The French version of this page is the reference text. This English version is provided for convenience.
This page explains which personal data Artiz Studio collects on artiz-studio.com, why, how long it is kept and how to exercise your rights, in line with the General Data Protection Regulation (GDPR) and French data protection law.
Data controller
Alan Meyer, sole trader (micro-entrepreneur) trading as Artiz Studio, 5 Rue Alsace Lorraine, 44400 Rezé, France. Contact: [email protected].
Data collected, purposes and legal bases
| Situation | Data | Purpose | Legal basis |
|---|---|---|---|
| Buying a creation | Email address, Cfx.re username, creation, amount, promo code used, payment method, date, consents and accepted terms version | Process the order, deliver the creation, send the receipt, support | Performance of the contract |
| Accounting | Reference, creation, amount, dates, payment method | Keep accounts, meet legal obligations | Legal obligation |
| Proof of consents | Date of the consents (immediate delivery, waiver, terms) and terms version | Prove these consents in case of dispute | Legal obligation and legitimate interest |
| Custom work form | Name, email address, Discord username, server information, project description | Answer your request and prepare a quote | Pre-contractual steps taken at your request |
| Support | Messages exchanged by email or on Discord | Answer your questions and fix defects | Performance of the contract or legitimate interest |
| Website security | IP address and technical signals processed by Cloudflare (bot protection, Turnstile) | Protect the website and the form against abuse and fraud | Legitimate interest |
| Script protected by a license | Hash of the license key, random installation identifier, short hash of the FiveM server address, connection dates | Check the license, prevent a key from being shared, disable the license after a refund | Performance of the contract and legitimate interest |
| Statistics | Anonymous audience measurement (Cloudflare Web Analytics), technical events (payment opened, payment succeeded, request sent) | Understand how the website is used and improve it | Legitimate interest |
Artiz Studio never sees or stores your card details: you enter them directly with Stripe or PayPal.
The data requested for an order is required: without an email address and a Cfx.re username, the creation cannot be delivered.
Retention periods
- Unpaid order (abandoned payment): deleted after 48 hours.
- Buyer identification data (email address, Cfx.re username): kept for 3 years after the buyer’s last order, then automatically anonymized.
- Accounting data of the order (reference, creation, amount, dates, payment method): kept for 10 years without any identification data, then automatically deleted.
- Licenses of protected scripts: the license (without identifying data) is kept with the order; verification sessions are deleted when they expire, servers released by the buyer after 90 days. Failed verification attempts (IP address) are kept for 24 hours to limit abuse.
- Sign-in and order lookup forms: the IP address and a one-way hash of the email address entered are kept for 24 hours to limit abuse; the “Find my orders” email is only sent to the address of the order.
- Technical events: automatically deleted after 3 years.
- Custom work requests and support exchanges (emails, Discord messages): kept for at most 3 years after the last exchange, then deleted.
Recipients
Your data is neither sold nor used for advertising. It is accessible to Artiz Studio and to the following providers, each for its own task:
- Stripe and PayPal: payment;
- Tebex and Cfx.re: delivery of the creation to your Cfx.re account;
- Cloudflare: website hosting, order database, bot protection (Turnstile) and audience measurement;
- Resend: sending emails (order confirmation, receipt, follow-up);
- Discord: Artiz Studio internal notifications (order reference, creation, amount, Cfx.re username, custom work requests) and support;
- Google (YouTube): only if you play a video, see the cookies section;
- your mailbox and Artiz Studio’s mailbox for email exchanges.
Transfers outside the European Union
Several of these providers are established in the United States or elsewhere outside the European Union. These transfers rely on the safeguards provided for by the GDPR, depending on the provider: a European Commission adequacy decision or standard contractual clauses.
Cookies and trackers
The website uses no advertising cookie and no cross-site tracking, and therefore shows no consent banner.
- Language cookie (
lang): set only when you click the language switch, it remembers your choice for 1 year. It is strictly necessary to carry out your request and contains no personal data. - Cloudflare Web Analytics: audience measurement without cookies and without individual identification.
- Cloudflare Turnstile: anti-bot check shown on the custom work form, which analyzes technical signals from your browser to tell humans from robots.
- YouTube: a video is loaded only after you click “Play video”, through the cookie-free domain youtube-nocookie.com. Before that click, no data is sent to YouTube.
- Fonts and the 3D preview are served by the website itself: no call to a third-party service.
Your rights
You have the rights of access, rectification, erasure, objection, restriction of processing and portability of your data, as well as the right to set instructions about its fate after your death.
To exercise them, write to [email protected] with the email address and Cfx.re username used for your order. You will get an answer within one month. Proof of identity may be requested if there is doubt about who you are.
Some data must be kept despite an erasure request, notably accounting records (10 years). They are then kept without any identifying element.
If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority: cnil.fr.
Security
The website is served over HTTPS. Access to the database and to the email tools is protected by secret keys, and order tracking links contain a personal random token.
Changes to this policy
This policy may change. The date of the last update is shown at the top of the page.