Privacy Policy

Last updated: September 30, 2026

Woudya ("we", "us") operates the website woudya.com. This page explains how we handle your data.

What we collect

• Orders: When you purchase a product, we collect your name, email, shipping address, and payment information. Payment is processed by Stripe, we never see or store your card details.
• Newsletter: If you sign up, we store your email address to send occasional updates. You can unsubscribe at any time.

Audience measurement

We measure visits with our own server (a Cloudflare Worker), without cookies and without any third-party analytics service. Three measurements are active: page views, visit journeys, and the campaign that brought you, kept in your browser and attached to your order.

Page views

Each page you open sends one record to our server, and so do some shop actions: adding to cart, going to the payment page, coming back from it (paid, cancelled or abandoned), and following a link to another shop. We keep each record for 90 days, then it is deleted automatically. A record contains:

• the type of event, its exact time, the page address (without its query string), and the domain of the site that sent you, if any;
• for shop actions, the products and quantities in your cart, the cart total and, for an abandoned payment, the time elapsed since you left for the payment page;
• the campaign tags of the link you followed (utm_source, utm_medium, utm_campaign, utm_content), if present;
• the country of your connection and your device type (mobile, tablet or desktop);
• a short fingerprint of your IP address, recalculated each day. Your IP address itself is not stored, but this fingerprint is the same for all pages you open from the same connection on the same day, so the records of that day can be grouped by connection. Because it is derived from your IP address, we treat these records as personal data.

We use these records to count visits and pages, and to see which sites and campaigns bring visitors. Legal basis: our legitimate interest in understanding and running our shop (Article 6(1)(f) GDPR). You can object at any time by writing to [email protected]; see also "Your rights" below.

Visit journeys

To find where our pages fail visitors, we record the path of each visit on woudya.com, page by page. This runs without asking you first. It is for our internal statistics only: we do not use it for advertising or profiling, we do not share it, and we do not link it to your order, your payment or your email.

• Visit identifier: a random identifier created by your browser for this visit and kept in session storage. It is erased when you close the tab; a new tab or a new visit gets a new identifier. It is not linked to your name, email, order or IP address. Because this identifier groups the events of one visit, we treat these records as personal data.
• What is recorded under this identifier: the time of each report and, relative to it, of each event; the pages you open (address without its query string) and the time each stays visible; how far you scroll (25, 50, 75, 100 %); a few actions: add to cart (product reference), size choice (its position in the list), delivery country chosen, the pay button, links followed (internal page, or only the host name of an external site); whether the payment page opened, and whether you came back from it paid or cancelled, as reported by your browser; JavaScript error types from a fixed list and the site script that raised them; the country of your connection; your device type (mobile, tablet or desktop); the source of your visit, reduced to a fixed list (for example "google", "instagram", "direct"; anything else counts as "other").
• Never recorded: nothing you type, no email or address, no error message, no payment detail, no session recording, and no IP address. Your IP address is only used in memory to filter automated traffic and limit abuse, then discarded.
• Retention: each record is deleted automatically 30 days after it is written.
• Legal basis: our legitimate interest in finding and fixing what fails on our shop (Article 6(1)(f) GDPR).
• Your choice: nothing is recorded if your browser sends Global Privacy Control or Do Not Track. You can also turn it off on this browser (turn it back on); this choice is kept in local storage. It does not affect the page-view records above.

Campaign attached to your order

When you arrive through a link carrying a referral tag (ref) or campaign tags (utm_source, utm_medium, utm_campaign, utm_content), your browser keeps these values in its local storage. They have no expiry date: they stay until a new tagged link replaces them or you clear this site's data in your browser. For the current tab only, your browser also keeps, in session storage, the domain of the site that sent you and the first page you opened on woudya.com.

• At checkout: these values are sent with your order to our payment server and stored with your payment in Stripe, so they are linked to your order, and therefore to you as a buyer. Values that look like an email address or a phone number are dropped before this step. They are kept as long as the order record.
• Shop actions: they are also added to the page-view records of shop actions described above (for example adding to cart), including on later visits from the same browser.
• Purpose: knowing which campaign or partner led to a sale.
• Your choice: clearing this site's data in your browser removes them. The opt-out link of visit journeys does not affect them.

Basket reminder

On product pages and in the basket, below the optional email field, a box that is unticked by default lets you ask for a reminder of your basket and news of new Woudya batches. Leaving it unticked changes nothing to your order or your payment.

• What we store, only if you tick the box and enter a valid email: your email address, the date, the page and its language, the country of your connection, the delivery country you chose if any, the products and quantities in your basket (no prices), and the exact text you agreed to with its time, as proof of your consent. Your IP address is not stored.
• Purpose: sending you a reminder of that basket and news of new batches. For now no email is sent: your address is only recorded with your consent. Before any first email, we will ask you to confirm your address, and without that confirmation we send you nothing. We do not share this data and use it for nothing else.
• Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw it at any time; this does not affect what was done before you withdrew it.
• Retention: until you unsubscribe, and at most 24 months after the last time you gave your consent. The record is then deleted automatically.
• Unsubscribe: through the link in each of these emails once they exist, which erases your record at once, or at any time by writing to [email protected].
• Where: on our server hosted by Cloudflare (see "Who we share data with").

How we use your data

• To fulfill and ship your orders
• To send you order confirmations and shipping updates
• To send newsletter emails (only if you opted in)
• To send a basket reminder and news of new batches (only if you ticked the box, and after you confirm your address; no such email is sent yet)

Who we share data with

• Cloudflare: Hosting of the website and of our measurement server, which stores the records described above
• Stripe: Payment processing
• Shipping carriers: Name and address for delivery

We do not sell, rent, or share your personal data with anyone else.

Your rights (GDPR)

If you are in the EU, you have the right to access, correct, or delete your personal data. Contact us at [email protected] and we will respond within 30 days.

Cookies

We do not use cookies for measurement. Visit journeys use session storage, and local storage only to remember your opt-out. The campaign attached to your order uses local storage without expiry, as described above. Stripe may set functional cookies required for payment processing.

Contact

For any privacy-related question: [email protected]

← Back to Woudya