Privacy Policy.

The short version.

We take what an order needs and nothing beyond it. No advertising pixels, no third-party trackers anywhere on this site — nothing here reports to Google, Meta or an ad network. Visits are counted by us, on our own server, with no cookie and nothing written to your device. The only cookies we set keep you signed in and remember your language. Your data is not sold or rented to anybody. If you use the chat, a functional token on your device lets you resume it; automatic replies use an AI service.

Who is responsible.

PRIMALFORM, shipping from within the European Union, is the controller for everything described here. Write to [email protected] about anything on this page.

What we take, and why.

• To fulfil an order — name, email, phone, delivery address and any note you add, plus the items, prices and payment method. Without them we cannot ship or confirm anything. Legal basis: performance of the contract.
• If you open an account — your email, your name and a hashed password (the password itself is never visible to us), so you can sign in and see your history.
• Payment — for a card or PayPal link we see only what the provider reports on the payment; on crypto we store the invoice, the address, the amount and the transaction hash. A card or PayPal payment is made on the provider's own page and comes back to us as an outcome, never as card details: we never see or store a card number, because none is ever entered on this site.
• Server logs — the ordinary request records our server and Cloudflare keep, IP addresses included, used to keep the site up and to block abuse. Legal basis: legitimate interest in a working, non-abused shop.
• Chat and contact enquiries — the text you send, the page you wrote from and, if supplied, your email for follow-up. We store the conversation to answer you. Automatic chat shares message text with the AI services described below. Legal basis: our legitimate interest in answering enquiries and, for order-related requests, steps to perform the contract.

Cookies.

We use functional cookies to keep you signed in and remember your language choice. If you use the chat, a random conversation token is stored in localStorage so you can resume it in the same browser; this is not an advertising or analytics identifier. Clear site data to remove it. Our visit counting does not use cookies or localStorage.

How we count visits.

We keep our own basic statistics — which pages get read and for how long, which link brought someone here, roughly which country, phone or laptop. Beyond that we write down what people press while they browse — a search term, a product dropped into the cart, a checkout begun, a click that leads off the site, the newsletter box filled in — each one filed as an action name with the page it happened on, roughly where on the page it was pressed and the time it happened, never as anything that identifies who pressed it. A shop that cannot see what people are looking for cannot get better at answering them. It all runs on the same server as the shop: nothing goes to Google Analytics or any other company, and none of it leaves the European Union.

It sets no cookie and writes nothing to your device, so there is nothing to consent to and nothing to clear. To tell one visit from another we store a one-way hash of your IP and browser mixed with a secret that changes every midnight — it cannot be turned back into your address, and the same visitor produces a different value tomorrow, so these records cannot follow anyone across days. They are deleted automatically after 180 days. Legal basis: legitimate interest in a working shop, by the least identifying method we could build.

Who else touches it.

• Contabo GmbH — hosts the server the shop and its database run on, in France, inside the EU.
• Cloudflare — stands in front of the site for security and speed, so every request passes through it.
• Resend — sends the order and account emails, and so processes your address and the contents of those emails.
• The carrier — gets the name and address printed on the carton, and nothing about the contents beyond what the label legally requires.

Cloudflare and Resend are US companies. When you use automatic chat, your message text and recent conversation are sent through OpenRouter to the configured AI provider (currently DeepSeek) to generate a reply. Do not send medical information, passwords or payment details in chat. Your optional email is stored separately for our team to follow up and is not included as an email field in AI requests. These services may process data outside the EU. We do not sell your data to advertisers or data brokers.

How long we keep it.

Orders and their invoices stay as long as accounting law requires. Account data stays until you ask for the account to be deleted. Server logs rotate away within weeks. Chat and contact messages are kept to handle your enquiry and follow-up. Contact us to request their deletion; clearing browser storage removes only your local chat token, not the messages stored on our server.

Your rights.

Under the GDPR you can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable form. Write to [email protected] and you get an answer within one month. If you think we have handled it badly, you can complain to the data protection authority in your country.

One limit, stated plainly: closing an account does not wipe an order we are legally obliged to keep a record of.