Privacy policy.

Last updated: 2 November 2026

This policy explains what personal data rafsdesign.com collects, why, who helps me process it and what your rights are. Questions or requests: [email protected].

1. Who is responsible

Raf (RafsDesign), a designer registered as a sole trader in France, is responsible for the personal data described here. My full legal details appear on every invoice and are available on request.

2. What I collect and why

• Contact form and project questionnaire: your name, email address, a link to your product if you give one, and your answers and message. I use them to reply to you and to prepare a proposal.
• Emails you send me: your email address and whatever you choose to include. I use them to reply and, if we work together, to do the work.
• Payments: when you book through Stripe, Stripe collects your name, email address, billing address, business name and tax ID if you give them, and your payment details. I receive everything except your full card details, which I never see. I use this to deliver the work and to issue invoices.
• Client work: the access, files and information you share for a project are used only to do that work, as set out in the terms.
• Visiting the site: the hosting provider processes technical data such as your IP address and browser type to deliver the pages and protect the site. I don't use analytics or advertising tools, and I don't track you across other sites.

I don't sell your personal data.

3. Legal bases

• Replying to your request and preparing a proposal: steps taken at your request before a contract.
• Doing the work and handling payment: performance of our contract.
• Keeping invoices and accounting records: legal obligation.
• Spam protection and site security: my legitimate interest in keeping the site and inbox safe.

4. Services that process data for me

• Cloudflare: hosts the site and forwards email sent to [email protected].
• Formspree: receives the contact form and questionnaire and sends them to my inbox.
• Google: reCAPTCHA checks that form submissions aren't spam (it loads only on the pages with a form). Google Fonts serves the site's typeface. Gmail is my inbox.
• Stripe: processes payments and issues receipts and invoices.
• Vimeo: plays the walkthrough videos on two case study pages, with its "do not track" setting turned on.

Each of these services handles data under its own privacy policy. Some are based in, or process data in, the United States. They rely on safeguards recognised under EU law, such as the EU-US Data Privacy Framework or standard contractual clauses.

5. Cookies and local storage

The site itself sets no cookies. After you send a form, your browser remembers it for the current tab only, so the page doesn't ask you to send it again; this is cleared when you close the tab. reCAPTCHA and Vimeo may set their own cookies when they load. Stripe's checkout runs on Stripe's own site, under its own cookie policy.

6. How long I keep it

• Enquiries that don't lead to work: up to 3 years after our last exchange.
• Client records, invoices and accounting documents: 10 years, as French accounting law requires.
• Project files: for as long as we work together, and afterwards only as long as needed for follow-up work or as agreed with you.

7. Your rights

You can ask to access, correct or delete your personal data, to restrict or object to its use, or to receive a copy in a portable format. Email [email protected]. Some records, such as invoices, must be kept for legal reasons.

You can also complain to the French data protection authority, the CNIL, or to the authority where you live.

8. Changes

I'll update this policy when the site or the services I use change. The date at the top shows the current version.