Privacy Policy
Last updated 27 May 2026
Orchard Couture ("we", "us", "the house") respects your privacy and handles your personal data under the EU General Data Protection Regulation (GDPR), the ePrivacy Directive, and the Irish Data Protection Act 2018.
What we collect
- Order details — name, email, delivery address, phone (where required by courier). Used to fulfil and deliver your order.
- Payment details — card payments are processed by Stripe. Card numbers never touch our servers.
- Account details — if you create an account, we store your profile and addresses to make future orders easier.
- Contact messages — anything you send through our contact form, email or live chat.
- Usage data — privacy-respecting analytics, only after you give cookie consent.
- AI feature inputs — selfies (Virtual Try-On, adult products only) and room photos (AI Room Styling). Stored in your account for thirty days only, then auto-deleted, unless you save a result to "My fittings".
How we use it
We process your data to perform our contract with you (orders, delivery, returns), to comply with legal obligations (tax records, statutory consumer rights), and where you've consented (marketing, optional analytics, AI features). We do not sell your data.
Who we share it with
Our sub-processors. Each operates under a written data-processing agreement (DPA).
- Google Cloud Platform (Ireland) — hosting, database, storage, scheduled jobs
- Gemini Enterprise Agent Platform (Google Ireland) — AI imagery, virtual try-on, room styling, brand voice
- Vercel (US, DPF-covered) — edge hosting for the storefront
- Cloudinary (Israel, EU storage region) — media CDN
- Stripe Payments Europe Limited (Ireland) — card processing
- Ably Real-time Limited (UK) — realtime channels
- Google Analytics (Ireland) — only with your analytics-cookie consent
- Printful, Printify, Gelato — only for orders containing items they fulfil; data limited to name, address, email, phone if courier-required, and the order line items
- Our transactional email provider, our domain DNS, our backup provider
The full, current sub-processor register is published at /legal/processors and updated whenever it changes. We notify account holders by email at least thirty days before adding a new sub-processor.
International transfers
Where data leaves the EEA, we rely on the EU-US Data Privacy Framework or Standard Contractual Clauses, and we choose EU regions for storage wherever each provider supports it.
Your rights
You may at any time: request a copy of your data, correct it, delete it, restrict or object to its processing, withdraw consent, or take your data elsewhere (portability). To exercise any right, sign in and use My Account → Privacy, or email privacy@orchardcouture.com. We respond within thirty days. You may also complain to the Irish Data Protection Commission (dataprotection.ie).
Retention
Order records are retained for seven years (Irish revenue requirement), after which we pseudonymise them. AI feature inputs are deleted after thirty days unless you saved them. Newsletter consent history is retained for three years after withdrawal. Account profiles are kept until you delete the account.
Children
This site is intended for adult purchasers. We do not knowingly collect personal data from anyone under 16 (the GDPR digital-consent age in Ireland). AI features that process photographs are unavailable on children's pieces.
Changes
If we update this policy, the effective date at the top changes and we notify account holders by email of material changes.
Contact
Privacy enquiries: privacy@orchardcouture.com. General support: support@orchardcouture.com.
Sub-processors
The third parties that process data on our behalf, the purpose, where data is held, and the transfer safeguard in place.
AI image generation, image editing, video generation, virtual try-on composites, AI room styling, AI vision pre-checks, prompt-driven copy assist.
Google Ireland Limited · Text (Gemini 2.5 Pro / 2.5 Flash): europe-west4 (Netherlands). Image (Imagen 4) and video (Veo 3): global / us-central1 — EU regions not yet available for these models; transfer covered by DPF. · transfer: MIXED
Data shared: Prompt text (no PII unless user submits it), User-supplied photo inputs for try-on (server-side, auto-deleted after 30 days), User-supplied photo inputs for room-styling (face-detection pre-check rejects any with detected faces; auto-deleted after 30 days), Brand voice context (admin-curated)
Aggregate web analytics for product performance and marketing measurement.
Google Ireland Limited · EU-region tagging via server-side GTM; data warehoused in US (DPF-covered). · transfer: DPF
Data shared: Pseudonymous user ID (post-consent only), Page-view events, Custom commerce events (post-consent only), IP address — anonymised (last octet stripped)
Delivery of transactional and marketing emails: order confirmation, shipping, password reset, newsletter, abandoned cart.
TBD · TBD — EU region preferred. · transfer: SCCS
Data shared: Customer name, Customer email, Order data (subject lines, links), Marketing consent state
Static site hosting and edge runtime for the customer storefront and admin app.
Vercel Inc. · Edge region dub1 (Dublin, Ireland). No customer data stored at rest. · transfer: DPF
Data shared: IP address (request logs only, short retention), User-agent strings, Request paths (no PII in URLs by design)
Hosting, application runtime, database, file storage, scheduled jobs, secret management, structured logging, build pipelines.
Google Ireland Limited · Firestore: eur3 (multi-region EU). Cloud Storage: europe-west1. Cloud Run: europe-west1. · transfer: EU-DOMESTIC
Data shared: Account email & uid, Order data (line items, addresses, totals), Wishlist & profile data, Try-on / room-design session metadata (inputs auto-deleted after 30 days), Analytics events (post-consent, hashed), Operational logs
Low-latency datastore (Redis over REST) holding ephemeral commerce state — the shopping bag, wishlist, recently-viewed list and recent searches — keyed to a user uid or an anonymous browser id.
Upstash, Inc. · EU region (eu-west-1 Ireland / eu-central-1 Frankfurt) chosen when the database is provisioned; data resides in the selected region. · transfer: SCCS
Data shared: Shopping bag contents (keyed to user uid or anonymous browser id), Wishlist items (keyed to user uid or anonymous browser id), Recently-viewed product ids, Recent search terms
CDN delivery and storage for product imagery, hero stills, hero videos, journal imagery, AI try-on / room-design outputs.
Cloudinary Ltd. · EU storage region enabled (eu-west). Delivery via global CDN. · transfer: SCCS
Data shared: Product imagery (no PII), AI-generated try-on outputs (linked to user uid, auto-deleted after 30 days unless user saves), AI-generated room-design outputs (linked to user uid, auto-deleted after 30 days unless user saves)
Card payment processing, Strong Customer Authentication (3DS), VAT calculation, invoices.
Stripe Payments Europe Limited · EU · transfer: EU-DOMESTIC
Data shared: Customer name, Customer email, Shipping & billing address, Order total & line items, IP address (fraud signal)
Realtime channels for admin monitoring, live order/inventory updates, presence.
Ably Real-time Limited · EU datacentres (Frankfurt, Dublin). · transfer: SCCS
Data shared: Channel message payloads (no PII by design — only system event metadata)
On-demand printing with EU production network. Order forwarding only.
Gelato Group AS · EU production network (Sweden, Spain, Germany, UK, Ireland-fast). · transfer: SCCS
Data shared: Customer name, Shipping address, Email (shipment notifications only), Order line items
On-demand printing and fulfilment of adopted apparel and home-goods products. Order forwarding only — no inventory.
Printful, Inc. · EU fulfilment for EU orders (Latvia, Spain). · transfer: SCCS
Data shared: Customer name, Shipping address, Email (for shipment notifications only; supplier may not marketing-email), Phone (where courier requires), Order line items (no card data, no DOB, no marketing-consent state)
On-demand printing via a network of print providers. Order forwarding only — no inventory.
Printify, Inc. · EU print providers selectable per adopted product. · transfer: SCCS
Data shared: Customer name, Shipping address, Email (for shipment notifications only), Order line items