Privacy Policy

1. Controller

Foco Azul LLC
[TBD: Registered address in Wyoming]
Wyoming, United States
Email: [TBD: support@littlerootlings.com]

Brand: Little Rootlings is operated by Foco Azul LLC.

2. Data we collect

• When browsing the site: we do not use tracking cookies. Server logs may include IP address, browser type and timestamp (hosting: Vercel).
• When purchasing: email address, Stripe session ID, Stripe customer ID, purchase amount, currency and purchased product. Payment data is handled by Stripe; we never store card or bank details.
• When using /admin: a signed, HTTP-only session cookie for authentication.

3. Purpose and legal basis

• Contract performance (Art. 6(1)(b) GDPR): email and order data are used to process the purchase, deliver the download and provide support.
• Legitimate interest (Art. 6(1)(f) GDPR): server logs for security, debugging and fraud prevention.
• Consent (Art. 6(1)(a) GDPR): if you sign up for a newsletter (not currently active).

4. Processors

We use processors based in the US and EU:

• Stripe, Inc. — payment processing and tax calculation (Standard Contract Clauses / DPA available in the Stripe Dashboard).
• Supabase — database hosting for orders (DPA available).
• Vercel Inc. — web hosting and serverless functions (DPA available).

Transfers to the US rely on Standard Contract Clauses and the providers’ supplementary safeguards.

5. Cookies

We only use technically necessary cookies: the admin session cookie and, where required by Stripe/Vercel, security or operational cookies. No marketing or analytics cookies are used without your consent.

6. Retention

Order data is kept for as long as required for tax and warranty purposes (typically 6–10 years depending on jurisdiction). You may request deletion at any time, unless legal retention obligations apply.

7. Your rights

You have the right to access, rectify, erase, restrict processing, data portability and to object. Please send requests to [TBD: support@littlerootlings.com].