Privacy policy

This privacy policy explains what this store collects, why it collects it, how long it keeps it, and the eight rights you have over it.

Last updated 17 September 2026. This privacy policy explains what personal data this demonstration store handles, why, and what you can ask us to do with it.

Who is responsible for this privacy policy

The controller is Pavels Web Solutions, Romania. Write to team@pavels.ro for anything related to your data.

The short version

This is a demo. No real purchase takes place and nothing is shipped, so we only need the data the features you try actually use. You can explore most of the store without giving us anything at all.

What we collect and why

• Cart and checkout: the products in your cart and, if you place a test order, the name, email, phone and addresses you type in. Used to run the checkout flow and show the order in your account. Stripe receives the payment details you enter in its form. In test mode no real payment is processed.
• Account: name, email, a password stored as a one way hash by WordPress, saved addresses, phone, an optional date of birth for the birthday coupon, profile photo if you upload one, orders, subscriptions, wishlist, coupons and loyalty level.
• Referrals: your referral code, how many times your link was opened, and which accounts registered through it.
• Notifications: your in app notifications, your notification preferences and, if you allow push notifications, the push subscription your browser gives us.
• Contact form: your name, email, company if you add it, and your message.
• Security: the sign in and contact forms use Altcha, a proof of work check that runs on our own servers and does not track you. Our servers also keep short technical logs, such as IP address and requests, to keep the site secure.
• Analytics: only if you allow it in the cookie settings, Google Analytics 4 measures visits and page use. See the cookie policy.

Legal basis

Running the features you choose to use, such as an account, a test order or a subscription, is based on providing the service you asked for. Security logs and answering contact messages are based on our legitimate interest in running a safe demo and replying to people who write to us. Analytics, marketing cookies and push notifications are based on your consent, which you can withdraw at any time.

Who else processes it

• Our hosting providers, which run the WordPress and storefront servers.
• Stripe, for the payment form in test mode.
• Our email delivery provider, for account, order and contact emails.
• Google, for Analytics, only with your consent.
• The push service built into your browser, such as those run by Google, Mozilla or Apple, only if you enable push notifications.

We do not sell personal data and we do not share it for advertising. Some of these providers may process data outside the European Economic Area, under the safeguards the GDPR requires, such as standard contractual clauses.

How long we keep it

Test orders, accounts and related data stay until you delete your account, ask us to remove them, or we reset the demo, whichever comes first. Contact messages are kept for up to twelve months after the conversation ends. Security logs are kept for a short period and then rotated.

Your rights

You can ask for access to your data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Write to team@pavels.ro and we will answer within one month. You also have the right to complain to the Romanian data protection authority, ANSPDCP, or to the authority in the country where you live.

Children

Our drinks contain caffeine. The store is not meant for anyone under 18, and we do not knowingly collect data from anyone under that age.

The privacy policy in short

Under this privacy policy, an account stores a name, an email address and the addresses you enter. An order stores what you bought and what you paid. Nothing here is sold, and nothing is shared beyond the processors that run the shop.

The rights this privacy policy gives you are the ones the General Data Protection Regulation gives you: access, rectification, erasure, restriction, portability, objection, a say over automated decisions, and the right to complain to a supervisory authority.

Asking us to act on them

To use any right in this privacy policy, write to the address on the contact page. Deleting an account removes the profile and anonymises the orders behind it, because an invoice has to keep existing even when the person behind it asks to be forgotten. What gets stored in your browser is in the cookie policy.