Privacy policy
Last updated May 13, 2026
This policy explains what personal data we collect on sochateaux.com, how we use it, who can access it, and how you can exercise your rights under the General Data Protection Regulation (Regulation EU 2016/679, the GDPR).
Data controller
Heritage Avenue SRL, Strada Memorandumului 20, 400114 Cluj-Napoca, Romania, acts as the data controller for personal data processed on sochateaux.com. Contact for privacy matters: contact@sochateaux.com.
What we collect
When you create an account
- Email address, name, password (stored as a one-way hash)
- Profile fields you choose to fill: avatar, bio, location, social links
- Audience segments you select to personalise content and newsletter
- Email verification status and timestamps
When you interact with content
- Likes, favorites, comments, follows, and the items they relate to
- Notification preferences per channel and per event type
- Push subscription endpoints if you opt in to push notifications
When you make a purchase
- Billing name and address (required for invoicing)
- Order history, including products, prices, and VAT applied
- Payment processing is handled by Stripe Payments Europe, Ltd. We never see or store full card numbers.
- For Strategy Calls: scheduling details and the answers you provide on the pre-call form
Technical data
- IP address (kept short-term for security and abuse prevention)
- User-agent and basic device information for compatibility
- Audit logs for moderation actions and security events
- Anonymous audience measurement, only if you accept analytics cookies
Why we use this data and the legal basis
- Performance of a contract (Art. 6(1)(b)): account creation, order processing, delivery of digital products and Strategy Calls.
- Legal obligations (Art. 6(1)(c)): invoice retention, VAT reporting, response to lawful requests.
- Legitimate interests (Art. 6(1)(f)): security, fraud prevention, spam and abuse mitigation, basic site reliability monitoring.
- Consent (Art. 6(1)(a)): analytics, marketing or audience-tracking cookies, push notifications, marketing emails beyond transactional messages. Consent can be withdrawn at any time.
Who can access your data
We share data only with the service providers we need to operate the site:
- Vercel Inc. (United States): hosting and content delivery.
- Neon Inc. (United States, on AWS): primary database.
- Stripe Payments Europe, Ltd. (Ireland): payment processing and invoicing.
- Resend, Inc. (United States): transactional and newsletter email delivery.
- Mapbox, Inc. (United States): map rendering for chateau pages.
- Google Ireland Ltd.: reCAPTCHA v3 for form abuse prevention, and Google Meet links for Strategy Calls.
- Vimeo, Inc. (United States): hosting of video embeds.
Some of these providers are based outside the European Union. Transfers rely on Standard Contractual Clauses approved by the European Commission and on each provider's certification under applicable frameworks. We never sell personal data.
How long we keep your data
- Account data: for as long as your account is active, plus 3 years after the last activity, then anonymised or deleted.
- Order and invoice records: 10 years from the end of the financial year, in line with Romanian accounting law.
- Email logs: 12 months for deliverability and dispute resolution.
- Security logs: 12 months, longer only if needed for an ongoing investigation.
- Consent records: stored as long as the consent is valid (12 months by default), then refreshed.
Your rights under the GDPR
You have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate or incomplete data
- Request erasure (the "right to be forgotten") where applicable
- Object to certain processing or restrict it
- Receive your data in a portable format
- Withdraw consent at any time, without affecting the legality of past processing
- Lodge a complaint with the Romanian supervisory authority, ANSPDCP, or with the supervisory authority of your country of residence
To exercise any of these rights, write to contact@sochateaux.com. We respond within 30 days.
Cookies and similar technologies
See our cookie policy for details on the cookies we use and how to manage them. You can update your preferences at any time via the "Cookie settings" link in the footer.
Children
sochateaux.com is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please write to contact@sochateaux.com and we will delete the data promptly.
Changes to this policy
When this policy changes substantially we update the date at the top of the page and notify logged-in users by email. The previous version remains available on request.