Privacy notice
The short version
This site sets no cookies of its own, runs no analytics, shows no advertising, and loads nothing from third parties while you look around: fonts and images come from our own domain. We only process personal data when you do something that needs it: join the waitlist, pre-order, withdraw from a purchase, or write to us. We do not sell data and we do not build profiles.
1. Who is responsible
The seller named in our imprint runs this site and decides how personal data is handled here.
For anything about your data, write to coffee@fairytalegrey.com.
We apply the General Data Protection Regulation (GDPR). Where this notice names a legal basis, it refers to Art. 6 GDPR.
2. When you visit the site
The site is hosted on the network of Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, USA), which answers every request from a data center near you. To deliver a page, and to protect the site against attacks, Cloudflare processes on our behalf what every web server sees: your IP address, the page or file requested, date and time, the browser and operating system your browser reports, and the page you came from. We do not combine this with anything else and we do not try to identify visitors. Legal basis: our legitimate interest in running a secure, working site (Art. 6(1)(f)).
From your IP address Cloudflare derives the country you are probably in. We use it to preselect the "ship to" country in the bag, and store it (two letters, not the address) with a waitlist entry. Technical logs of the parts of the site that run as a program are kept for a few days, 7 at most, then deleted automatically.
3. What is stored on your device
The site itself sets no cookies. It uses your browser's local storage for the contents of your bag and the ship-to country you chose, and for the number of your last order (so the confirmation page does not empty a newer bag). None of this leaves your device except as part of an order. You can clear it in your browser at any time. Stripe sets its own cookies on the checkout page (section 6).
4. The waitlist
If you join the waitlist we store your email address, the page you signed up on, the country derived from your IP address and the time, and send you one email asking you to confirm the address (double opt-in). We keep a record of when you confirmed; that is our proof of your consent. After that we send you one email when Fairytale + Grey ships, and nothing else. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time through the link in our emails or by writing to coffee@fairytalegrey.com; we then delete the entry. An address that is not confirmed within 30 days is deleted automatically; a confirmed one after the announcement has gone out.
5. Protection against automated abuse
The waitlist and the withdrawal form send emails to an address typed into them, so they are protected by Cloudflare Turnstile. It is loaded only when you start filling in one of these forms. Turnstile examines technical signals from your browser (such as IP address, browser characteristics and how the page was loaded) to tell people from programs, and gives us a yes or a no. It is not used for advertising. Legal basis: our legitimate interest in keeping bots from sending email through our forms (Art. 6(1)(f)).
6. Pre-orders and payment
Payment is handled by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). On our checkout page, and only there, your browser loads Stripe's payment form from Stripe's servers; in it you enter your name, email address, phone number, delivery and billing address and your payment details. Your card or account details go to Stripe only; we never see or store them. Stripe sets cookies on the checkout page to prevent fraud, and uses data about the payment to prevent fraud and to meet its own legal duties, for which it is responsible itself: stripe.com/privacy.
From Stripe we receive, and store in our order database in Western Europe: your name, email address, phone number, delivery address, what you ordered, the amounts, the payment status and Stripe's reference numbers. We use this to deliver your order, to send you the emails that belong to it, to handle withdrawals, returns and complaints, and to keep our books. Legal basis: performance of the contract with you (Art. 6(1)(b)) and our legal obligations under commercial and tax law (Art. 6(1)(c)). We keep order records for as long as commercial and tax law requires, which is up to 10 years.
To get the parcel to you, our warehouse in Germany and the carrier receive your name, delivery address and, for delivery notices, your email address or phone number. For destinations outside the European Union the customs authorities receive what a customs declaration requires.
7. Emails we send you
We send the emails an order requires (the confirmation with your withdrawal rights, the notice that your parcel is on its way, the acknowledgment of a withdrawal) and, if you joined the waitlist, the confirmation request and the one announcement. We send no newsletter.
To deliver them we use Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, United States), which processes your email address, the content of the message and technical delivery data on our behalf, and stores them in the United States for thirty days: resend.com/legal/privacy-policy. The transfer takes place under the European Commission's standard contractual clauses, which form part of our data processing agreement with Resend. Alerts to ourselves about new orders go through Cloudflare's email service.
8. The withdrawal form
If you declare a withdrawal online, we store what you enter (name, order number, email address, your note if any) and the date and time we received it, send you the acknowledgment the law requires, and keep the declaration with the records of the order. Legal basis: the contract and our legal obligations (Art. 6(1)(b) and (c)).
9. When you write to us
If you email us we use what you tell us to answer you and to deal with your request. Legal basis: steps toward or performance of a contract, or our legitimate interest in answering inquiries (Art. 6(1)(b) or (f)). We keep such correspondence as long as the matter requires, and business correspondence as long as the law requires.
10. Who receives data, and where
Apart from the recipients named above (Cloudflare for hosting, security and our own alerts; Resend for sending our emails; Stripe for payment; our warehouse and the carrier for delivery; the provider of our mailbox; our accountants and, where the law requires it, authorities), nobody receives your data. Service providers that work for us are bound by data processing agreements. Where personal data reaches the United States, this happens under the EU-US Data Privacy Framework, under which Cloudflare and Stripe are certified, and under the standard contractual clauses in our agreements.
11. Your rights
You can ask us at any time what we store about you and get a copy, have wrong data corrected, have data deleted or its use restricted, receive the data you gave us in a common format, and object to processing that we base on our legitimate interests. Where processing is based on your consent you can withdraw it at any time, with effect for the future. There is no automated decision-making and no profiling on this site. Write to coffee@fairytalegrey.com; we answer within one month. Data we must keep by law is blocked from other use instead of deleted.
You also have the right to complain to a data protection authority, in particular in the EU country where you live or work.
12. Security
All traffic to and from this site is encrypted. Order data is stored in a database that only the shop's own program and we can reach; the back office is protected by a password and refuses requests from other sites. Payment details never touch our systems.
13. Changes
When the site changes, this notice changes with it; the version date at the top tells you when.