Datenschutzerklärung
Last updated: 5 October 2026
Diese Seite gibt es nur auf Französisch und Englisch. Hier steht die englische Übersetzung; maßgeblich ist die französische Fassung.
Who is responsible
The controller is Ody Labs, 47 rue Vivienne, 75002 Paris (see the legal notice). For any question, or to exercise your rights: hello@irisup.com.
What we do with your data
1. Making your artwork from the photo of your eye
Data: the photograph of your eye, the iris crop and the artworks generated from it, the automatic quality check of the photo, and the IP address it was sent from (to limit abuse).
Why: to check that the photo can make a good print, then to generate the artwork you asked for. We never use the photo to recognise or identify you: no biometric template is computed or kept.
Legal basis: steps taken at your request before a contract, then the contract if you order (GDPR art. 6(1)(b)).
Retention: 30 days after upload if you do not order that artwork; if you do, 30 days after delivery (time to handle a print defect). Deletion is automatic.
Recipients: our data host (Supabase Inc.), and Google Cloud (Vertex AI), which checks the photo's quality and generates the artwork from it, processing it in the European Union. Google does not receive your name, email or address, and its Google Cloud terms exclude using these images to train its models. The printer only ever receives the finished artwork, never the photo.
2. Signing in with your email
Data: your email address, a one-time code (of which we keep only a hash) and a session cookie.
Why: to send you your artwork and order, and to stop anyone else generating artworks in your name. Legal basis: pre-contractual steps and the contract (6(1)(b)).
Retention: the code, 24 hours; the session, 30 days; an account with no order, 30 days after your last visit.
Recipients: Resend, which delivers the emails.
3. Processing, making and delivering your order
Data: name, shipping address, phone, email, order contents and amount, parcel tracking, and the date and version of the terms you accepted.
Why: to take payment, have your order printed and shipped, keep you informed and handle after-sales. Legal basis: the contract (6(1)(b)), then our accounting and tax obligations (6(1)(c)).
Retention: 10 years for accounting records (French Commercial Code, L123-22). Photographs and print files follow the retention in point 1.
Recipients: Shopify, which runs the payment page; Gelato and its partner print shops, which print and ship; the carriers; Resend for order emails.
4. Payment
Payment happens on Shopify's secure page. We never see or store your card details. Shopify processes them under its own privacy policy (opens in a new tab).
5. Answering you (chat and email)
Data: your messages, the email you leave to receive the answer and, for the chat, your IP address, browser and the pages viewed during the conversation.
Why: to answer your questions. Legal basis: our legitimate interest in providing customer service, or pre-contractual steps when the question is about an order.
Retention: 3 years after the last exchange. Recipients: Brevo (chat) and OVHcloud (our mailbox).
The chat loads only when you click the “Chat” button: no Brevo script runs before that.
6. Running and securing the site
Data: IP address, browser and requested pages, in the host's technical logs. Why: security and troubleshooting. Legal basis: legitimate interest (6(1)(f)). Retention: the host's log retention, a few days.
We use no audience measurement, no advertising pixel and send no newsletter. No decision with legal effect is made automatically: the automatic photo check can only ask you to take another one.
Providers and transfers outside the European Union
| Provider | Role | Where the data is | Safeguard for transfers |
|---|---|---|---|
| Supabase Inc. | Database and photo storage | Paris (France) | Support access from abroad: standard contractual clauses |
| Vercel Inc. | Hosting | Paris (France), US company | EU-US Data Privacy Framework |
| Google Cloud (Vertex AI) | Photo quality check and artwork generation | European Union, US company | EU-US Data Privacy Framework |
| Shopify | Payment page | Ireland, Canada | Adequacy decision (Canada) |
| Gelato | Printing and shipping | Norway (EEA) and print shops in the EU | European Economic Area |
| Resend | Email delivery | United States | [TO VERIFY: DPF or standard contractual clauses] |
| Brevo | Customer-service chat | Belgium, France, Germany | Support access from India and the US: standard contractual clauses |
| OVHcloud | Mailbox hello@irisup.com | France | — |
| Cloudflare | Redirects irisup.art, .fr and .eu | Global | EU-US Data Privacy Framework |
We do not sell or rent your data, and we do not use it for advertising.
Your rights
You may request access to your data, its correction or erasure, the restriction of its processing, and its portability, and you may object to processing based on our legitimate interest. You may also set instructions for what happens to your data after your death. Write to hello@irisup.com from the address you used on the site: we answer within one month. Your photos and artworks are erased immediately on request, except for an order being made; accounting records must be kept for the legal period.
If you believe your rights are not respected, you may lodge a complaint with the French data protection authority, the CNIL — cnil.fr (opens in a new tab) — or with the authority of your own country.
Minors
The site is for adults only. If you photograph someone else's eye, you need their consent — their parents' for a minor. In a Duo you send two people's eyes: you confirm, by ticking a box, that both agreed, and we record when. We process the other person's photograph only to make this print, under the same retention as yours.