Privacy policy

1. Controller

[Firmenname], Einzelunternehmen [Vorname Nachname] [Strasse Nr.] [PLZ Ort] Schweiz

E-Mail: hello@popcurve.xyz

2. Data we process

Contact form: name, email address, subject and message.

Custom rug request: name, email, optional phone number, desired size and shape, your notes, and the images you upload. We strip metadata (such as location) from images when saving them.

Shop orders: name, email, phone number, delivery address, the item ordered and the amount. You enter payment details (card, TWINT) directly with our payment provider Stripe; we never see them.

Server logs: when you visit the site, our server records technically necessary data such as IP address, date and time, the page requested and browser type. This is used for security and operation and deleted after 30 days at the latest.

3. Purpose

We process your data to answer your requests, handle commissions and orders, deliver rugs, meet legal obligations (e.g. bookkeeping) and run the website securely. We don't sell data and don't track you for advertising.

4. Cookies

We only use technically necessary cookies: one that remembers your language and, in the admin area only, a login cookie. No analytics or advertising cookies. Fonts are served from our own server, not from Google.

5. Recipients and processors

Hosting: netcup GmbH, Karlsruhe, Germany. The website and database run on their servers in Germany.

Payments: Stripe Payments Europe Ltd., Dublin, Ireland, and Stripe, Inc., USA, to process payments and prevent fraud.

Notifications: so that we can respond quickly, key details of new requests and orders (e.g. name, email, subject) are forwarded to us by email (Resend, Inc., USA) and via Telegram (Telegram Messenger Inc.).

Delivery: we pass your name and address to Swiss Post Ltd.

6. Transfers abroad

According to the Swiss Federal Council, Germany and Ireland provide adequate data protection. For the USA we rely, where available, on the Swiss-U.S. Data Privacy Framework or on the standard contractual clauses recognised by the FDPIC.

7. Retention

Requests and messages are deleted no later than two years after contact ends. Order and accounting records are kept for ten years (Art. 958f CO). Designs uploaded with requests that don't lead to an order are deleted after twelve months at the latest.

8. Security

The website is only served encrypted (HTTPS). Images from requests are not public; only we can access them through a login protected by two-factor authentication.

9. Your rights

You can ask at any time for access to your data, have it corrected or deleted, object to processing, and request a copy of your data, unless a legal retention duty applies. Write to hello@popcurve.xyz. You may also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC).

10. Changes

We update this policy when our processing changes. The version published here applies.