1. Data controller
The data controller is Les Artisans Du Digital (LADD), SAS, 25 rue de Ponthieu, 75008 Paris — see our legal notice for full details.
GDPR contact: jmboni@lesartisansdudigital.fr.
2. Data we collect
evow only collects what the product strictly needs. Three families:
- Morphology profile — sizes per garment type, optional measurements, body shape, cut and material preferences. You provide these voluntarily during onboarding.
- Style profile — cultural style universe, reference brands, budget, sustainability criteria, life moments (modest cuts, maternity, adaptive fashion).
- Account — email (Google OAuth or magic link), display name, timestamped GDPR consents.
What we do not collect: browsing history outside evow, payment instruments outside the gifting flow, address-book contacts, precise geolocation.
3. Purposes
- Fit recommendation — calibrate your true size across 277+ partner brands (legal basis: contract performance).
- Shopping surfaces — feed the Magic Mirror SDK, the Chrome companion and the mobile app feed by filtering products that fit your profile.
- Club EVOW — drop and pre-sale notifications aligned with your size and style (legal basis: explicit consent, separate opt-in).
- Anonymous analytics — measure product usage without correlation to your identity.
4. Hosting and jurisdiction
All data is hosted in the European Union:
- Cloud Run (Paris, FR — europe-west9)
- Cloud SQL Postgres (Belgium, BE — europe-west1) with CMEK encryption
- Regional EU object storage
No transfer outside the EU happens without standard contractual clauses and explicit consent. Master encryption keys are controlled by the publisher; Google has no access to the encrypted data.
5. Retention
- Active profile: as long as your account is open.
- Deleted profile: full erasure within 30 days, backups purged within 90 days.
- Timestamped consents: 5 years after the last event (legal obligation).
- Technical logs: 12 months max, anonymised afterwards.
6. Sharing and third parties
evow never sells your data. Partner brands only receive the size guide that concerns them, and only when you actively choose to share your profile with them (consent scoped per brand, revocable at any time).
Sub-processors (GDPR Article 28): Google Cloud (hosting), Firebase Auth (authentication), SendGrid (transactional email). All under GDPR-compliant DPA.
7. Your rights
At any time, you can:
- Access your data through your dashboard or by email request.
- Rectify any information from your profile.
- Delete your account in one click from settings.
- Export the entirety of your data in JSON format.
- Restrict or object to a specific processing.
- Withdraw marketing consent at any time.
Maximum response time: 30 days. If you disagree, you can refer the matter to the CNIL (French supervisory authority) or your local DPA.
8. Minors
Profiles for users under 16 are tied to an adult guardian account. No direct communication (email, push) is sent to them. Club EVOW is restricted to 16+ profiles with explicit consent. Sharing a profile for gifting requires a fresh guardian consent each session.
9. Security
TLS encryption in transit, encryption at rest with publisher-managed keys (CMEK), optional multi-factor authentication, regular security audits, VPC network isolation, encrypted multi-region backups.
In case of a security incident affecting your data, notification within 72 hours pursuant to Article 33 GDPR.
10. Changes
Any substantive change to this policy is notified to affected users by email with a 30-day notice period.
Published by Les Artisans Du Digital (LADD), SAS — a Jemitilab subsidiary. Publishing director: Jean-Michel BONI. 25 rue de Ponthieu, 75008 Paris, France.