Privacy Policy
This page explains what data we collect, why, how long we keep it, and how to exercise your rights (GDPR, EU regulation 2016/679, and the French Data Protection Act). Last updated: October 4, 2026.
1. Data controller
The data controller is [NOM_COMPLET], a French sole trader operating under the trade name Tropiax, [ADRESSE_COMPLETE], [VILLE], France.
Contact for any question about your data: contact@tropiax.com.
2. Data collected, purposes, and legal bases
Orders
Data: name, email, delivery address, product ordered, amount.
Purpose: process and deliver your order, provide tracking, after-sales service, and handle returns.
Legal basis: performance of a contract (GDPR article 6.1.b); and legal obligation for accounting retention (6.1.c).
Payment
Data: card details are entered directly on Stripe's payment page. Tropiax never receives or stores any card data; we only receive payment confirmation.
Legal basis: performance of a contract.
Audience measurement (PostHog)
Data: page views, clicks, purchase journey, device type, approximate country, and session recording ("session replay") with sensitive fields masked.
Purpose: understand and improve how the site is used.
Legal basis: your consent (article 6.1.a), collected via the cookie banner. Without your consent, no measurement data is collected. You can withdraw it at any time.
Contact
Data: the information contained in your emails.
Purpose: respond to your requests.
Legal basis: legitimate interest (6.1.f) in responding to inquiries, or performance of a contract if it concerns an order.
Customer reviews
Data: displayed first name (chosen by the customer), rating, review text, link to the original order (not published).
Purpose: publish verified reviews on products, in line with articles L111-7-2 and L121-4 of the French Consumer Code.
Legal basis: your consent (article 6.1.a), collected via the checkbox when submitting the review. You may request deletion of your review at any time.
Security and abuse prevention
Data: IP address, used temporarily to limit the number of requests.
Legal basis: legitimate interest in protecting the site.
3. Retention periods
- Orders: 5 years from the order (commercial limitation period). Accounting records and proof of payment are kept for the applicable legal period (up to 10 years).
- Audience measurement: 12 months maximum.
- Customer reviews: as long as the product remains in the catalog; deleted or anonymized afterward.
- Email exchanges: 3 years after the last contact.
- Consent cookie: 1 year.
After these periods, data is deleted or anonymized.
4. Recipients and processors
Your data is never sold. It is only shared with providers who help us deliver the service:
- Stripe Inc. (United States) — card payment.
- Supabase Inc. (United States) — orders database.
- Vercel Inc. (United States) — site hosting.
- PostHog — audience measurement, EU Cloud offering (eu.i.posthog.com), data hosted in the European Union.
- Upstash Inc. — rate limiting (IP address, kept for a few minutes).
- CJ Dropshipping (China) — order preparation and shipping. Only the data necessary for delivery is shared: name, delivery address, product.
Carriers also receive the data necessary to deliver the parcel.
5. Transfers outside the European Union
Some providers are located outside the European Union. These transfers are governed as follows:
- Stripe, Supabase, Vercel (United States): European Commission standard contractual clauses, where applicable supplemented by the provider's adherence to the EU–US Data Privacy Framework.
- CJ Dropshipping (China): the transfer is limited to data strictly necessary for shipping (name, delivery address) and is based on the performance of the contract concluded with you (GDPR article 49.1.b): without this data, your parcel cannot be delivered.
You may request a copy of the applicable safeguards by writing to contact@tropiax.com.
6. Cookies and trackers
The site uses a limited number of cookies:
- tropiax_consent — remembers your choice regarding audience measurement. Duration: 1 year. Necessary for the banner to function and does not require consent.
- tropiax_admin_session — session for the admin area, reserved for the publisher. Duration: 7 days. Strictly necessary; it does not concern you as a visitor.
- Audience measurement trackers (PostHog) — only set if you accept them in the banner.
During payment, the page hosted by Stripe may set its own cookies necessary for security and fraud prevention; these are governed by Stripe's policy.
You can accept or decline audience measurement in the banner shown on your first visit, and change your choice at any time by deleting the tropiax_consent cookie in your browser: the banner will be shown again. Declining is as easy as accepting and does not restrict access to the site.
7. Your rights
You have the following rights over your data:
- access: obtain a copy of your data;
- rectification: correct inaccurate data;
- erasure: request deletion, subject to our legal retention obligations;
- objection: object to processing based on legitimate interest;
- restriction: request the temporary freezing of a processing activity;
- portability: receive your data in a reusable format;
- withdraw consent at any time, without affecting what took place before.
To exercise them, write to contact@tropiax.com. We may ask you for proof of identity in case of doubt. We respond within 30 days.
8. Security
Exchanges with the site are encrypted (HTTPS). Access to order data is restricted to the publisher, and payments are processed by Stripe, which manages the security of card data.
9. Complaint to the CNIL
If, after contacting us, you believe your rights are not being respected, you may file a complaint with the French data protection authority (CNIL): https://www.cnil.fr.
10. Updates
This policy may change; the last update date appears at the top of the page. See also our legal notice.