PRIVACY
POLICY.

Controller: Avare Studio OÜ, Järvevana tee 9, 11314 Tallinn, Estonia, registry code 17622190, info@avare.co.

[Placeholder: data protection contact, if any]

Data we process, depending on what you use:

• Orders: name, email, phone, delivery address, ordered items, prices and VAT, payment status, acceptance of the Terms and Privacy Policy with time and version.
• Customer account: name, email, phone, addresses, preferences, bag and saved items.
• Newsletter (double opt-in): email, source, consent version, request and confirmation time, hashed IP address.
• Withdrawal notices, contact messages and back-in-stock requests: the details you enter.
• Security: hashed IP address for rate limits; security checks by Google reCAPTCHA Enterprise when you submit a form.
• Visit statistics (only with consent): counts of visits and views, with a daily changing hash of IP address and browser kept for at most 3 days.

[Placeholder: purposes and legal bases (Art. 6 GDPR) for each processing]

Service providers that process data for us:

• Google Ireland / Google LLC — Firebase Hosting, Authentication, Cloud Firestore (database located in the EU, multi-region eur3), Cloud Functions, App Check / reCAPTCHA Enterprise.
• Stripe — payment processing.
• Resend — sending of order, account and service emails.
• Carriers and customs agents — delivery of your order.

[Placeholder: transfers to third countries and safeguards (e.g. EU–US Data Privacy Framework, standard contractual clauses)]

[Placeholder: retention periods (orders/accounting records, account data, newsletter, contact messages, withdrawal records, back-in-stock requests: deleted after notice or after 12 months)]

You have the right of access, rectification, erasure, restriction, data portability and objection, and you can withdraw consent at any time. Signed-in customers can download their data and close their account on the account page. Write to info@avare.co or use the contact form (“Privacy / data request”).

You can complain to a supervisory authority, for example the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

[Placeholder: final wording]

See the Cookie Notice.