Privacy policy

Who we are

This website is run by aélys art. The data controller, the person responsible for your personal data, is:

[Legal name of the person or business behind aélys art]
[Postal address]
[SIRET / registration number]
Email: contact@aelys.art

We are a small independent art studio. We collect as little as we can, only for the reasons below, and we never sell your data.

What we collect, why, and for how long

When you write to us through the contact form

• What: your name, your email address, the topic you chose and your message.
• Why: to read and answer your message, and, if you ask about a commission or a purchase, to discuss it with you.
• Legal basis: steps taken at your request before a possible contract (GDPR art. 6(1)(b)) when you ask about a commission or purchase; otherwise our legitimate interest in answering the people who write to us (art. 6(1)(f)).
• How long: up to 3 years after our last exchange, then deleted. If your message leads to an order, the related invoices and records are kept for 10 years, as French accounting law requires.

Sending a message does not sign you up to any mailing list, unless you also tick the optional box for our news (see below).

When you join the oracle deck waitlist

• What: your email address, the language you were reading the site in, and the date and time you signed up.
• Why: to email you when the aélys oracle deck becomes available, in your language. Nothing else: we won’t send you other news or offers unless you also tick the optional box for them.
• Legal basis: your consent (GDPR art. 6(1)(a)), given when you enter your email and press the button. You can withdraw it at any time: use the unsubscribe link in our email or write to us, and we delete your address.
• How long: until the deck is released and we have told you, and at most 6 months after the release; or until you withdraw your consent, if sooner.

When you choose to receive our news

• What: your email address, the language you were reading the site in, the form where you ticked the box (contact form or oracle waitlist), and the date and time you ticked it, kept as proof of your consent.
• Why: to send you, a few times a year, news about new talismans, oracle cards, drawings and stories, and occasional offers or events.
• Legal basis: your consent (GDPR art. 6(1)(a) and article L34-5 of the French Postal and Electronic Communications Code), given by ticking the optional box. The box is never ticked for you, and leaving it empty changes nothing else.
• Withdrawing: every email includes an unsubscribe link, or you can write to us at any time. Once you unsubscribe, we may keep your address on a short “do not email” list, only so that we respect your choice.
• How long: until you unsubscribe. If you haven’t opened or clicked any of our emails for 3 years, we delete your address.

When you email us or message us on Instagram

We receive whatever you choose to send, and use it only to answer you, on the same basis and for the same time as messages sent through the contact form. Messages on Instagram are also handled by Meta under its own privacy policy.

When you simply visit the site

• What: like any website, our host automatically receives technical information with each request: your IP address, browser type, the page requested, and the date and time.
• Why: to deliver the pages to you and keep the site secure and working (for example, to block abuse).
• Legal basis: our legitimate interest in running a secure website (GDPR art. 6(1)(f)).
• How long: these logs are kept only briefly by our host and are not used to identify or follow you.

Cookies and tracking

This site sets no cookies for visitors and uses no analytics, advertising or social media trackers. Our fonts are served from our own site, not from a third party. The Instagram link is a plain link: Instagram learns nothing about your visit unless you click it. Your choice of language is kept in the page address, not stored on your device.

That is why you don’t see a cookie banner. If this ever changes, we will update this page and ask for your consent where the law requires it.

Who handles your data

Only we read your messages, the waitlist and the list of people who accept our news. We never sell, rent or share your data for others’ marketing. We rely on a few service providers (“processors”) who store or carry data for us, only on our instructions and under data processing agreements:

• Cloudflare, Inc. (United States): hosts the website and passes on what you send through its forms.
• Google Ireland Ltd / Google LLC (Google Cloud Firebase): stores the messages sent through the contact form and the oracle waitlist, including the news choices made in each.
• OVH SAS (OVHcloud) (France): our email provider (Zimbra mail); delivers and stores the emails we exchange with you, in the European Union.

We may also disclose data if the law requires it, for example to answer a valid request from a court or public authority.

Transfers outside the European Union

Our emails stay with OVHcloud in the European Union. Cloudflare and Google are US companies, so the contact form messages and the waitlist may be processed in the United States. These transfers are covered by the European Commission’s adequacy decision for the EU–US Data Privacy Framework, under which both companies are certified, and by the Commission’s Standard Contractual Clauses. You can ask us for more information about these safeguards.

How we keep it safe

The site is served only over an encrypted connection (HTTPS). The waitlist can be read only by us, after signing in, and the messages only through our protected accounts. We keep only what we need and delete it at the end of the periods above.

Your rights

Under the GDPR and the French Data Protection Act (loi Informatique et Libertés), you have the right to:

• access the data we hold about you and get a copy;
• correct it if it is wrong or incomplete;
• erase it;
• restrict how we use it;
• object to our use of it when it rests on our legitimate interest;
• receive the data you gave us in a common format, or have it sent to someone else (portability);
• withdraw your consent at any time, for the waitlist or our news, without affecting what was done before;
• give instructions about what happens to your data after your death.

To use any of these rights, write to contact@aelys.art. We answer within one month. If we have a reasonable doubt about who is asking, we may ask you to confirm your identity.

If you think we have not respected your rights, you can complain to the French data protection authority, the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07; cnil.fr), or to the authority in the country where you live or work. We would be glad if you came to us first, so we can put things right.

Children

This site is not aimed at children. If you are under 15, please ask a parent or guardian before joining the waitlist, asking for our news or writing to us. If you believe a child has given us their data without that permission, contact us and we will delete it.

Automated decisions

We make no automated decisions and do no profiling with your data. The oracle cards are dealt at random in your browser and nothing about your reading is recorded.

Changes to this policy

We may update this page when the site or the law changes; the date at the top shows the latest version. If a change affects how we use the email you gave us, we will tell you before it applies and, where needed, ask for your consent again.