Legal

Privacy Policy

This policy explains what data we process when you use the Catch Feels store (account, orders, payments, shipping, security), how cookies work and how you can manage your consents.

Last updated: 8 October 2026

View Terms & Conditions Contact

Data controller and contact

The controller of your personal data is Catch Feels — Adam Zimniak, ul. Bobrzeckiej 9/20, 31-216 Kraków (the “Store”).

Contact on privacy matters: [email protected]

Who this policy applies to

This policy applies to people who use the website, in particular:

visitors (for example browsing products),
account holders (signing in, managing account data),
buyers (orders, payments, delivery, returns),
people who contact us (for example by e-mail about an order).

What data we process

1) Account and sign-in

e-mail address,
profile details, if you save them in your account: first name, last name, company, phone and address,
password (if you set one) – stored as a secure hash, never as a plain-text password,
e-mail code sign-in: we send a short code and verify it (the code is not stored in plain form in the database),
session data (for example session tokens), kept by the Auth.js / NextAuth mechanism.

2) Orders and customer service

ordered products, variants, quantities, amounts, discounts, order status,
engraving text and technique, if you order an engraved product,
the chosen delivery method (for example DPD / InPost) and the pickup point/locker identifier (if applicable),
the e-mail address used to communicate about the order (also for a guest – it may be completed from the payment data),
details entered in the Stripe payment form: first name, last name, delivery address and phone number (the phone number is needed by the courier),
return requests: the returned products, the reason (if you give one) and the parcel number.

Product reviews

the rating, the text of the review and the name you enter in the form yourself (optional; without a name the review appears as “Customer”),
once approved, the review together with the name is published on the product page – we never publish your e-mail address; you can ask for a review to be removed by writing to the contact address.

3) Payments

payments are handled by an external provider (Stripe) – we do not store card numbers,
in our systems we may store transaction identifiers (for example the session/Payment Intent identifier) for settlement and order handling.

4) Technical data and security

IP address, browser and basic technical data of requests (for protection against abuse),
anti-spam / rate-limiting mechanisms (for example when sending sign-in codes or confirming payments),
logs/audit of administrative actions or error diagnostics (where they occur).

Purposes and legal bases

We process data only to the extent needed to run the store and fulfil orders. Legal bases:

Performance of a contract (Article 6(1)(b) GDPR) – accepting and fulfilling an order, payment, delivery, returns, account handling.
Legal obligation (Article 6(1)(c)) – for example keeping accounting documents/settlements (where applicable).
Legitimate interests (Article 6(1)(f)) – security, preventing abuse, establishing/defending legal claims, basic diagnostics, an aggregate page-view counter without an identifier, and publishing product reviews.
Consent (Article 6(1)(a)) – optional cookies/analytics and marketing identifiers (only if you accept them).

Providing the data needed to place an order (e-mail, delivery address, phone) is voluntary, but without it we cannot fulfil the order. You provide any other data, including cookie consents, only if you want to.

Who we may share data with

We use trusted service providers who process data on our behalf or as separate controllers (for example the payment provider). In practice these may be:

Stripe – payment provider and checkout form (payment data, e-mail, delivery address/phone depending on the checkout configuration).
Delivery providers (for example DPD, InPost) – to the extent necessary to ship the order (for example address/phone or a pickup point identifier).
E-mail delivery provider (Resend) – to send transactional messages (sign-in codes, password reset, confirmations).
Cloudinary – hosting of product photos and videos. Your browser downloads them directly from Cloudinary's servers, so your IP address reaches them when a page is displayed – regardless of your cookie consent, because this is simply loading an image, not tracking.
OpenStreetMap – map tiles for the InPost parcel locker map. When you open the map, your browser downloads them from OpenStreetMap's servers, so your IP address reaches them (the United Kingdom has a European Commission decision finding an adequate level of data protection).
Hosting/infrastructure (Hetzner, Cloudflare) – running the servers, logs, backups and the database.

We always try to minimise the data we share (only what is needed to provide the service).

Transfers of data outside the EEA

Some services (for example the Stripe payment provider, the Resend e-mail provider or Cloudinary photo/video hosting) may process data on infrastructure located outside the European Economic Area, including in the USA. In such cases appropriate safeguards are used (for example standard contractual clauses or the provider's participation in the Data Privacy Framework), as described in the given provider's documentation. The parcel locker map (OpenStreetMap) is served from the United Kingdom, for which the European Commission has found an adequate level of data protection.

How long we keep data

Account: until the account is deleted at your request (write to the contact address) or the data is no longer useful, subject to legal requirements.
Paid orders: for the period needed for settlements, handling complaints/returns and as required by tax and accounting rules – as a rule 5 years from the end of the year in which the sale took place.
Cancelled and unpaid orders (no payment, refund or complaint): 180 days from cancellation, then deleted automatically.
Sign-in and registration codes: we delete them one day after the code expires at the latest. Password reset links: 7 days after expiry at the latest (they are valid for one hour).
Attempt-limit counters (rate limiting): 7 days.
Security event log (sign-ins, administrative actions, errors; with IP address and browser): 180 days.
Analytics events, with consent (page views, add-to-cart, purchases – linked to the visitor identifier cf_aid): 90 days from being saved, then deleted automatically. Withdrawing consent deletes them immediately, without waiting for that period.
Aggregate page-view counter (without an identifier – see the section “The only thing we count without consent” below): 730 days. Longer than the consent-based analytics data, because this counter contains nothing that could be linked to a person.
The record of your cookie decision: we record only the decision itself (which categories you chose, when and how) – without an IP address, browser or e-mail address, even if you were signed in. We keep this entry for 180 days.

Age

The Store is not directed at children and does not knowingly collect data of people under 16. Where the basis for processing is consent (for example to analytics or marketing cookies) and the person giving consent is under 16, the consent should be given or confirmed by a parent or legal guardian.

Creating an account and placing an order is the conclusion of a contract, not consent within the meaning of the GDPR – the rules on age and legal capacity when concluding a contract are in the Terms & Conditions.

Your rights

Within the limits of the law you can exercise your rights regarding personal data (including access to data, rectification, erasure, restriction of processing, objection and data portability). Where we process data on the basis of consent, you can withdraw it at any time (withdrawal does not affect the lawfulness of processing before the withdrawal).

Write to us at: [email protected].

If you believe the processing infringes the law, you can also lodge a complaint with the supervisory authority in your country of residence (in Poland: the President of the Personal Data Protection Office, PUODO).

Cookies and similar technologies

The website uses cookies and similar mechanisms (for example localStorage) to make the store work. Some of them are necessary, and some are optional and start only after you consent.

Necessary (always active)

session and security cookies related to signing in (Auth.js / NextAuth) – the account does not work properly without them,
security settings and protection against abuse,
the record of your cookie choice – the cf_consent cookie (valid for 180 days). It is necessary: it remembers that you did not consent and lets us respect that choice on the server side too,
local helper data, for example for resuming a payment (such as an order identifier saved in the browser's storage).

Optional (after your consent)

Analytics – help us understand how the site is used (for example page views, basic events). Visitor identifier: cf_aid. In addition, cf_ses marks a single visit and expires by itself after 30 minutes of inactivity – it tells us how many pages were viewed in one go, without tying that to you as a person.
Marketing – save where you came from (UTM parameters, referring page, ad click identifier) in the cf_mkt cookie. If you place an order, we save that source together with the order – it stays there as transactional data, so we know which ad paid off. Without marketing consent we do not save it either in the browser or with the order.

Without your consent these identifiers are not created at all, and our server rejects saving any analytics data. When you withdraw consent, we delete not only the cookies in your browser but also the data previously collected under your identifier.

The only thing we count without consent – and why we are allowed to

We keep an aggregate page-view counter: for each day we record how many times a given subpage was displayed and whether this happened on a phone, tablet or computer. That is all – one number per row.

There is no identifier in it: no visit number, no IP address and no information about your browser. We also do not save anything on your device. From such a counter it is impossible to reconstruct that two page views came from the same person – which is why it does not require consent. We need it to know how much traffic we really have, not only as much as we see thanks to people who agreed to analytics.

We determine the device type on the server from the browser header (user-agent). The header itself is not stored – only one word goes into the database: “phone”, “tablet” or “computer”. This also applies to analytics data collected with consent.

Everything we save in your browser

Below is everything – every single item. The list is generated directly from the site's code, so it cannot drift away from reality.

Name	Type	Category	Lifetime	Purpose
`authjs.session-token`not accessible to page scripts	cookie	Necessary	30 days from your last visit	Keeps you signed in. On HTTPS it carries the __Secure- prefix. The period counts from your last visit: every visit to the site extends it by another 30 days. The account does not work without it.
`authjs.csrf-token`not accessible to page scripts	cookie	Necessary	until you close the browser	Protects the sign-in forms from being impersonated by another site (CSRF). On HTTPS it is named __Host-authjs.csrf-token.
`authjs.callback-url`not accessible to page scripts	cookie	Necessary	until you close the browser	Remembers which page to return to after you sign in. On HTTPS it carries the __Secure- prefix.
`cf_guest_orders`not accessible to page scripts	cookie	Necessary	30 days	A signed proof that this browser placed an order without an account — it lets you return to the payment, see the confirmation and report a return. You can also recover it on a new device with a code sent by e-mail (/orders/lookup).
`NEXT_LOCALE`	cookie	Necessary	180 days	Remembers the site language (Polish/English). It is created when you click the PL/ENG switcher in the menu, and also automatically when your browser reports a language other than Polish or you open an address with the /en prefix directly.
`cf_consent`	cookie	Necessary	180 days	Remembers your cookie decision. Necessary: it is what remembers that you said “no” and lets us respect that on the server side too.
`catchfeels-cart`	browser storage	Necessary	until the cart is cleared	The cart of a signed-out visitor. After you sign in it is merged into the cart on your account and deleted.
`catchfeels-cart-bundles`	browser storage	Necessary	until the cart is cleared	Bundles in the cart of a signed-out visitor. After you sign in they are merged into the cart on your account and deleted.
`cf_pending_checkout_guest_v1`	browser storage	Necessary	24 hours (removed on your next visit to the cart)	The number of an order you started but have not paid yet — it lets you return to the payment.
`cf_pending_checkout_user_v1_<e-mail address>`	browser storage	Necessary	24 hours (removed on your next visit to the cart)	The same for a signed-in user. The address in the key name keeps the orders of two accounts using the same browser apart.
`catchfeels-pickup`	browser storage	Necessary	until you clear the browser data	The InPost parcel locker and DPD Pickup point you chose last (the point's code and address), so you do not have to choose it again for your next order. It stays only in your browser.
`cf_breathe_hide_until`	browser storage	Necessary	until the stored date passes	Remembers that you hid the breathing widget, and until when it should stay hidden.
`cf_breathe_never`	browser storage	Necessary	indefinitely	Remembers your “don't show again” choice for the breathing widget.
`cf_breathe_session`	browser storage	Necessary	up to 30 minutes of inactivity	Counts the time you spend browsing the store, so the breathing widget appears only after 20 minutes. Purely an interface adjustment — it creates no identifier and sends nothing to the server.
`cf_pending_checkout`	browser storage	Necessary	24 hours (removed on your next visit to the cart)	An older version of the started-order key, from before it was split into guest and signed-in account. Still read for returning visitors and migrated to the proper key at the next opportunity, then deleted.
`cf_aid`	cookie	Analytics	365 days	A random visitor identifier that lets us tell a returning visit from a new one. It is created only after you consent to analytics; when you withdraw consent we delete it together with the data collected under it.
`cf_ses`	cookie	Analytics	30 minutes from last activity	A random number for a single visit, renewed on every page view. It lets us count how many pages were viewed during one visit without tying that to you as a person. It is created only after you consent to analytics and deletes itself after 30 minutes of inactivity.
`cf_mkt`	cookie	Marketing	30 days from your last visit coming from an ad or external link	Remembers where you came to the site from (UTM parameters, referring page, ad click identifier). Every further visit from an ad or external link renews it for 30 days. When you place an order we save this source together with the order, so we know which ad paid off.

The “do not track me” signal from your browser (GPC / DNT)

If your browser sends the Global Privacy Control or Do Not Track signal, we treat it as an answer of “necessary only”: we do not show the banner and do not start anything optional.

In that case we do not save even the cookie decision on your device – you have not made one, so there is nothing to remember. If, despite the signal, you want to enable some of the optional cookies, you can do so in “Cookie settings” in the footer; such a conscious choice outweighs the signal and we will then remember it.

How to change your cookie settings

You can change your decision at any time: click “Cookie settings” in the footer of the page and save a new choice.

If you prefer to withdraw consent completely instead of choosing “necessary only”, click “Withdraw consent” in the “Cookie settings” window – we will delete the saved decision entirely, and the banner will appear again the next time you visit the site.

You can also manage cookies in your browser settings (remember, however, that blocking necessary cookies may make it impossible to sign in or place an order).

Changes to this policy

We may update the privacy policy when the store's features or the way data is processed change (for example when analytics tools are added). We always publish the current version on this page together with the date of the update.

This policy is available in Polish and English. Both versions are equally binding; in the event of any discrepancy, the version more favourable to you applies.

Questions? Write to us Back to top ↑