Privacy

This page describes what the site actually does, read off its own code rather than copied from a template. If something here does not match what you see, tell us and we will fix the page or the code.

Who is responsible

For anything on this page, write to team@molotovatelier.com.

When you buy something

Payment runs through Stripe. Your card details go to Stripe directly and never reach this site or any database we control. To complete an order Stripe collects your name, email, telephone number, billing address and delivery address, and we receive those back so the piece can be built, packed and sent.

The order is then stored in our own database: order number, the Stripe session and payment reference, your email, name, telephone, delivery address, the pieces and quantities, the totals, the order status and any tracking number or internal note we add while fulfilling it.

Why: to perform the contract you entered into, and to keep the accounting records the law requires.

When you create an account

Sign-in uses a one time link sent to your email address. There is no password to store. A profile holds your email, and whatever else you choose to put in it: name, telephone, delivery address, and whether you want to hear from us. Orders placed with the same email address are linked to the account so you can see them.

Why: to give you an account you asked for, and to perform the contract. The newsletter flag is consent, and you can switch it off on your account page at any time.

What we record while you browse

This is the part most sites are vague about, so here it is in full.

On your first visit the site generates a random identifier and stores it in your browser's local storage under the key molotov-vid. It is a random value. It carries no name, no email address and nothing taken from your device. It lets us count a person as one visitor across several pages instead of as several strangers.

Against that identifier the site records events as they happen: a page view, viewing a product, adding to or removing from the cart, opening the cart, starting checkout, abandoning checkout, a completed order, signing in, signing up, turning the sound on, and subscribing to the newsletter. With each event it stores the page path and, for some, a small detail such as which piece or how many. Alongside that it stores the page you first landed on, the site that referred you, your browser's user agent string and a two letter country code that our host derives from your connection.

We do not store your IP address, and we do not use advertising or cross-site tracking services. Nothing here is shared with an ad network.

If you sign in, that identifier is linked to your account, so the browsing recorded on that device becomes part of your account record.

Why: to see which pieces and guides people actually use and where an order falls apart, which is a legitimate interest in running the shop. You can object to it at any time, and you can stop it yourself by clearing site data for this domain or by blocking local storage in your browser.

Other things stored in your browser

Three more keys sit in local storage and never leave your device: molotov-cart holds what is in your cart, molotov-muted remembers whether you muted the music, and molotov-t remembers where the track was. No cookies are set by this site for analytics or advertising.

Email we send

Transactional email goes out through Resend: your sign-in link, a note when a piece leaves the workshop, and an internal notification to us when an order comes in. Marketing email only goes to people who have switched the newsletter on.

Who processes your data

Provider	What it does	What it sees
Stripe	Takes the payment	Card details, name, email, phone, billing and delivery address
Supabase	Database and sign-in, hosted in the EU, Ireland	Profiles, orders, visitors, events
Resend	Sends email	Your email address and the contents of the message
Vercel	Serves the site	Request data in transit, and supplies the country code

Some of these companies are established outside the European Economic Area. Where that means your data leaves the EEA, it is covered by the safeguards in each provider's data processing terms. We do not sell data to anyone, and nobody outside this list gets it except where the law requires it.

How long it is kept

• Orders and the accounting records around them are kept for as long as accounting and tax law requires. [TO BE COMPLETED] the retention period, which depends on the country of establishment.
• Your account is kept until you ask us to delete it.
• Visitor and event records are kept while they are useful. They are not deleted automatically today, which we would rather state plainly than pretend otherwise. Ask and we will remove the records tied to your identifier or your account.

Your rights

You can ask for a copy of what we hold about you, have it corrected, have it deleted, have its use restricted, have it sent to you in a portable form, and object to the browsing records described above. Write to team@molotovatelier.com and we will answer within a month. We will not ask you for more identification than we need to be sure it is you.

You can also complain to the data protection authority in the country where you live or work. We would rather you came to us first.

Changes

If the site starts doing something new with data, this page changes with it. The date at the top is when it last changed.