Privacy policy
This page explains what information the auboiacier.fr website collects about you, why, who receives it, how long we keep it and how to exercise your rights. It applies to quote and contact requests, appointment requests and orders placed online.
Last updated: September 2026.
1. Who is responsible for your data
The data controller is Auboiacier, a metalwork studio in Saumur (49400, Maine-et-Loire, France), represented by Quentin Aumercier. The business's full details (registered name, legal form, SIRET, registered address) appear below where provided, and in the legal notice. For any question about your data: auboiacier@gmail.com. The studio has no data protection officer: its size and activity do not require one.
Legal notice2. The data we collect, depending on what you do
You browse the site without filling anything in: we collect no personal data. Your cart is stored in your browser only (section 8). The host's technical logs record your IP address and browser type for a few days at most, to run and protect the site. You request a quote or contact us: name, email address, phone (optional), town, type of project, your message, and the photos or plans you attach (JPG, PNG or PDF). The language you were browsing in is sent with the request, so we can reply in that language. You request a measuring appointment: the same information, plus the half-day you would like. If you book and pay for the visit online, your postcode is used to calculate the travel price, and the booking is handled as an order. You order online: the delivery town (asked in the cart), the order details (pieces, options, dimensions, notes you add), then, on Stripe's payment page: name, email, phone, delivery address and card details. Your card details are entered at Stripe and never pass through our site. We collect nothing else: no customer account, no password, no profile, no sensitive data. Please do not include any in the free-text field of your messages.
3. Why, and on what legal basis
Answering your quote, contact or appointment request and sending you an acknowledgement: steps taken at your request prior to a possible contract (Article 6(1)(b) GDPR). Processing your order, taking payment, organising manufacture, delivery or the visit, sending you the confirmation and invoice, handling warranties and after-sales service: performance of the contract (Article 6(1)(b)). Keeping invoices and accounting records: legal obligation (Article 6(1)(c); French Commercial Code). Protecting the site against abuse (limit on submissions per IP address, anti-bot field, technical logs) and measuring traffic without identifying anyone: legitimate interest (Article 6(1)(f)), with no impact on your rights and freedoms. We do no marketing: no newsletter, no promotional follow-up, no sale or sharing of your data for marketing purposes. If we ever offered a newsletter, it would rely on your consent, freely given and revocable at any time.
4. Who receives your data
Your data is read by the craftsman himself, and processed by the providers below, who act on our behalf, on our instructions and only for the purposes stated: — Stripe Payments Europe, Ltd. (Dublin, Ireland): payment page, payment collection, invoice, refunds, storage of the contact details and delivery address linked to the order. Stripe also processes some data on its own account (fraud prevention, regulatory obligations), under its own privacy policy: stripe.com/privacy. — Resend, Inc. (United States): delivery of our emails (acknowledgement, order confirmation, order sheet to the studio). The message passes through Resend for as long as it takes to deliver. — Vercel Inc. (United States): hosting of the site and running of the forms. Vercel sees the IP address and technical logs; if sending an order sheet to the studio fails, the order reference, email and postcode are written to its logs for a few days so that the order is not lost. — Google (Gmail, Google Ireland Ltd.): our mailbox, where your requests and order sheets arrive. — Base Adresse Nationale (French public service, api-adresse.data.gouv.fr): only your postcode, sent by our server, to calculate the distance for a measuring visit. No other information goes with it. We do not sell, rent or pass on your data to anyone. It may be disclosed to an authority where the law requires it.
5. Transfers outside the European Union
Stripe Payments Europe is established in Ireland; it may transfer data to its parent company Stripe, Inc. (United States) under Stripe's Binding Corporate Rules, approved by the European authorities, and standard contractual clauses. Resend and Vercel are US companies: the data they process may be hosted or accessed in the United States. These transfers are governed by data processing agreements including the standard contractual clauses adopted by the European Commission and, for providers certified under it, by the EU–US Data Privacy Framework. Where the provider allows it, we choose execution in Europe (site functions in Paris, emails sent from Ireland). Google Ireland may transfer data to Google LLC (United States) under the same safeguards. You can obtain a copy of the applicable safeguards by writing to auboiacier@gmail.com.
6. How long we keep it
Quote, contact or appointment request without an order: three years after our last exchange, then deletion. Attached photos and plans follow the same rule. Orders and paid appointments: order and invoice data are kept for ten years from the end of the financial year, as French accounting law requires (Article L123-22 of the Commercial Code). During the legal warranty period (two years after delivery), they also serve after-sales service. Technical logs and anti-abuse counters: from ten minutes to a few days, at the host. Cart: in your browser only, until you empty it, the order is paid, or you clear the site's data in your browser. Stripe keeps, on its side, what its own legal obligations require (see its privacy policy).
7. Your rights
At any time you may ask to see the data we hold about you, to correct it, to have it erased, to restrict its use, to object to processing based on our legitimate interest, and to receive the data you gave us in a machine-readable file (portability). You may also tell us what to do with your data after your death (a right under French law). An email to auboiacier@gmail.com is enough, preferably from the address used for your request or order. We reply within one month. If there is serious doubt about your identity, we may ask for a means of verification, without requiring a copy of an ID document if another means suffices. Erasure cannot cover invoices and data the law requires us to keep (section 6): we will tell you so and keep them apart from any other use. If you are not satisfied with our reply, you may lodge a complaint with the French data protection authority, the CNIL: www.cnil.fr/en/plaintes, or by post to CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France. If you live in another EU country, you may also contact your local authority.
8. Cookies and browser storage
Unless you open a customer account, this site sets no cookies. It embeds no advertising tracker, no social network button, no third-party video or map. If you open a customer account, the site sets one cookie, “auboiacier_compte”, which keeps you signed in. It holds your verified e-mail address and an expiry date, signed by the site; nothing else, no advertising identifier and no profile. It is strictly necessary for the service you request — without it you would be signed out on every page — and is therefore exempt from consent (Article 82 of the French Data Protection Act). It lasts thirty days and is deleted as soon as you sign out, or when you clear the site's data in your browser. During the sign-in itself, a second cookie (“auboiacier_passage”) lives for ten minutes: it serves only to check that you are the one who started the sign-in, and disappears straight after. It also uses a single local storage entry in your browser (“auboiacier-panier-v1”) to remember the contents of your cart from one page to the next. That storage is likewise strictly necessary for the service you request and is exempt from consent. It stays on your device, is not sent to us as such, and you can clear it by emptying the cart or clearing the site's data in your browser. Audience measurement: this site uses Vercel Web Analytics to count visits and page views. The tool sets no cookies and reads nothing on your device. It does not identify visitors: your IP address and browser name are used only to build an anonymous fingerprint, renewed every day, and are not stored. The data collected (page viewed, country, device type, browser, referring site) is processed on our behalf by Vercel Inc., which hosts the site, on the basis of our legitimate interest in knowing how the site is used (Article 6(1)(f) GDPR), and is not combined with any other data. No consent is required for this measurement; you can block it with a content blocker without affecting the site. The payment page is Stripe's (checkout.stripe.com): Stripe sets its own cookies there, needed for payment and fraud prevention, governed by its cookie policy (stripe.com/legal/cookies-policy).
9. Security
The site is served over HTTPS only. Card details are entered and stored at Stripe, a PCI DSS certified provider; we have no access to them. Access to our mailbox, to Stripe and to the host is protected by password and two-step verification. Form attachments are checked (photo or PDF only) before being forwarded, and the number of submissions per address is limited. In the event of a data breach likely to affect you, we would inform you and the CNIL within the time limits set by the GDPR.
10. Updates
This policy may change if the site or our providers change. The date at the top of the page shows the version in force; a significant change will be announced on the site.