Privacy Policy

Last updated: 2026-06-16

This policy explains how we process your personal data under GDPR (Regulation 2016/679).

1. Data controller

The controller is Ambar Blart (unregistered business, Poland). Contact: ambar.blart@gmail.com.

2. Data we process

Email, name, invoicing data (optional), transaction data (Stripe — no card data), account data (if you sign up), server logs (IP, user-agent), analytics (if you consent to cookies).

3. Purposes & legal bases

Performance of the sales contract (Art. 6(1)(b) GDPR), legal obligations — keeping records for 5 years (Art. 6(1)(c)), legitimate interest — security and claims (Art. 6(1)(f)), consent — newsletter, analytics cookies (Art. 6(1)(a)).

4. Recipients

Stripe Payments Europe Ltd (Ireland) — payments. Supabase / Lovable Cloud — database and auth hosting (EU). Transactional email providers. Data may be transferred to the US (Stripe) under Standard Contractual Clauses.

5. Retention

Transaction data — 5 years from end of fiscal year. Account — until deletion. Newsletter — until consent withdrawal.

6. Your rights

Right of access, rectification, erasure, restriction, portability, objection, and to lodge a complaint with the Polish DPA (uodo.gov.pl) or your local authority. Requests: ambar.blart@gmail.com.

7. Cookies

See the Cookie Policy.

8. Automated decisions

No automated decision-making under Art. 22 GDPR. No marketing profiling.

9. Private Commissions form

If you send an enquiry through the Private Commissions form, we process: full name, email address, and optionally phone/WhatsApp, country, city, project type, approximate dimensions, preferred wood species, project description and an optional reference photo. The legal bases are steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in handling business correspondence (Art. 6(1)(f)). The data is stored in our Supabase database (Lovable Cloud, EU); any photo is kept in private file storage and is never publicly accessible. A notification about the enquiry is sent to an internal Ambar Blart mailbox. Enquiry data is retained for 3 years from the last contact unless you ask for erasure earlier.

Ambar Blart · ambar.blart@gmail.com