Privacy Policy

This Privacy Policy explains how personal data is collected and processed when you visit menstrua.shop or purchase a product from it. It is issued in accordance with Regulation (EU) 2016/679 (GDPR), the UK GDPR and the Data Protection Act 2018, and the French Data Protection Act (loi n° 78-17 du 6 janvier 1978, as amended).

1. Data controller

The controller of your personal data is Anthony Sandu, sole trader, SIREN 981 045 875, registered address Résidence Carré Gaïa, 215 allée des Cyprès, 83110 Sanary-sur-Mer, France.

Contact for any data protection request: support@menstrua.shop

2. What data we collect

Identification data	First name, last name (where provided), email address
Transaction data	Order reference, product purchased, amount, date, country of purchase, VAT status
Payment data	Collected and processed directly by Stripe. We never receive or store your full card number.
Technical data	Truncated IP address (network portion only), browser type, device type, pages visited, referring source
Correspondence	The content of any message you send us, including refund requests

3. Why we process it, and on what legal basis

Processing your order and delivering the product	Performance of a contract (Art. 6(1)(b) GDPR)
Sending transactional emails (confirmation, download link, refund confirmation)	Performance of a contract (Art. 6(1)(b) GDPR)
Handling refund requests and customer support	Performance of a contract (Art. 6(1)(b) GDPR)
Complying with accounting and tax obligations	Legal obligation (Art. 6(1)(c) GDPR)
Sending marketing emails about our products	Consent (Art. 6(1)(a) GDPR), withdrawable at any time
Measuring website audience and preventing fraud	Legitimate interests (Art. 6(1)(f) GDPR)

4. Who has access to your data

Your data is never sold. It is shared only with the service providers strictly necessary to operate the business, each acting as a processor under contract:

• Stripe Payments Europe, Ltd (Ireland): payment processing, fraud prevention and invoicing
• BunnyWay d.o.o. – bunny.net (Slovenia): hosting and delivery of the video on our home page. Nothing is requested from bunny.net until you press play on that video; if you never play it, no data reaches them
• Hostinger International, Ltd (Cyprus): the domain name and the support@menstrua.shop mailbox used to answer you
• Netlify, Inc. (United States): hosting and delivery of the website itself
• Supabase, Inc. (United States): the database in which your order is recorded and the private storage from which your guide is delivered
• Resend (United States): sending the emails we address to you — your order confirmation, your download link and our follow-up messages

Data may also be disclosed where required by law or by a competent authority.

5. International transfers

Some of our providers are established outside the European Economic Area. Where this is the case, transfers are governed by an adequacy decision of the European Commission or by the European Commission's Standard Contractual Clauses, together with any additional safeguards required.

6. How long we keep it

• Customer and transaction records: 10 years from the end of the accounting year, as required by Article L.123-22 of the French Commercial Code
• Marketing contacts: 3 years from your last interaction, or until you withdraw consent
• Correspondence: up to 3 years after the matter is closed
• Technical logs: up to 13 months

7. Your rights

Under the GDPR and the UK GDPR you have the right to: access your data; obtain its rectification; request its erasure; request restriction of processing; object to processing based on legitimate interests; receive your data in a portable format; withdraw your consent at any time; and define directives concerning the fate of your data after your death.

To exercise any of these rights, write to support@menstrua.shop. We will respond within one month. We may ask you to confirm your identity where there is reasonable doubt.

8. Complaints

If you consider that your rights have not been respected, you may lodge a complaint with a supervisory authority:

• France: CNIL, www.cnil.fr
• United Kingdom: ICO, ico.org.uk
• Elsewhere in the EU: the supervisory authority of your country of residence

9. Cookies

The Website uses only the cookies strictly necessary for its operation and for secure payment processing, which do not require prior consent. Our visit measurement (section 10) sets no cookie at all. We use no analytics or advertising cookies. If any are introduced in the future, a consent banner will be displayed and your choice will be recorded before any such cookie is placed.

10. Visit measurement

We count visits to our own pages so we can see which pages are read and roughly where our readers are. This measurement is first-party: it runs on our own servers, it sets no cookie and no identifier of any kind on your device, it uses no third-party analytics provider, and it cannot follow you to any other website.

For each page view we record the date and time, the page address, the country and (where available) the city and time zone, the website you arrived from, and whether the device is a phone, a tablet or a computer.

We never store your full IP address. Before anything is written down, the address is truncated: for IPv4 the final block is replaced with a zero, and for IPv6 everything beyond the first three groups is discarded. What remains identifies a network — an internet provider, a company, a mobile operator — and is shared by a large number of people. We keep it only to tell our own visits apart from real ones, to recognise a returning connection, and to spot abuse of our forms. The truncated address is erased after 30 days, while the rest of the visit record is kept for 14 months.

The country, region and city are resolved by our hosting provider before the request reaches us, so what our systems receive is the location, never the full address it came from. These records are not linked to your order, to your email address, or to any account.

The legal basis is our legitimate interest in understanding how our own website is used and in protecting it from abuse (Article 6(1)(f) GDPR). No cookie and no identifier of any kind is placed on or read from your device, which is why no consent banner is displayed. You can object to this measurement at any time by writing to support@menstrua.shop.

11. Changes to this policy

This policy may be updated to reflect changes in our practices or in the applicable law. The date at the top of this page indicates the last revision.