Privacy Policy

Who We Are

Liora is an online shop operated from France by Ilona Darney. For the purposes of the General Data Protection Regulation (GDPR), Ilona Darney is the data controller responsible for the personal information described in this Privacy Policy. For any privacy-related questions or requests, you can contact us at lioraclothingfr@gmail.com.

Information We Collect

We only collect information that is necessary to operate our shop, provide our services and fulfil your orders. Specifically:

• Account: If you create an account, we collect your email address, display name, and a unique account ID. If you sign in with Google, we receive the name, email address and other profile information made available to us through that authentication service — we do not receive your Google password. Once you complete your first order, we also store your phone number and shipping address (street, city, state/region, postal code, country) against your account so checkout can be pre-filled next time.
• Orders: When you place an order, we collect your name, email address, phone number, and shipping address, together with the items purchased, their prices, the shipping method chosen and its cost, the order total, and the payment status of the order.
• Payment: Payments are entered directly into Stripe's own secure checkout page. Liora does not receive or store your full card number, expiry date or CVC — Stripe passes us only a payment/session reference confirming whether the payment succeeded.
• Address autocomplete: As you type your shipping address at checkout, the text you've entered so far is sent to OpenStreetMap's Nominatim search service to suggest matching addresses. Only the partial address text is sent — not your name, email or any other identifying information.
• Customer service: If you contact us through our contact form, we process your name, email address, subject line and message so that we can respond to your request. Messages are delivered to us by email via our provider Resend, and a copy is also kept in our database for our own records.
• Reviews: If you leave a product review, we store your account ID, display name, star rating and written comment against that product. Your display name and comment are shown publicly on the product page.
• Information stored on your device: We do not use cookies. Certain information is instead stored locally in your browser's local/session storage — your shopping cart contents, favourited products, selected display currency, cached exchange rates, and interface preferences (e.g. whether you've minimised the currency switcher). This information stays on your device and is not automatically transmitted to us, except that your cart contents are sent to our checkout API at the moment you actually place an order.
• IP address: We use your IP address on a short-lived, in-memory basis to apply rate limits that prevent abuse of our checkout, contact and review forms. It is not written to any database, not linked to your account, and is discarded automatically after the rate-limit window expires.

Cookies

Liora does not use cookies, and does not run any analytics, advertising or tracking scripts. The device-storage items listed above are all held in your browser's local/session storage rather than cookies, are never used to track you across other websites, and are not shared with any advertising network.

How We Use Your Information

We process your personal information only when we have a lawful reason to do so.

• We use information necessary to process purchases, take payment, calculate and arrange shipping, provide order confirmations and manage customer accounts on the basis that this processing is necessary to perform our contract with you or take steps at your request before entering into a contract.
• We may process certain information (including your IP address, on a short-lived basis) to prevent fraud, secure and protect our website, and respond to certain customer enquiries where necessary for our legitimate interests, provided those interests do not override your rights.
• We also retain and process information when necessary to comply with legal obligations, including applicable accounting, tax and regulatory requirements.

If we introduce optional marketing communications that require your consent, we will ask for that consent where required, and you may withdraw it at any time. Every processing activity has an appropriate legal basis under the GDPR, and the chosen legal basis affects the rights available to you.

Who We Share It With

We only share personal information with service providers when this is necessary to operate Liora and provide your order.

• Stripe — receives your email address and payment details directly, to process payment for your order.
• Shippo and the shipping carrier it books with (e.g. Colissimo, Chronopost, or another partner carrier) — receive your name, address, phone number, email address, and order contents to calculate shipping rates, generate shipping labels/documents and deliver your order, including customs information legally required when shipping internationally.
• Google / Firebase — provides the technical infrastructure behind account authentication (including Google Sign-In) and our database and file storage.
• Resend — delivers the emails generated by our contact form to our inbox, processing the name, email address and message you submit.
• OpenStreetMap (Nominatim) — receives the partial address text you type at checkout in order to suggest matching addresses. No other personal information is sent to this service.
• Frankfurter (European Central Bank exchange-rate data) — used only to fetch public currency-conversion rates for display purposes; no personal information is sent to this service.
• Other technical or professional service providers may process limited information where necessary to operate, secure or legally administer the business.

We do not sell your personal information. We may also disclose information where required by law, regulation, legal proceedings or a competent public authority.

International Data Transfers

Some of the service providers we use — including Stripe, Shippo, Google/Firebase, Resend, and OpenStreetMap's infrastructure providers — may process personal information outside France or the European Economic Area (EEA), including in the United States. Where personal information is transferred outside the EEA, we rely on the safeguards and transfer mechanisms applicable to the relevant service provider and processing activity, where required under data-protection law. These may include an adequacy decision recognised by the European Commission or appropriate safeguards such as Standard Contractual Clauses. Information about safeguards applicable to a particular transfer may be requested by contacting us.

Data Retention

We keep personal information only for as long as necessary for the purposes for which it was collected and to comply with applicable legal requirements.

• Orders: retained for the period necessary to manage the commercial relationship and, in any event, for up to 10 years where required by French accounting and tax law.
• Accounts: generally kept while your account remains active and deleted or anonymised when it is no longer required, subject to information we must retain for legal purposes.
• Contact-form messages: retained only for as long as reasonably necessary to deal with your request and any resulting legal or administrative requirements.
• Reviews: kept until you ask us to remove them, or until the product they relate to is permanently discontinued and removed from the site.
• IP addresses used for rate-limiting: held in memory only, for at most a few minutes, and never written to a database.

Security

We take reasonable technical and organisational measures to protect your personal information against unauthorised access, loss, misuse, alteration or disclosure. Card payments are entered directly on Stripe's own secure, PCI-compliant checkout page — we never see or store your full card details. Pricing and stock levels are re-verified on our server at the moment of purchase to prevent tampering with client-submitted values. No online service can guarantee absolute security, but we take reasonable measures appropriate to the information we process.

Your Rights

Because Liora is operated from France, your personal information is protected by the GDPR and applicable French data-protection law. Depending on the circumstances and legal basis of the processing, you may have the right to:

1. 1

   Access the personal information we hold about you.

2. 2

   Correct inaccurate or incomplete personal information.

3. 3

   Request the deletion of your personal information where applicable.

4. 4

   Request restriction of certain processing, or object to processing based on legitimate interests.

5. 5

   Receive certain information in a portable format where the right to data portability applies.

6. 6

   Withdraw your consent at any time where processing is based on consent. Withdrawal does not affect processing lawfully carried out before consent was withdrawn.

7. 7

   Lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés) or another competent data-protection authority.

Not every GDPR right applies to every type of processing — for example, rights such as objection and portability depend on the legal basis being used. To exercise your rights, contact lioraclothingfr@gmail.com. We may need to request information necessary to verify your identity before completing certain requests.

Children's Privacy

Liora's online shop is not specifically directed at children. We do not knowingly seek to collect personal information from children except where necessary and lawful in connection with use of our services. If you believe that a child has provided personal information to us in circumstances where it should not have been collected, please contact us at lioraclothingfr@gmail.com.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to our services, the technologies we use or applicable legal requirements. When we make changes, the updated version will be published on this page.

Last updated: 27 July 2026