Tietosuojakäytäntö

1. Who looks after your data

The controller of the data collected on infuse.earth is:

• I Infuse SARL
• 4 Beausoleil, 49230 Sèvremoine, France
• SIRET 930 808 621 00013 — VAT FR60930808621
• Email: gestion@infuse.earth
• Legal representative: Timoté Merlet

I Infuse SARL has not appointed a Data Protection Officer (DPO): article 37 of the GDPR does not require it. For any question about your data, write to gestion@infuse.earth.

2. What we receive

We receive what the uses in § 3 need, and nothing more.

2.1 To reach you and deliver to you

• First and last name
• Email address
• Postal address, for billing and delivery
• Phone number, if you give it: it goes to the carrier when the carrier needs it for delivery

2.2 Your order

• Products, quantities, dates
• Amounts paid
• The payment method used, without card number
• Delivery addresses
• With your consent (“Accept” on the cookie banner): the page you arrived on, the domain of the site you came from (google.com, for example), the utm parameters of a campaign link, and the date of that first visit

2.3 Your payment

Payment goes through Stripe, certified PCI-DSS Level 1. Your card number goes straight from your browser to Stripe: INFUSE neither sees it nor keeps it.

2.4 Your visit

• Host logs. Vercel, which hosts the site, keeps technical logs (IP address, device type, page requested, time) for security and operation. Your IP address is also used, for a few minutes, to limit abuse of the forms and the Concierge.
• Cookieless measurement. Vercel Web Analytics and Speed Insights count page views, where visitors come from, country, device and browser type, load times, and a few gestures with no name attached (a search, its length and never its text; an add to cart; opening the Concierge). Ahrefs Web Analytics counts, in aggregate, page views, visit duration, where visitors come from, country, device and browser. Nothing is stored on your device.
• Error reports. When a page breaks, Sentry sends us the report: the error message, the page, the browser. For one visit in ten, it also measures load times. Your session is never recorded.
• Path measurement, with your consent. If you click “Accept” on the banner, PostHog records your path under an anonymous identifier: page views, time spent on each page, clicks, and session recordings in which every input field is masked. The data goes through infuse.earth and is then hosted in the European Union (Frankfurt).

The cookies page lists the site's cookies and local storage one by one.

2.5 The Concierge

What you write to the Concierge goes to Anthropic, which provides the Claude model, long enough to compose the answer. If you are signed in, or if you type an order number, the Concierge also reads the order summary (number, status, dates, tracking, amount) to answer you: never your address, never your email. INFUSE does not keep your conversations; they stay in your browser tab for the length of your visit. If you ask to talk to someone, your message, and your email if you give it, reach us by email.

2.6 Your account, if you create one

• Your email, and your password if you choose one: Supabase keeps only an encrypted hash of it. You can also sign in with a code or link sent by email.
• Your profile, saved addresses, orders and favourites

2.7 The Allies program

• Your ally status and your code
• Sales made with your code
• The bank details (IBAN or equivalent) you send us to receive your share. Our team makes the transfer by hand, with no Stripe Connect or other intermediary. These details stay in our Supabase database, with restricted access.

2.8 A cart left along the way

If you type your email at the Delivery step without finishing your order, we keep that email and a snapshot of your cart (products, quantities, amount) so you can pick your order back up, and to remind you of it by email. Legal basis: legitimate interest (GDPR article 6.1.f). This data is deleted automatically after 60 days, or as soon as your order is paid. You can object or ask for deletion at any time (contact in § 8).

2.9 What you write to us elsewhere on the site

• Your emails to customer service
• A review or a question on a product page: your rating, your text, your email
• A back-in-stock alert: your email
• The newsletter: your email and your language
• Application and contact forms (ally, talents, ambassador, pro space, collaborations): name, email, phone, website, city, message, depending on the form
• Messages exchanged between members of the Circles
• The message attached to a seed you gift

2.10 On your device

What you type at checkout (name, email, phone, address) also stays in your browser's local storage, so you do not have to type it again. This copy never reaches us; it stays in that browser until you clear the site's data. Details on the cookies page.

3. Why, and on what basis

Each use rests on a basis from article 6 of the GDPR.

4. Who has access

Authorised members of the INFUSE team, and the providers below, each for its own task. They process your data on our behalf, under their data processing terms.

To deliver to you, your name, your address, and your phone or email when needed, go to your parcel's carrier: La Poste (Colissimo, Lettre suivie, Delivengo) or Mondial Relay. Outside the European Union, the customs declaration travels with the parcel to the customs of the destination country.

Two small calls: when you type a French address at checkout, suggestions come from the Base Adresse Nationale, the French public address service. Stripe's card form loads its font from Google Fonts (Google, United States), which then sees your IP address.

INFUSE never sells your data, and never gives it to advertising partners or data brokers.

5. Transfers outside the European Union

Some providers are based outside the European Union: in the United States (Vercel, Stripe, Resend, Anthropic), Singapore (Ahrefs), Israel (Wix) and the United Arab Emirates (Telegram). Israel benefits from an adequacy decision of the European Commission. For the others, transfers rely on:

• the EU–US Data Privacy Framework, for US companies that have joined it;
• the European Commission's standard contractual clauses (decision 2021/914);
• encryption of data in transit and at rest.

You can ask for a copy of these safeguards at gestion@infuse.earth.

6. How long

7. Your rights

Articles 15 to 22 of the GDPR give you these rights over your data:

• Access (art. 15): get a copy of your data.
• Rectification (art. 16): correct inaccurate or incomplete data.
• Erasure (art. 17), within our legal obligations (invoices are kept 10 years).
• Restriction of processing (art. 18).
• Portability (art. 20): receive your data in a structured format (JSON or CSV).
• Objection (art. 21) to processing based on legitimate interest, or to direct marketing.
• Withdrawal of consent (art. 7), at any time.
• Automated decisions (art. 22): INFUSE makes no decision with legal effects on you based solely on automated processing. The Concierge guides you; it decides nothing for you.
• Instructions after your death, under article 85 of the French Data Protection Act.

8. How to exercise them

In your account: you edit your details and delete your account in your settings.

By email: write to gestion@infuse.earth with:

• your name and the email of your account or order;
• what you are asking for;
• a copy of an ID document, only if a doubt about your identity requires us to ask for it.

INFUSE answers within 30 days at most. For a complex request, this can extend by 2 months; we tell you beforehand.

9. Cookies

The cookies page gives the exact list of cookies and local storage, with their lifetimes. In short: no advertising cookies, no Meta pixel. Two measurements wait for your “Accept” on the banner: the page you arrive on, kept on your order, and the path measured by PostHog. To withdraw your consent: decline the measurement.

10. Security

• Encryption in transit (HTTPS) across the whole site
• Encryption at rest of the Supabase database
• Passwords kept as an encrypted hash, or sign-in with a one-time code sent by email
• Data access limited to authorised people

If a data breach threatens your rights and freedoms, INFUSE notifies the CNIL within 72 hours and tells you as soon as possible, as articles 33 and 34 of the GDPR require.

11. Complaint to the CNIL

If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL):

CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
cnil.fr/fr/plaintes

12. When this page changes

It changes when the law moves or when a tool arrives on the site or leaves it. If a change touches what we do with your data, we write to you by email if you have an account or receive the newsletter. The update date is at the bottom of the page.

Päivitetty viimeksi: 2026-10-27