Legal
Privacy Policy
Last updated: 19 October 2026
1. Who is responsible for your data
Agostina is published by the company Agostina, a single-shareholder simplified joint-stock company (SASU) with a share capital of €1, registered under SIRET number 109 510 941 00015, whose registered office is at 49A rue de la Balue, 35400 Saint-Malo, France, represented by Océane André, President.
Agostina is the controller of the personal data processing described in this policy. For any question, or to exercise your rights: contact@agostina.store.
This policy applies to the Agostina mobile app and the agostina.store website, whether you are a buyer or a creator. Agostina is reserved for adults (18 years old and over).
2. The data we collect
For everyone using Agostina
- Account: email address, password (stored in encrypted form, never in plain text), preferred language
- Profile photo, if you add one
- Your activity in the app: shops followed, products saved, videos liked, shops blocked, content reported
- Technical push notification token, if you allow notifications
- Technical operating and security data (for example IP address, date and time of requests), kept for a short period (see section 6)
If you buy on Agostina
- Name, delivery address and phone number linked to each order
- Your order history
- Payment data: it is entered directly into Stripe's secure form. Agostina never sees or keeps your card number
If you sell on Agostina (creator)
- Shop information: name, description, photos and videos of your creations
- Legal information about your business (needed for invoicing and compliance), once your shop makes sales
- Information linked to your Stripe Connect account, used to receive your payouts. Identity documents and bank details are collected and managed directly by Stripe: Agostina does not keep their details
- Your shop's shipping address, used to calculate delivery costs
- The information that the European tax cooperation rules (known as "DAC7") require us to collect and verify about sellers: name, address, date of birth, tax identification number (for a business: company name, SIRET and VAT number) and bank account details for payouts. This information, together with the number of sales and the amounts received each quarter, is sent every year to the tax authorities for sellers who exceed the thresholds set by law
What is public
A shop's name, description, photos and videos are visible to all users of the app. What you choose to publish is also visible. Your orders, address and phone number are never public.
What we do not use
Agostina uses no audience-analytics tool, no advertising tracker and does no commercial profiling. The agostina.store website uses no non-essential cookies. If this changes, we will update this policy and obtain your consent where the law requires it.
3. Why we use your data
| Purpose | Legal basis |
|---|---|
| Create and manage your account | Performance of a contract (the Terms of Use) |
| Process your orders and payments, organise shipping, make payouts to creators | Performance of a contract |
| Send you notifications about your orders and payouts | Performance of a contract |
| Send you news from the shops for which you turned on the bell | Your consent (turning on the bell on the shop's page, which you can withdraw at any time by turning it off) |
| Moderation, service security, prevention of fraud and abuse | Agostina's legitimate interest in protecting the platform and its users |
| Accounting, tax and regulatory obligations; replying to requests from authorities | Legal obligation |
| Replying to your requests and handling the exercise of your rights | Legal obligation and legitimate interest |
We never use your data for advertising and never sell it to anyone.
4. Who we share your data with
Each recipient only receives the data needed for its task.
| Recipient | Role | Data concerned |
|---|---|---|
| The creator you buy from | Prepare and ship your order | Name, delivery address, phone number, order contents. They may only use them to fulfil that order |
| Stripe | Payments, payouts to creators, identity verification of creators (regulatory obligation). For these obligations, Stripe acts on its own behalf | Payment data, creators' identity information |
| Sendcloud | Shipping labels and parcel tracking | Name, delivery address, phone number, parcel information |
| Supabase | Hosting of the database and servers | All the app's data |
| Cloudflare R2 | Storage of photos and videos | Files published by creators and users |
| Resend | Sending emails linked to your account (for example password reset) | Email address, content of the email |
| Expo (push notification service), Apple and Google | Delivering notifications to your device: Expo passes them on to Apple's (iOS) and Google's (Android) notification services | Notification token, content of the notification |
| Authorities, including the tax administration | On legal request, and every year for the tax reporting of sellers | The data strictly required; for sellers: identity, address, tax identifier, number of sales and amounts received |
No service provider is allowed to use your data for its own commercial purposes.
5. Where your data is hosted
Agostina's database is hosted in the European Union, in Frankfurt (Germany). Some of our service providers are companies established outside the European Union or may process data there (payments, media storage, sending emails, notifications). These transfers are covered by a European Commission adequacy decision (for example the Data Privacy Framework) or by standard contractual clauses. Our email-sending provider (Resend) stores its service data in the United States, even when emails are sent from Europe.
6. How long we keep your data
| Data | Duration |
|---|---|
| Active account | For as long as the account is used |
| After account deletion | Your profile is anonymised; your profile photo, addresses, cart, notification tokens, preferences and activity are deleted, as well as the files of your creator application. A shop's photos and videos are deleted within 12 months after the shop is closed |
| Orders, delivery addresses and billing data | 10 years from the transaction, in restricted-access archives, to meet our accounting and tax obligations, even after your account is deleted |
| Legal information of a shop that has made sales | 10 years from the transaction concerned |
| Technical logs | Short period: currently 7 days, according to our host's retention period |
| Inactive account | 3 years after your last login, after a notice email; the account is then anonymised (order data stays archived as indicated above) |
For a creator, account deletion is refused while an order or a payout of their shop is in progress; it can be requested again as soon as these obligations have been fulfilled. Buyers can delete their account at any time.
7. Your rights
You have the following rights:
- Access: know what data we hold about you
- Rectification: correct inaccurate data
- Erasure: delete your account, directly from the app (Profile, then the ⚙ icon at the top right, then "Paramètres" (Settings), "Zone de danger" (Danger zone) section, "Supprimer mon compte" (Delete my account) button; the app is currently in French only) or from the page https://agostina.store/delete-account
- Objection: object to processing based on our legitimate interest
- Restriction: ask for temporary freezing of processing
- Portability: receive your data in a reusable format
- Withdrawal of consent: at any time, for example by turning off notifications
- Post-mortem directives: define what happens to your data after your death
To exercise these rights: contact@agostina.store. We reply within one month and may ask you to prove your identity.
Portability: an automatic export tool is under development. Until then, every request is handled manually by email within the same period.
You can also lodge a complaint with the CNIL (cnil.fr), the supervisory authority in France.
8. Security
Password encryption, encrypted communications between the app and our servers, strict access control to the database, separation of access rights. If a data breach is likely to result in a high risk for you, we will inform you and the CNIL, as required by law.
9. Push notifications
Notifications are only sent if you allow them in your device settings. They concern your activity on Agostina: orders, shipments and payouts, and, if you turn on the bell on a shop's page, a daily notification when that shop publishes new content. The bell can be turned off with one tap on the same page. The other notifications can only be stopped in your device settings.
10. Minors
Agostina is reserved for adults. We do not knowingly collect data about minors; if we learn that an account belongs to a minor, we delete it.
11. Changes to this policy
We may change this policy, for example to reflect a change in the app or in the law. Any substantial change is shown to you in the app before it takes effect. The date of the last update appears at the top of the page.
12. Contact
contact@agostina.store