Privacy Notice
The short version
We collect what we need to sell you a template, deliver it, answer you and keep the records the law asks for. We don't use analytics, advertising or tracking cookies. Stripe handles payments; we never see your card number. You can ask to see, correct or delete your data at office@primedigitallabs.com.
1. Who is responsible
The controller of your personal data is Prime Digital Labs, trading as PixelMint Lab, 65 Av. de Sierre, 07200 Aubenas, France. Email: office@primedigitallabs.com. Phone: +33 7 71 05 95 71.
We have not appointed a data protection officer. For any privacy question, write to the email address above.
2. What we collect and why
When you buy a template
- What: your email address; whether you buy for personal use or for a business; your country; for businesses, the name of the company, and the VAT number if you enter one on Stripe’s page; the template, licence, price and tax; your order number; the Stripe payment reference. Stripe tells us the payment status and the payment method type, not your card number.
- Why: to take your order, deliver the files, send the confirmation email and invoice, handle support, withdrawal and guarantee requests, and meet our accounting and tax obligations.
- Legal basis: performance of the contract and the steps before it (Article 6(1)(b) GDPR); our legal obligations for invoices and tax (Article 6(1)(c)).
Proof of your consents at checkout
- What: the exact text of each box you ticked, the version of the terms, the time (UTC), your browser’s user agent and a hashed version of your IP address.
- Why: French consumer law requires us to be able to prove that you asked for immediate access and acknowledged the loss of the right of withdrawal, and that you accepted the terms.
- Legal basis: legal obligation (Article 6(1)(c)) and our legitimate interest in being able to prove the contract (Article 6(1)(f)).
Downloads
- What: when each file was downloaded, how many times, the order it belongs to, and a hashed IP address.
- Why: to enforce the link limits (7 days, 5 downloads per file), issue new links, prevent unauthorised sharing of files and know whether a download has started (which matters for the right of withdrawal).
- Legal basis: performance of the contract (Article 6(1)(b)) and our legitimate interest in preventing misuse (Article 6(1)(f)).
New-link requests
- What: the email address and order number you enter.
- Why: to find your order and send a new link to the email on the order.
- Legal basis: performance of the contract (Article 6(1)(b)).
Contact and custom-work forms
- What: the name you give, your email, optional phone, company, the topic or service, your message and answers about your tools, data sources, deadline and budget. A reference number and the time sent.
- Why: to reply to you and, for custom work, prepare a quote.
- Legal basis: steps taken at your request before a contract (Article 6(1)(b)) and our legitimate interest in answering messages (Article 6(1)(f)).
Withdrawal requests
- What: the name you give, your email, order number, the template concerned, any message, and the date and time we received it.
- Why: to process your withdrawal, send you an acknowledgement and keep proof of it.
- Legal basis: legal obligation (Article 6(1)(c)).
Server logs and spam protection
- What: technical data your browser sends when you visit (IP address, date and time, page requested, browser type) and, for our forms, a hashed IP address used to limit repeated submissions.
- Why: to keep the site running and secure and to block spam and abuse.
- Legal basis: our legitimate interest in a secure website (Article 6(1)(f)).
We do not make decisions about you by automated means alone, and we do not build profiles.
3. Who receives your data
- Stripe (Stripe Payments Europe, Ltd., Ireland) processes payments, calculates tax and issues receipts and invoices. Stripe acts as an independent controller for its own purposes, such as fraud prevention and its legal obligations, and as our processor for some services. Stripe’s own privacy policy applies on its payment page.
- Our hosting provider stores the website, the order records and the files.
- Our email provider sends order emails, new-link emails and replies.
- Our accountant receives invoice and order data needed for the accounts.
- Authorities when the law requires it.
We do not sell your data, and we do not share it for advertising.
4. Transfers outside the EU
Stripe may process some data in the United States. Those transfers are covered by the EU-US Data Privacy Framework, to which Stripe is certified, and by standard contractual clauses approved by the European Commission. If another provider transfers data outside the European Economic Area, we will name it here with the safeguard used.
5. How long we keep it
| Data | How long |
|---|---|
| Orders, invoices and accounting records | 10 years |
| Proof of consent at checkout | 10 years |
| Download logs | 24 months |
| Contact and custom-work messages | 12 months after our last exchange |
| Withdrawal requests | 10 years, with the order |
| Server logs and form rate-limit logs | 30 days |
| Messages caught as spam | 7 days |
If a custom-work project goes ahead, the quote and project records are kept as business records for 10 years.
6. Your rights
You can ask us to:
- give you a copy of the data we hold about you (access);
- correct inaccurate data (rectification);
- delete your data, where we are not required to keep it (erasure);
- limit how we use it in certain cases (restriction);
- send you the data you gave us in a common format (portability);
- stop using it where we rely on our legitimate interest (objection).
Write to office@primedigitallabs.com. We reply within one month. We may ask you to confirm your identity, for example by writing from the email address on your order.
You can also give instructions about what happens to your data after your death, as French law allows.
If you are not satisfied with our answer, you can complain to the French data protection authority, the CNIL (Commission Nationale de l’Informatique et des Libertés), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr, or to the authority in the EU country where you live.
7. Cookies
Our own pages set no cookies at all. We use no analytics or advertising, and the site loads no third-party scripts. Our fonts are served from our own server. That is why there is no cookie banner.
When you continue to Stripe’s payment page, you leave our site. Stripe sets its own cookies there for payment and fraud prevention, under Stripe’s cookie policy. The same applies to Google’s pages when you open a Google Sheets “Make a copy” link.
8. Security
Payment card data never passes through our site. Download links use long random tokens tied to your order, and the files are stored outside the public part of the website. IP addresses in our logs are stored as hashes. Access to order records is limited to the people who need it.
9. Children
The shop is meant for adults and businesses. We do not knowingly collect data from children.
10. Changes
If we change this notice, we update the version and date below. If a change affects how we use data we already hold, we tell you by email first.
Version 1.0, 28 October 2026.