Privacy Policy

1. Who we are

TheBobbleShop is operated by DIGITEYEZER, a company with share capital of €32,860, registered office at 41 RUE DE LA DECOUVERTE CS 37621, 31670 LABEGE, France, registered under number 528343502, represented by Frédéric COURTEILLE. DIGITEYEZER is the data controller for the personal data described in this policy.

Questions about your data or this policy: fred@thebobbleshop.com.

2. What data we collect

3. Why we use it, and on what legal basis

• To create your account and your figurine (performance of the contract between you and us): your photos are used solely to compute the 3D file for your figurine.
• To process and ship your order (performance of the contract): billing/shipping details are passed to WooCommerce and, where relevant, to our delivery partners.
• To send you service emails (performance of the contract): "your figurine is ready", order confirmations, shipping updates. We do not send marketing emails.
• To keep the service secure and prevent abuse (legitimate interest): e.g. confirming you own a project before letting you view or edit it.
• To sign you in with Google (your consent, given when you click "Sign in with Google"): we verify your Google token directly with Google and receive your name and email back.

We never use your photos or personal data for advertising, and we never sell your data.

4. Who we share it with

We only share personal data where it's genuinely needed to run the service:

• Google (sign-in verification only — your Google token is checked directly against Google's servers; we never see your Google password).
• Our payment processor (via WooCommerce — e.g. Stripe and/or PayPal depending on the method you choose at checkout). Card details are entered directly with the processor; TheBobbleShop never handles or stores raw card numbers.
• Our hosting provider, located in the European Union, who stores the site's data on our behalf under a hosting agreement.
• Delivery carriers, limited to what's needed to ship your order (name and address).

We do not use any third-party analytics or advertising service on this site, and your photos are never sent to an external AI vendor — figurine computation runs on infrastructure we operate ourselves.

5. Where your data is processed

Your data is hosted and processed within the European Union. Where a recipient listed in Section 4 (e.g. Google) may process data outside the EU/EEA, that transfer relies on the safeguards required by GDPR (such as the EU-US Data Privacy Framework or Standard Contractual Clauses), as provided by that recipient.

6. How long we keep your data

• Figurine photos and 3D renders: deleted automatically 12 months after your order is completed (or 12 months after the figurine was created, if it was never ordered). Deleting your account earlier removes them sooner.
• Order and invoicing records: kept for the period required by French commercial and tax law, currently up to 10 years for accounting records — this is a legal retention obligation we can't shorten on request, even if you ask us to delete your account.
• Account data (name, email): kept for as long as your account is active, and deleted (outside of the accounting records above) if you ask us to close your account.

These figures reflect our current understanding of French retention rules and may be refined; see the Section 7 for how to ask us about your specific data.

7. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate data;
• Erasure ("right to be forgotten"), subject to our legal retention obligations (Section 6);
• Restrict or object to certain processing;
• Data portability — receive your data in a structured, machine-readable format;
• Lodge a complaint with the French data protection authority, the CNIL, if you believe your rights aren't being respected.

To exercise any of these rights, email fred@thebobbleshop.com. We'll respond within one month, as required by law.

8. Cookies

We only use cookies that are strictly necessary to run the site — there are no advertising or analytics cookies, so no cookie consent banner is shown.

9. Security

We restrict access to your figurines and orders to your own account (verified on every request), use encrypted connections (HTTPS) site-wide, and rely on Google Sign-In instead of storing passwords ourselves, which removes an entire category of password-related risk.

10. Children

TheBobbleShop is not directed at children. If a figurine is made of a child, it should be uploaded and ordered by a parent or guardian on their own account.

11. Changes to this policy

If we make material changes to this policy, we'll update the "Last updated" date at the top of this page.