Hanae
Blog
← Back to home

Translation provided for information only; only the French version is legally binding. Read the French version

GDPR

Privacy policy

This policy describes the processing of personal data carried out in connection with the hanae.paris website and the Hanaé mobile app (together, the “Service”), in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act (loi Informatique et Libertés).

Data controller

Théophile Marchand-Arvier, sole trader (entrepreneur individuel, EI) trading under the name Hanaé (hereinafter “Hanaé”) · SIREN 882 790 363 · 68 chemin de la Grande Roche, 74170 Saint-Gervais-les-Bains, France · email: bonjour@hanae.paris · phone: +33 7 81 90 24 15.

Customer data

We collect the data needed for the Service:

  • Account and orders: email address, first name, last name, phone number, order history and, if you sign in with Apple or Google, the identifier provided by that service.
  • Delivery: the recipient’s name, address and phone number, delivery instructions, card message.
  • Payment: Hanaé does not store any bank details. Payments, subscriptions and tips are processed by Stripe, which sends Hanaé the status and amount of payments.
  • Subscription: bouquet, size, frequency, delivery day and address, subscription status.
  • Proof of delivery: photograph taken by the courier when handing over the bouquet, with the hand-over time. Some of these photos, cropped to the bouquet with no person, address or door number visible, may be published on the site as examples of our deliveries (and are then kept for as long as they are published); you can object by writing to bonjour@hanae.paris.
  • Conversations: messages and attachments exchanged with customer service or with the courier during delivery, complaints.
  • Reviews: rating, optional comment and date. Reviews with a comment are published on the website with the author’s first name (see the terms of use).
  • Referrals and promotional codes: referral code, codes used, link between referrer and referred person, rewards granted. The referrer’s first name is shown on their public referral page and in the preview of the link they share.
  • Technical data: IP address (security and limiting the number of requests), approximate location derived from the IP address (city, region, country) for real-time traffic measurement, app notification tokens.
  • Audience measurement: page views and usage events (browsing, adding to basket, ordering), language, landing page and referring site, linked to a random identifier and not to your name or email address, via PostHog.
  • Advertising measurement (website, with your consent): when you arrive through a Google ad, the identifier of the click on the ad, attached to your order; on payment, the order amount and reference sent to Google Ads, without your name or contact details.

Recipient data

When you have a bouquet delivered to another person, you give us their name, address, phone number and your message. This data is used solely to prepare and carry out the delivery and to contact the recipient if there is a difficulty. It is your responsibility to inform the recipient of this. This data is kept for as long as the order to which it relates.

Purposes and legal bases

  • Performance of the contract (art. 6-1-b GDPR): management of the account, orders, subscriptions, delivery and proof of delivery, payment, customer service, complaints, referrals and promotional codes, tips.
  • Legal obligation (art. 6-1-c): retention of accounting records, responding to requests to exercise your rights.
  • Legitimate interest (art. 6-1-f): security of the Service, prevention of fraud and abuse, publication of customer reviews, emails to our customers ahead of their next occasions (see below), recruitment and management of partners (see below).
  • Consent (art. 6-1-a): audience measurement, advertising measurement, non-essential cookies, other marketing communications. Consent may be withdrawn at any time.

Emails ahead of your next occasions

Once you have ordered from Hanaé, we may email you about products similar to the ones you bought: one week before the anniversary of a delivery, before Valentine’s Day, Grandmothers’ Day, Mother’s Day (French dates) and Christmas, and one month after your first order. These emails rely on our legitimate interest and on article L.34-5 of the French Postal and Electronic Communications Code; you are told about them when you order or, if you ordered before they were introduced, by the first of these emails, which lets you opt out in one click. They use your email address, first name, language, the dates of your orders and the first name of their recipient. We write at most once every 14 days, and not if you have just ordered.

Every email contains an unsubscribe link that takes effect immediately, in one click. You can also object at any time by writing to bonjour@hanae.paris. Emails about your orders (confirmation, delivery) are not affected. The history of these emails is kept with your account data.

Recipients of the data

Data is processed by Hanaé. The partners who prepare and deliver orders under Hanaé’s supervision each receive, as far as they are concerned, the delivery data (recipient’s name, address and phone number, instructions, card message) strictly necessary to prepare and deliver the order. Data is also processed on behalf of Hanaé by the technical processors listed below. Hanaé does not sell or rent any personal data.

Processors

  • Supabase: database, authentication, file storage (including proof photos) and server functions, hosted in the European Union (Ireland).
  • Vercel: website hosting.
  • Stripe: payments, subscriptions and refunds (PCI-DSS certified).
  • Resend: sending transactional emails and sign-in links.
  • Expo: delivery of the app’s push notifications.
  • Apple: Sign in with Apple and, on iPhone, notifications and the live order-tracking activity (status, estimated time, position of the courier and of the delivery address) via Apple’s notification service.
  • Google: Sign in with Google, address autocompletion and geocoding, and travel-time calculation (Google Maps Platform).
  • OpenStreetMap: display of the delivery-tracking base map (your IP address is sent to the map server).
  • Upstash: limiting the number of requests, based on the IP address and, depending on the case, the email address or an order or account identifier.
  • PostHog: audience measurement, data hosted in the European Union.
  • Google Ireland Limited: measurement of orders that come from our Google Ads ads, on the website and only with your consent (see the cookie policy).
  • Twilio: where applicable, sending text messages to the recipient about the delivery.
  • Sentry: where applicable, tracking of technical errors.

Transfers outside the European Union

Some processors (in particular Vercel, Stripe, Resend, Expo, Apple, Google, Upstash, Twilio and Sentry) are established in the United States or may transfer data there. These transfers are governed by the EU–US Data Privacy Framework where the processor participates in it or, failing that, by the European Commission’s standard contractual clauses.

Retention periods

  • Account data: as long as the account is active, then deleted 3 years after the last activity.
  • Orders and invoices: 10 years for the data required for accounting (legal obligation); recipient data follows the order.
  • Proof-of-delivery photos: 90 days after delivery, then deleted.
  • Messages: one year after the conversation is closed; attachments are deleted 180 days after closure.
  • Reviews: as long as they are published; if the account is deleted, the review is kept without the author’s first name.
  • Audience measurement: 13 months maximum. Real-time traffic data (approximate location) is deleted after one hour.
  • IP addresses used to limit requests: for the duration of the limiting window.

Deleting your account, from your personal area in the app and on the website, erases or anonymises the account data; order data required for accounting is kept without your email address or phone number.

Business partners and couriers

This section informs businesses and couriers, whether partners or prospects, of the processing that concerns them (articles 13 and 14 GDPR).

  • Prospective businesses: to identify future partners, Hanaé collects public business data from the Google Maps listings of flower shops (shop name, address, phone number, website, rating and number of reviews, opening hours). Purpose: recruiting partners. Legal basis: legitimate interest. You may object to this processing at any time by writing to bonjour@hanae.paris.
  • Preparation partners: business contact details, orders entrusted, ratings and internal notes on the quality of arrangements and on incidents. Purpose: managing the partner relationship. Legal basis: performance of the contract and legitimate interest.
  • Couriers: identity, contact details, photo, vehicle, supporting documents (ID, insurance, contract, bank details form), last four digits of the IBAN, deliveries made, pay, ratings and incidents. During a delivery, the courier’s position is collected and shared with the end customer, from a few minutes after departure until the bouquet is handed over. The live position is erased when the delivery ends (at the latest two hours after its last update); recorded positions are kept for 7 days at most. Purpose: organising deliveries, real-time tracking by the customer, pay. Legal basis: performance of the contract, legal obligations and legitimate interest.
  • Retention: for the duration of the partnership and then 3 years, subject to accounting records kept for 10 years; for prospects who did not follow up, 3 years from the last contact.

Cookies and audience measurement

The website uses cookies that are strictly necessary for it to work (session, authentication, referral code) and, with your consent, audience measurement tools (PostHog) and advertising measurement (Google Ads). Your choice is collected through a consent banner and can be changed at any time from the “Manage cookies” link in the footer. In the app, audience measurement is only enabled after your consent, which can be changed at any time from the Account tab. Full details: cookie policy.

Without cookies or consent, we also measure the checkout journey anonymously, to improve it: steps reached, errors shown, abandonment, country and referring site. No field you type is sent, and the identifier, drawn at random each time the page opens, cannot be used to recognise you. Retention: 13 months. With your consent, the checkout page may also be recorded in PostHog (clicks, movements, scrolling), with input fields masked.

Automated decisions

Hanaé does not take any decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you.

Your rights

Under the GDPR, you have the right of access, rectification, erasure, restriction, objection and portability of your data, the right to withdraw your consent at any time, without affecting the lawfulness of prior processing, and the right to give instructions regarding what happens to your data after your death.

To exercise these rights: bonjour@hanae.paris. We reply within one month of receiving the request; this period may be extended by two months given the complexity or number of requests, in which case you will be informed. You may lodge a complaint with the CNIL, the French data protection authority · cnil.fr.

Last updated: October 2026.