Privacy Policy

1. Introduction

This Privacy Policy explains how the personal data of users of the websites flowgraines.fr and oretlienart.fr (the “Sites”) is collected, used and protected. It applies to all the services offered, including online courses, subscriptions, graphic packs and illustration commissions.

The game “La jardinerie”, available on the web and on Android with the same account, has its own dedicated privacy policy (in French), which supplements this one.

2. Data controller

The controller of the personal data collected through the Sites is:
Aurélien Bessonnet, sole trader (auto-entrepreneur) in France.
Business address: 18 place de la Fraternité, 78280 Guyancourt, France.
Email: contact@oretlienart.fr

3. Data collected

When you use the Sites and their services, the following categories of data may be collected:

• Identification data: first name, last name, email address and, if you provide it, the gender used to address you correctly in our texts. If you sign in with Google, your name and email address are provided by Google.
• Account data: creation date, email confirmation status, access granted (courses, packs, subscriptions). Your password is handled by Firebase Authentication: it is never visible or accessible to the publisher.
• Order and billing data: services purchased (courses, packs, commissions, subscriptions), amounts paid, date and time of payments, and technical payment information provided by Stripe. Card details are entered directly with Stripe: they are neither passed on to the publisher nor stored on the Sites.
• Newsletter subscription: email address and nickname, when you subscribe (for example to receive the free ebook).
• Browsing data: pages viewed, time of visits, technical information about your device and browser, collected by Google Analytics only if you have accepted it (see section 6).
• Security data: to check that requests really come from the Sites and not from a bot, the Firebase App Check service (Google reCAPTCHA v3) analyses technical signals from your browser and your interaction with the page. This check is invisible and is used only to block abuse.
• Commission data: information you provide when requesting a commission or a quote (brief, references, visual preferences, etc.).
• Correspondence: the content of messages sent through contact forms or by email, and the replies to them.
• Data from the game “La jardinerie”: what you write in the game and the feedback you send from it. This is described in its dedicated policy.

Some fields may be required to use a service (for example, an email address to create an account). They are marked as such when the data is collected.

4. Purposes and legal bases

The data collected is used for the following purposes:

• Managing user accounts (creation, access, authentication) to give access to courses, packs, subscriptions, order history and the game.
  Legal basis: performance of the contract (Terms of Use / Terms of Sale).
• Managing orders and payments: processing purchases of courses, graphic packs, subscriptions and commissions, issuing receipts or invoices, tracking payments.
  Legal basis: performance of the contract and legal obligations (accounting).
• Communicating with users: answering contact requests, sending information related to purchased services (order confirmation, practical information, important updates).
  Legal basis: performance of the contract and legitimate interest in providing customer follow-up.
• Newsletter: sending the free ebook and news from Flowgraines.
  Legal basis: consent, which you may withdraw at any time.
• Audience measurement: visit statistics (most viewed pages, browsing paths), only if you have accepted it.
  Legal basis: consent.
• Security of the Sites: protection against bots, fraud and unauthorised access (App Check).
  Legal basis: legitimate interest in protecting the Sites and their users’ accounts.
• Managing commissions and custom projects: reviewing requests, preparing and following up quotes, discussing the brief, delivering files.
  Legal basis: performance of the contract (or pre-contractual steps taken at your request).
• Compliance with legal obligations: keeping certain data to meet accounting, tax or legal requirements.
  Legal basis: legal obligation.

Your data is never sold, rented out or used for advertising.

5. Recipients and processors

The data collected is used by Aurélien Bessonnet for his business. It is also processed by the following technical providers, acting as processors:

• Google (Firebase): hosting of the Sites, authentication (Firebase Authentication), database (Cloud Firestore, hosted in Europe), file storage, server functions (hosted in Belgium), bot protection (App Check, reCAPTCHA v3) and, if you have accepted it, audience measurement (Google Analytics).
• Stripe: secure payment processing and subscription management.
• SMTP2GO: sending emails (account confirmation, order confirmations, download links, newsletter).

These providers only have access to personal data to the extent necessary to perform their services and are bound by confidentiality and security obligations.

6. Cookies and local storage

When you browse the Sites, cookies and local storage data (localStorage, sessionStorage, IndexedDB) may be saved on your device.

Strictly necessary items, which do not require your consent:

• your account sign-in session (Firebase Authentication);
• the content of your “Ma Récolte” selection, for the duration of your visit;
• your choice regarding audience measurement cookies;
• the technical elements of bot protection (reCAPTCHA).

Audience measurement: Google Analytics cookies (_ga, _ga_*) are only set once you have agreed, through the banner shown on your first visit. Without your agreement, Google Analytics is not loaded at all. These cookies last 13 months at most.

You can change your choice at any time: manage my cookies. If you withdraw your agreement, audience measurement stops and the _ga cookies are deleted.

7. Retention periods

Personal data is kept no longer than necessary for the purposes for which it is processed, subject to legal retention obligations:

• account and identification data: for as long as the account exists, and erased when it is deleted. An account whose email address has not been confirmed is deleted automatically, at the latest two weeks after it was created;
• order and billing data: 10 years, in accordance with accounting obligations;
• pack download links: deleted automatically after their expiry date;
• newsletter: until you unsubscribe;
• commission data and correspondence: for as long as needed to follow up the relationship and, where applicable, to defend our rights in the event of a dispute;
• audience measurement: cookies kept for 13 months at most, related statistics kept for 14 months at most by Google Analytics.

8. Your rights

Under the applicable regulations (in particular the GDPR), you have the following rights over your data:

• Right of access: to obtain confirmation that data about you is being processed and, if so, a copy of it.
• Right to rectification: to have inaccurate or incomplete data corrected.
• Right to erasure: to have your data deleted, including your account, within the limits set by law (invoices, in particular, must be kept).
• Right to object: to object to certain processing on grounds relating to your particular situation, or at any time to direct marketing.
• Right to restriction: to have processing temporarily suspended in certain situations.
• Right to data portability: to receive the data you have provided in a structured, commonly used and machine-readable format, or to have it transmitted to another controller where technically feasible.
• Withdrawal of consent: for the newsletter and audience measurement, at any time, without affecting processing already carried out.

You can delete your account yourself from “My Profile”: the steps and what is kept are described on the page Delete your account.

To exercise your other rights, or if you cannot sign in, write to contact@oretlienart.fr from the email address linked to your account. You will receive a reply within one month.

You also have the right to lodge a complaint with the French data protection authority, the CNIL (cnil.fr).

9. Location and transfers outside the European Union

The Sites’ database is hosted in Europe, and server functions run in Belgium.

Some providers may however process data from third countries: Google and Stripe (United States), SMTP2GO (New Zealand). These transfers are covered by safeguards recognised by the regulations: participation in the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses for the United States; a European Commission adequacy decision for New Zealand.

For more information about these transfers, you can contact contact@oretlienart.fr.

10. Data security

Technical and organisational measures are in place to protect personal data against loss, unauthorised access, disclosure or alteration: encrypted communications (HTTPS), data encrypted at rest by Google, access rules restricting each account to its own data, and bot protection (App Check).

Despite all reasonable efforts, no system is entirely free of risk. Users can also help keep their data safe by choosing a strong password, keeping it confidential and signing out after using a shared device.

11. Changes to this Privacy Policy

This Privacy Policy may change to reflect changes in the services offered, legal obligations or technical choices. The date of the last update is shown at the top of this page. In the event of a significant change, a notice will be displayed on the Sites.