Privacy Policy

1. Controller

The data controller responsible for this website is:
TH Vu, 8050 Zürich, Switzerland
Email: 1624tcg@gmail.com

2. What data we collect

When you place an order, Stripe collects your name, email address, shipping address, and payment details on our behalf. We receive and store:

• Your email address (from Stripe, after a completed payment)
• Your shipping address (city, postal code, country)
• Order details: items purchased, quantities, and prices
• Stripe session and payment identifiers (no card numbers are stored by us)

We do not use cookies for tracking or analytics. When you browse the site, Vercel Analytics collects anonymised, aggregated data such as page views, referrer, country (derived from IP address), and device type. This data cannot be used to identify you personally and is not linked to your order information.

3. How we use your data

We use your data solely to:

• Process and fulfil your order
• Ship your cards via Swiss Post
• Contact you if there is an issue with your order

We do not use your data for marketing, profiling, or any purpose beyond order fulfilment.

4. Third-party processors

We work with the following third-party services, each bound by their own privacy policies:

• Stripe — payment processing. Your payment data is handled exclusively by Stripe and is never stored on our servers. Stripe is PCI-DSS compliant.
• Supabase — secure cloud database for storing order records. Data is stored in the EU (Frankfurt region).
• Resend — transactional email service used to send your order confirmation. Your email address is transmitted to Resend solely for this purpose.
• Vercel Analytics — cookieless, privacy-preserving analytics provided by Vercel Inc. (USA). No personal data or cookies are used. Data collected is anonymised and aggregated (page views, country, device type). Vercel is covered under the EU-US Data Privacy Framework.

5. Data retention

Order records are retained for 10 years as required by Swiss accounting law (OR Art. 958f). After this period, data is permanently deleted.

6. Your rights

Under Swiss data protection law (nDSG), you have the right to:

• Request access to the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to legal retention obligations)
• Object to the processing of your data

To exercise any of these rights, contact us at 1624tcg@gmail.com. We will respond within 30 days.

7. Security

All data is transmitted over HTTPS. Payment processing is handled entirely by Stripe — we never see or store your card details. Order data is stored in a secured database with row-level access controls.

8. Contact

For any privacy-related questions or requests, please contact:
1624tcg@gmail.com