Privacy Notice

1. Who is responsible

The controller of your personal data is the seller behind Dream Assets Studio, run by its founder Titouan Bruno Pin-Pin Fouques, 8 Grand Rue, 44400 Rezé, France. Email: support@dreamassetsstudio.com. Phone: +33 6 31 35 65 29. Full details are on the legal notice.

We have not appointed a data protection officer. For any privacy question, write to the email address above.

2. What we collect and why

When you buy a template

• What: your email address; the country you live in; the template or bundle, price and tax; your order number; the Stripe payment reference and payment status. Stripe tells us the payment method type, not your card number.
• Why: to take your order, deliver your templates, send the confirmation email and receipt, handle support, withdrawal and guarantee requests, and meet our accounting and tax obligations.
• Legal basis: performance of the contract and the steps before it (Article 6(1)(b) GDPR); our legal obligations for accounting and tax (Article 6(1)(c)).

Proof of what you confirmed at checkout

• What: the exact text of each box you ticked (personal use; terms and age; immediate access; loss of withdrawal right), the terms version, the time (UTC), your browser’s user agent and a hashed version of your IP address.
• Why: consumer law requires us to be able to prove that you asked for immediate access and acknowledged losing the right of withdrawal, and that you accepted the terms.
• Legal basis: legal obligation (Article 6(1)(c)) and our legitimate interest in being able to prove the contract (Article 6(1)(f)).

Downloads and access links

• What: when each file was downloaded or each Google Sheets or Notion link was opened through our download address, how many times, the order it belongs to, and a hashed IP address.
• Why: to apply the link limits (7 days, 5 uses per item), issue new links, prevent sharing beyond the licence, and know whether a download or access has started, which matters for the right of withdrawal.
• Legal basis: performance of the contract (Article 6(1)(b)) and our legitimate interest in preventing misuse (Article 6(1)(f)).

New-link requests

• What: the email address and order number you enter.
• Why: to find your order and send a new link to the email address on the order.
• Legal basis: performance of the contract (Article 6(1)(b)).

Contact form and custom template requests

• What: your name, email, the topic and order number if you give one, and your message. For custom requests: what you want to track or plan, the app, any examples or links, the timing and budget range you choose. A reference number and the time sent.
• Why: to reply to you and, for custom requests, prepare a quote.
• Legal basis: steps taken at your request before a contract (Article 6(1)(b)) and our legitimate interest in answering messages (Article 6(1)(f)).

Please don’t send us bank details, account numbers or health information through these forms. We don’t need them.

Withdrawal requests

• What: your name, email, order number, the template concerned, any note you add, and the date and time we received it.
• Why: to process your withdrawal, send you an acknowledgement and keep proof of it.
• Legal basis: legal obligation (Article 6(1)(c)).

Server logs and spam protection

• What: technical data your browser sends when you visit (IP address, date and time, page requested, browser type) and, for our forms, a hashed IP address used to limit repeated submissions.
• Why: to keep the site running and secure and to block spam and abuse.
• Legal basis: our legitimate interest in a secure website (Article 6(1)(f)).

We don’t make decisions about you by automated means alone, and we don’t build profiles.

3. What we never receive

What you type into a template stays with you. Excel and PDF files are on your own devices; we have no access to them. Google Sheets copies are in your Google account and Notion copies in your Notion workspace. Google and Notion are separate services with their own privacy policies, and they, not we, handle what you store there.

4. Who receives your data

• Stripe processes payments, calculates tax and sends receipts. Stripe acts as an independent controller for its own purposes, such as fraud prevention and its legal obligations, and as our processor for some services. Stripe’s privacy policy applies on its payment page.
• Our hosting provider stores the website, the order records and the files.
• Our email provider sends order emails, new-link emails and replies.
• Our accountant receives the order data needed for the accounts.
• Authorities when the law requires it.

We don’t sell your data, and we don’t share it for advertising.

5. Transfers outside the EU

Stripe may process some data in the United States. Those transfers are covered by the EU-US Data Privacy Framework, to which Stripe is certified, and by standard contractual clauses approved by the European Commission. If another provider transfers data outside the European Economic Area, we will name it here with the safeguard used.

6. How long we keep it

Data	How long
Orders and accounting records	10 years
Proof of what you confirmed at checkout	10 years, with the order
Orders that were never paid	30 days
Download and access-link records	24 months
Contact messages and custom requests (in our mailbox)	12 months after our last exchange
Examples and screenshots you send for a custom template	deleted after delivery, unless you ask us to keep them
Withdrawal requests	10 years, with the order
Server logs and form rate-limit records	30 days

If a custom template goes ahead, the quote and order records are kept as accounting records for 10 years.

7. Your rights

You can ask us to:

• give you a copy of the data we hold about you (access);
• correct inaccurate data (rectification);
• delete your data, where we’re not required to keep it (erasure);
• limit how we use it in certain cases (restriction);
• send you the data you gave us in a common format (portability);
• stop using it where we rely on our legitimate interest (objection).

Write to support@dreamassetsstudio.com. We reply within one month. We may ask you to confirm your identity, for example by writing from the email address on your order.

You can also give instructions about what happens to your data after your death, as French law allows.

If you’re not satisfied with our answer, you can complain to the French data protection authority, the CNIL (Commission Nationale de l’Informatique et des Libertés), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr, or to the authority in the EU country where you live.

8. Cookies

Our own pages set no cookies at all. We use no analytics or advertising, and the site loads no third-party scripts. Our fonts are served from our own server. That’s why there’s no cookie banner.

When you continue to Stripe’s payment page, you leave our site, and Stripe sets its own cookies there for payment and fraud prevention under Stripe’s cookie policy. The same applies to Google’s pages when you open a “Make a copy” link and to Notion’s pages when you open a “Duplicate” link.

9. Security

Card details never pass through our site. Download and access links use long random tokens tied to your order, and the files are stored outside the public part of the website. IP addresses in our logs are stored as hashes. Access to order records is limited to the people who need it.

10. Younger buyers

The shop is for adults. Buyers under 18 need a parent’s or guardian’s permission. We don’t knowingly collect data from children beyond what an order needs.

11. Changes

If we change this notice, we update the version and date below. If a change affects how we use data we already hold, we tell you by email first.

Version 1.0, 28 October 2026.