1. Who is responsible
The controller for the processing described here is Agence Vautier, Avenue Cardinal Mermillod 36, 1227 Carouge, Switzerland. Contact for privacy questions: contact@agencevautier.ch, +41 22 300 08 29.
This policy covers this website, merchant accounts and the use of the Vautier Store dashboard. For the personal data of a store’s customers, the merchant who runs the store is the controller and Vautier processes the data on the merchant’s behalf (see section 10).
2. Applicable law
Our processing of personal data is subject to the Swiss Federal Act on Data Protection (FADP) and, where it applies to our processing (for example for merchants or visitors in the European Union), to the EU General Data Protection Regulation (GDPR).
3. Data we process
- Account data: your email address, your name (if you give it or it comes from Google), your role in a store team, and the date your account was created and verified.
- Sign-in data: one-time sign-in codes (stored only in a protected, non-reversible form), session cookies, and - if you sign in with Google - your Google account identifier, email address and name.
- Store data: the information you enter about your store and business (name, address, contact details, business identifiers), and the content you publish.
- Subscription and billing data: your plan, billing period, billing email, the references of your customer and subscription records at our payment provider, invoice records. Card details are entered on Stripe’s pages and are not stored by us.
- Messages: what you send us through the contact form (name, email, company, topic, message) or by email.
- Technical data: IP address, browser information, the pages and functions requested, and error reports, in server logs and for security (for example to limit repeated sign-in attempts).
- Records of the terms version you accepted and the privacy policy version shown to you when you signed up.
4. Why we process it (purposes and legal bases)
- To create and run your account and store and provide the service (performance of the contract - Art. 6(1)(b) GDPR).
- To verify your email address and sign you in securely (contract; our legitimate interest in security - Art. 6(1)(f) GDPR).
- To bill subscriptions and keep accounting records (contract; legal obligations - Art. 6(1)(c) GDPR).
- To answer your messages (legitimate interest; contract where the message concerns your account).
- To keep the platform secure, prevent abuse and fix errors (legitimate interest).
- To send you messages about your account and the service (contract). We do not send marketing emails.
5. Sign-in with an email code
When you sign in or sign up, we send a 6-digit code to your email address. The code is valid for 5 minutes and can be used once; it works only in the browser that asked for it. We store only a keyed, non-reversible form of the code; it is deleted one day after it expires. The number of requests and attempts is limited per address and IP address to prevent abuse.
A new merchant account is only created after the code has confirmed the email address. Registrations that were started with an older verification link and never confirmed are deleted after 7 days.
6. Sign-in with Google
If you choose “Continue with Google”, Google confirms your identity to us. We request only your basic profile: a Google account identifier, your email address (and whether Google has verified it) and your name. We do not receive your Google password and request no access to your emails, files or contacts.
We store the Google account identifier with your Vautier account so that we recognise you the next time. If the email address already belongs to a Vautier account, we ask you to confirm with a code sent to that address before connecting the two.
Google processes data under its own privacy policy (policies.google.com/privacy).
8. Service providers and recipients
We use the following providers, who process personal data on our behalf or as independent controllers for their own services:
- Amazon Web Services (AWS): hosting of the platform and its database on servers in Frankfurt, Germany.
- Hostinger: domain name system (DNS) and the mailboxes from which we send account emails such as sign-in codes.
- Stripe: payment and subscription processing for Vautier Store plans, and - if a merchant connects one - online payments to the merchant’s own Stripe account.
- Google: sign-in with Google, only if you choose it.
- Let’s Encrypt: security certificates for the platform’s addresses (no account data).
We do not sell personal data. We disclose data to authorities only where we are legally required to.
9. Where data is stored and international transfers
The platform’s database and files are stored on servers in Frankfurt, Germany (European Union). Switzerland recognises the EU as providing an adequate level of data protection. Encrypted backup copies are additionally kept by the operator.
Some providers (for example Stripe and Google) may process data in other countries, including the United States, under their own data protection terms.
10. Data of your store’s customers
When shoppers buy from a store on Vautier Store, the merchant decides which data is collected and why; the merchant is the controller and must inform the shoppers (each store has its own privacy page). Vautier hosts and processes this data on the merchant’s behalf. Each store’s data is kept separate from every other store’s data.
11. How long we keep data
- Account and store data: as long as the account exists; deleted when the account and store are closed.
- Sign-in codes: deleted one day after they expire. Google sign-in round trips: 10 minutes.
- Unconfirmed registrations from older verification links: 7 days.
- Data export files: 72 hours.
- Invoices and accounting records: for the period required by law for business records.
- Audit trail of administrative actions on the platform: kept without a time limit; it contains identifiers, not customer data.
- Backups: routine on-server backups are replaced after 14 days; copies made before maintenance work and the encrypted off-server copies are kept as long as they are needed for recovery.
- Error logs: 14 days. Server logs are rotated automatically as they grow.
12. Security
We protect personal data with technical and organisational measures appropriate to the risk, including: encrypted connections (HTTPS), sign-in codes and passwords stored only in protected form, secrets stored encrypted, strict separation of each store’s data, two-factor authentication and logging for platform staff, limits on repeated sign-in attempts, and encrypted off-server backup copies. No system is completely secure; if a breach affects your data, we inform you and the authorities as required by law.
13. Your rights
Under the FADP and, where applicable, the GDPR, you can request access to your personal data, its correction or deletion, a copy of the data you provided in a common format (store Owners can also export store data from the dashboard), and object to processing based on our legitimate interests. Under the GDPR you can also request restriction of processing.
To exercise your rights, write to contact@agencevautier.ch. We may need to verify your identity. You can also lodge a complaint with a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the authority of your country of residence.
14. Automated decisions
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
15. Changes to this policy
Vautier Store is a continuously evolving platform. This policy may be updated to reflect changes to our services, our processing or applicable legal requirements; it always describes our current processing. Each version is dated, and the version shown when you signed up is recorded with your account. We inform you of material changes as required by applicable law and ask for your consent where the law requires it.
See also: Terms of Service