Orchard Couture
Gathering the collection…
Gathering the collection…
Last updated 27 May 2026
Orchard Couture ("we", "us", "the house") respects your privacy and handles your personal data under the EU General Data Protection Regulation (GDPR), the ePrivacy Directive, and the Irish Data Protection Act 2018.
We process your data to perform our contract with you (orders, delivery, returns), to comply with legal obligations (tax records, statutory consumer rights), and where you've consented (marketing, optional analytics, AI features). We do not sell your data.
Our sub-processors. Each operates under a written data-processing agreement (DPA).
The full, current sub-processor register is published at /legal/processors and updated whenever it changes. We notify account holders by email at least thirty days before adding a new sub-processor.
Where data leaves the EEA, we rely on the EU-US Data Privacy Framework or Standard Contractual Clauses, and we choose EU regions for storage wherever each provider supports it.
You may at any time: request a copy of your data, correct it, delete it, restrict or object to its processing, withdraw consent, or take your data elsewhere (portability). To exercise any right, sign in and use My Account → Privacy, or email privacy@orchardcouture.com. We respond within thirty days. You may also complain to the Irish Data Protection Commission (dataprotection.ie).
Order records are retained for seven years (Irish revenue requirement), after which we pseudonymise them. AI feature inputs are deleted after thirty days unless you saved them. Newsletter consent history is retained for three years after withdrawal. Account profiles are kept until you delete the account.
This site is intended for adult purchasers. We do not knowingly collect personal data from anyone under 16 (the GDPR digital-consent age in Ireland). AI features that process photographs are unavailable on children's pieces.
If we update this policy, the effective date at the top changes and we notify account holders by email of material changes.
Privacy enquiries: privacy@orchardcouture.com. General support: support@orchardcouture.com.
The third parties that process data on our behalf, the purpose, where data is held, and the transfer safeguard in place.
AI image generation, image editing, video generation, virtual try-on composites, AI room styling, AI vision pre-checks, prompt-driven copy assist.
Google Ireland Limited · Text (Gemini 2.5 Pro / 2.5 Flash): europe-west4 (Netherlands). Image (Imagen 4) and video (Veo 3): global / us-central1 — EU regions not yet available for these models; transfer covered by DPF. · transfer: MIXED
Data shared: Prompt text (no PII unless user submits it), User-supplied photo inputs for try-on (server-side, auto-deleted after 30 days), User-supplied photo inputs for room-styling (face-detection pre-check rejects any with detected faces; auto-deleted after 30 days), Brand voice context (admin-curated)
Aggregate web analytics for product performance and marketing measurement.
Google Ireland Limited · EU-region tagging via server-side GTM; data warehoused in US (DPF-covered). · transfer: DPF
Data shared: Pseudonymous user ID (post-consent only), Page-view events, Custom commerce events (post-consent only), IP address — anonymised (last octet stripped)
Delivery of transactional and marketing emails: order confirmation, shipping, password reset, newsletter, abandoned cart.
TBD · TBD — EU region preferred. · transfer: SCCS
Data shared: Customer name, Customer email, Order data (subject lines, links), Marketing consent state
Static site hosting and edge runtime for the customer storefront and admin app.
Vercel Inc. · Edge region dub1 (Dublin, Ireland). No customer data stored at rest. · transfer: DPF
Data shared: IP address (request logs only, short retention), User-agent strings, Request paths (no PII in URLs by design)
Hosting, application runtime, database, file storage, scheduled jobs, secret management, structured logging, build pipelines.
Google Ireland Limited · Firestore: eur3 (multi-region EU). Cloud Storage: europe-west1. Cloud Run: europe-west1. · transfer: EU-DOMESTIC
Data shared: Account email & uid, Order data (line items, addresses, totals), Wishlist & profile data, Try-on / room-design session metadata (inputs auto-deleted after 30 days), Analytics events (post-consent, hashed), Operational logs
Low-latency datastore (Redis over REST) holding ephemeral commerce state — the shopping bag, wishlist, recently-viewed list and recent searches — keyed to a user uid or an anonymous browser id.
Upstash, Inc. · EU region (eu-west-1 Ireland / eu-central-1 Frankfurt) chosen when the database is provisioned; data resides in the selected region. · transfer: SCCS
Data shared: Shopping bag contents (keyed to user uid or anonymous browser id), Wishlist items (keyed to user uid or anonymous browser id), Recently-viewed product ids, Recent search terms
CDN delivery and storage for product imagery, hero stills, hero videos, journal imagery, AI try-on / room-design outputs.
Cloudinary Ltd. · EU storage region enabled (eu-west). Delivery via global CDN. · transfer: SCCS
Data shared: Product imagery (no PII), AI-generated try-on outputs (linked to user uid, auto-deleted after 30 days unless user saves), AI-generated room-design outputs (linked to user uid, auto-deleted after 30 days unless user saves)
Card payment processing, Strong Customer Authentication (3DS), VAT calculation, invoices.
Stripe Payments Europe Limited · EU · transfer: EU-DOMESTIC
Data shared: Customer name, Customer email, Shipping & billing address, Order total & line items, IP address (fraud signal)
Realtime channels for admin monitoring, live order/inventory updates, presence.
Ably Real-time Limited · EU datacentres (Frankfurt, Dublin). · transfer: SCCS
Data shared: Channel message payloads (no PII by design — only system event metadata)
On-demand printing with EU production network. Order forwarding only.
Gelato Group AS · EU production network (Sweden, Spain, Germany, UK, Ireland-fast). · transfer: SCCS
Data shared: Customer name, Shipping address, Email (shipment notifications only), Order line items
On-demand printing and fulfilment of adopted apparel and home-goods products. Order forwarding only — no inventory.
Printful, Inc. · EU fulfilment for EU orders (Latvia, Spain). · transfer: SCCS
Data shared: Customer name, Shipping address, Email (for shipment notifications only; supplier may not marketing-email), Phone (where courier requires), Order line items (no card data, no DOB, no marketing-consent state)
On-demand printing via a network of print providers. Order forwarding only — no inventory.
Printify, Inc. · EU print providers selectable per adopted product. · transfer: SCCS
Data shared: Customer name, Shipping address, Email (for shipment notifications only), Order line items