---
title: Privacy policy | CreativiTea
url: https://lochness-paris.com/custom-tea/privacy-policy.html
lang: en
---

# Privacy policy

Last updated: 10/2026

This policy covers CreativiTea (composer, gallery, pages, order requests) under the GDPR. Data controller: the publisher of the Application, a private individual (see the [legal notice](https://lochness-paris.com/custom-tea/legal-notice.html) ), reachable at contact@lochness-paris.com. The Application is a non-commercial test project.

## In short

- Creating and publishing a blend requires **no personal data** .
- Only the **order request** collects your contact details, to answer you.
- **No cookies** on public pages, no advertising, no third-party trackers. Fonts are hosted on our server.

## 1. Composing and publishing a blend

We store the composition (ingredients, proportions, moment) and publish it on a public page, without any name or contact details. To prevent abuse and count identical blends fairly, the server computes an **encrypted fingerprint** of your IP address (SHA-256 hash with a server-specific key): the address itself is never stored. The fingerprint is kept for 1 hour for the sending limit and 30 days for the counter. Legal basis: legitimate interest (security and proper operation of the service).

## 2. Order requests

**Data** : name, email, phone and message (optional), chosen bag size and blend, date of the request. **Purpose** : to reply to your request. As the Application is a test project, no sale results from it and nothing is charged. **Legal basis** : your consent (checkbox), which you may withdraw at any time. **Retention** : 12 months after our last exchange, then deletion. **Recipients** : the publisher only. Requests are stored with our host (OVH) and emailed to us through the Web3Forms service, acting on our behalf.

## 3. Audience measurement

We use **GoatCounter** , a cookie-free analytics tool: it counts page views and a few actions (such as "blend created" or "request sent") without identifying visitors or storing IP addresses. Legal basis: legitimate interest (improving the site). This kind of anonymous, limited measurement does not require consent.

## 4. Storage in your browser

If you use the light / dark button, your choice is kept in your browser (local storage "tea-theme"). It is never sent to us and you can erase it with your browsing data.

## 5. Security

Data is stored in a private folder on the server that cannot be reached from the web, and the administration area is password-protected. All traffic uses HTTPS.

## 6. Your rights

You may access, correct or erase your data, restrict or object to its processing, request portability and withdraw your consent at any time by writing to contact@lochness-paris.com. If you believe your rights are not respected, you may lodge a complaint with the State Data Protection Inspectorate of Lithuania (VDAI, vdai.lrv.lt) or with the authority of your country of residence.