Privacy Policy

Updated: 9 October 2026

This policy describes how Dalila Amoca, a sole trader (hereinafter “ Winslor”) collects, uses and protects the personal data of users of the winslor.com website and the online platform, in accordance with Regulation (EU) 2016/679 (GDPR) and the amended French Law No. 78-17 (Data Protection Act).

1. Data Controller

The data controller is Dalila Amoca, a sole trader, whose registered office is located at 47 rue Vivienne, 75002 Paris, France.

Contact: contact@winslor.com.

2. Data collected

Winslor collects the following categories of data:

• Identity and contact details: surname, first name, email address, telephone number (optional).
• Account data: login details, password (hashed), role, associated workspace(s).
• Billing data: company name, billing address, Stripe Customer ID (bank details are processed exclusively by Stripe and do not pass through our servers).
• Usage data: connection logs, IP address, device type, usage traces of features.
• User content: products, orders, shop settings, uploaded media.
• Communications: emails exchanged with support, contact forms, live chat messages.

With regard to our Clients’ end customers (buyers from hosted shops), Winslor acts as a data processor within the meaning of the GDPR on behalf of the Client, who remains the data controller.

3. Purposes and legal bases

• Provision of the Service (performance of a contract): account management, order processing, content hosting.
• Invoicing and fraud prevention (legal obligation and legitimate interest).
• Technical support (performance of a contract).
• Answering your questions (pre-contractual steps taken at your request): contact form and live chat.
• Improvement of the Service (legitimate interest), with aggregation/anonymisation measures.
• Marketing communications (consent, which may be withdrawn at any time).
• Invitation to review Winslor (legitimate interest): an invitation sent by Trustpilot no earlier than one month after your shop opens, followed by a single reminder a week later if you have not left a review; you may object to it at any time.
• Security and logging (legitimate interest).

4. Recipients and processors

Data may only be disclosed to authorised persons (internal Winslor teams) and to the following data processors, selected for their compliance with GDPR standards:

• Stripe Payments Europe Ltd (Ireland) — payment processing and invoicing.
• Resend Inc. (USA) — sending transactional emails and newsletters.
• Cloudflare, Inc. (USA, R2 network) — storage of uploaded files.
• Neon Inc. (USA / EU instance — Frankfurt) — PostgreSQL database.
• Vercel Inc. (USA) — frontend hosting.
• Railway Corp. (USA) — API hosting.
• DeepL SE (Germany) — machine translation of content produced.
• Google Ireland Limited (Ireland, with possible transfers to Google LLC in the USA) — Google Analytics audience measurement, only with your consent.
• Crisp IM SAS (France, data hosted in the European Union) — live chat on the site, only if you open it.
• Trustpilot A/S (Denmark) — sending, on Winslor's behalf, an invitation to review Winslor (name and email address shared).

5. Transfers outside the European Union

Some processors are located outside the European Union (notably in the United States). These transfers are governed by: adherence to the EU-US Data Privacy Framework, standard contractual clauses adopted by the European Commission, and/or additional technical safeguards (encryption at rest and in transit).

6. Retention period

• Account data: duration of the contractual relationship + 3 years for marketing purposes, unless you object.
• Billing data: 10 years (accounting and tax requirements).
• Log files: 12 months (LCEN requirement).
• Shop content: for the duration of the subscription, then 30 days after termination, followed by permanent deletion.
• Newsletter: until you unsubscribe.
• Audience measurement: 25 months for Winslor's native measurement; 14 months at most for Google Analytics.
• Live chat: 3 years after the last exchange.

7. Your rights

In accordance with the GDPR, you have the following rights:

• Access to your data and a copy thereof;
• Correction of inaccurate or incomplete data;
• Erasure under the conditions set out in Article 17 of the GDPR;
• Restriction of processing;
• Objection to processing on legitimate grounds and to direct marketing;
• Portability of your data in a structured format;
• Setting guidelines regarding the handling of your data after your death.

To exercise these rights, please write to contact@winslor.com, providing proof of your identity. We will respond within one month.

You also have the right to lodge a complaint with the CNIL (cnil.fr).

8. Cookies and trackers

The site uses trackers that are strictly necessary for it to work (merchant portal session, theme preference, language choice, storage of your cookie choices). They do not require your consent.

Winslor audience measurement. We measure traffic to the site with our own tool: pages viewed, referring site (the domain name only) and device type (phone, tablet or computer). No identifier is kept: a technical identifier specific to the browser tab, erased when the tab is closed, is used only to count the visitors present; neither your IP address nor the characteristics of your browser are recorded, and the data are neither combined with other processing nor passed on to third parties. They are kept for 25 months. This measurement meets the conditions for exemption from consent set by the CNIL (the French data protection authority); you can object to it at any time via the “Manage cookies” link at the bottom of every page.

Google Analytics. Only with your consent, we use Google Analytics (Google Ireland Limited) to produce detailed visit statistics and measure sign-ups. Google then sets cookies with a lifetime of 13 months at most and may transfer data to the United States under the EU-US Data Privacy Framework. No address parameter carrying a token or a payment identifier is sent to Google.

Live chat. The chat button at the bottom of the screen loads nothing until you click it. If you open it, the Crisp service (Crisp IM SAS) sets cookies, valid for 6 months, that let you find your conversation again; if you have exchanged messages in the last 30 days, a marker stored in your browser reloads the chat on the following pages so that our replies reach you. These cookies are necessary for the service you request and therefore do not require your consent.

You can give, refuse or withdraw your consent at any time via “Manage cookies”. Your choice is kept for 13 months. You can also set your browser to block cookies; some features may then be affected.

9. Security

Winslor implements appropriate technical and organisational measures to protect your data: TLS encryption in transit, encryption at rest, role-based access control, access logging, regular backups, and multi-tenant isolation at the application level.

In the event of a data breach likely to pose a risk to your rights and freedoms, you will be notified in accordance with Article 34 of the GDPR.

10. Changes to the policy

This policy may change. Any substantial changes will be posted on the website, and users with an account will be notified by email.