Privacy Policy

1. Who is responsible for your data

Goods by Loft is operated by YOUNESS NEBGUI, sole trader, Morocco ("we", "us"). We are the data controller for the personal data described in this policy, except payment data, for which Paddle acts as an independent controller. Contact: support@goodsbyloft.com.

2. What we collect and why

• Order data: when you buy a product, we receive your email address and details of what you bought (not your payment details) so we can deliver your files and keep proof of delivery. Legal basis: performance of a contract.
• Payment data: your card or payment details are collected and processed directly by Paddle.com, our merchant of record and payment processor. We never see or store your full payment details. Paddle's processing is described in the Paddle Privacy Policy.
• Contact messages: if you email us or use the contact form, we keep your name, email and message to answer you. Legal basis: legitimate interest in responding to inquiries.
• Technical data: our hosting provider (Cloudflare) processes IP addresses and request logs to serve the site securely and prevent abuse. Legal basis: legitimate interest in running a secure website.

We do not run advertising trackers and we do not sell personal data.

3. Cookies

Our own pages do not set marketing or analytics cookies. When you open the checkout, Paddle may set cookies that are strictly necessary to process your payment securely and prevent fraud.

4. Who we share data with

• Paddle (merchant of record): payment processing, tax handling, receipts and payment-related customer service.
• Cloudflare: website hosting, content delivery and secure file storage for the products you download.
• Resend: our transactional email provider, used to send your download link and reply to messages.

Each provider processes data under its own contractual safeguards. Where data is transferred outside the EEA/UK, the providers rely on recognized transfer mechanisms such as Standard Contractual Clauses.

5. How long we keep data

Order records (email address, product, date) are kept for as long as needed to prove delivery, handle refunds and meet accounting obligations, then deleted. Contact messages are kept for up to 24 months after the conversation ends. Server logs are retained briefly by our hosting provider under its standard retention.

6. Your rights

If you are in the EEA, UK or another jurisdiction with similar laws, you have the right to access, correct, delete, or receive a copy of your personal data, to restrict or object to processing, and to withdraw consent where processing is based on consent. To exercise any right, email support@goodsbyloft.com. We respond within 30 days. You also have the right to lodge a complaint with your local data protection authority. For rights relating to payment data, you can also contact Paddle directly via their privacy page.

7. Security

The site is served over HTTPS. Product files are stored in private cloud storage and delivered through time-limited, signed download links. Payments are handled entirely on Paddle's PCI-compliant infrastructure.

8. Children

Our store is not directed at children under 16, and we do not knowingly collect their data.

9. Changes to this policy

If we change this policy, we will update the effective date above. Significant changes will be highlighted on this page.