Privacy Policy

1. Data Controller

FILLAMOON processes personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).

• Trade name: FILLAMOON
• Email: [email protected]
• Website: https://fillamoon.com
• The data controller's full legal identity and business address are available in the Legal Notice.

2. Personal Data We Process

Depending on how you use the website, we may process:

• Contact information: name, email address and telephone number provided during checkout or correspondence.
• Order information: products, quantities, payment status, transaction identifiers, delivery method, and billing and shipping addresses.
• Payment information: payment status and limited payment details made available by Stripe. FILLAMOON does not receive or store complete card numbers or card security codes.
• Digital-delivery information: purchased digital product and version, Stripe transaction identifiers, download-link expiry, download allowance, download count and transactional email delivery status.
• Technical information: request, device, browser, security and diagnostic information processed by our infrastructure providers.
• Communications: enquiries and other messages you send to us.
• Analytics information: page views and website interactions collected by Google Analytics only after analytics consent.
• Browser storage: cart contents, consent choices and a temporary successful-checkout reference used to prevent the wrong cart from being cleared.

3. Purposes and Legal Bases

• Processing and delivering orders: performance of a contract under Article 6(1)(b) GDPR.
• Responding to enquiries: pre-contractual steps, contractual necessity or legitimate interests, depending on the request.
• Tax, accounting and legal compliance: legal obligation under Article 6(1)(c) GDPR.
• Fraud prevention, website security and service diagnostics: legitimate interests under Article 6(1)(f) GDPR.
• Optional website analytics: consent under Article 6(1)(a) GDPR.

Where processing relies on legitimate interests, we consider those interests against the rights and freedoms of the individuals concerned.

4. Payments

Payments are processed through Stripe-hosted Checkout. Stripe collects checkout and payment information and processes it under its own privacy terms and applicable data-protection obligations.

Read the Stripe Privacy Policy.

5. Recipients and Service Providers

We disclose personal data only where necessary for operating the store, fulfilling orders, protecting the service or complying with law. Recipients may include:

• Stripe: hosted checkout, payment processing and transaction management.
• Cloudflare: website delivery, checkout Worker execution, infrastructure security and operational logs.
• Google Analytics: consented website analytics.
• Email providers, including Resend: processing business correspondence, customer enquiries, transactional order confirmations, digital-file delivery messages and limited internal order alerts. Customer transactional messages contain the contact and order details needed to provide the service. Internal alerts contain payment status, products, quantities, order total and delivery method, but exclude customer names, contact details, payment credentials, and billing and shipping addresses.
• Shipping providers: information required to deliver an order.
• Professional advisers and public authorities: where necessary for accounting, tax, legal claims or a legal obligation.

We do not sell customers' personal data.

6. International Data Transfers

Some service providers may process data outside the European Economic Area. Where GDPR transfer restrictions apply, transfers must be covered by an applicable adequacy decision, Standard Contractual Clauses or another lawful safeguard made available for the relevant service.

7. Data Retention

• Order, invoice and accounting records: retained for the periods required by applicable Spanish tax, accounting and commercial law.
• Customer enquiries: retained as necessary to resolve the request and manage related legal claims.
• Cart: retained in your browser until you remove it or clear browser storage.
• Successful-checkout reference: retained only in the current browser tab session.
• Cookie consent record: retained for up to two years, unless replaced or deleted earlier.
• Notification deduplication record: retained for 30 days. Order-related notifications may be sent to authorized FILLAMOON administrators by email. These messages are accessible only to authorized recipients and are retained in accordance with our internal data retention practices.
• Operational order and digital-delivery records: D1 stores a minimal order reference, purchased product and variant identifiers, quantities, financial snapshots, payment status and transactional email delivery state without customer contact or address data. Physical-order confirmation delivery state is removed after 90 days. Short-lived interrupted-download attempts are removed after expiry. Download grants, delivery email status and the associated D1 order reference are retained for 90 days after access expires or is revoked and removed during the next daily cleanup cycle. Stripe order records may be retained separately for applicable legal, accounting and contractual periods.
• Provider records and logs: retained according to configured operational settings, contractual requirements and applicable law. Analytics retention follows the configured Google Analytics property setting.

When retention is no longer justified, data is deleted, anonymised or restricted as required.

8. Cookies, Local Storage and Analytics

The website uses necessary browser storage for the cart, checkout completion handling, consent choices and core operation.

Google Analytics loads only after analytics consent. Withdrawing or rejecting analytics consent disables analytics and removes accessible Google Analytics cookies from this website.

You can review the Cookie Policy or change your choice through Cookie Settings.

9. Your Data Protection Rights

Subject to applicable conditions, you may request access, correction, deletion, restriction, portability, object to certain processing, or withdraw consent without affecting earlier lawful processing.

To exercise your rights, contact [email protected]. We normally respond within one month, subject to extensions permitted by law.

You may also lodge a complaint with the Spanish Data Protection Authority (AEPD).

10. Data Security

We use proportionate technical and organisational measures intended to protect personal data, including encrypted communications, restricted access, verified Stripe webhooks, secure hosted payment processing and infrastructure protections. No internet-based system can guarantee absolute security.

11. Required Information

Information requested during checkout is required to process payment, fulfil the purchase and arrange delivery. If it is not provided, we may be unable to complete the order. Analytics consent is optional and is not required to purchase products.

12. Automated Decision-Making

FILLAMOON does not independently make decisions based solely on automated processing that produce legal or similarly significant effects. Payment and infrastructure providers may apply automated fraud and security controls under their own terms.

13. Children's Privacy

The online store is not specifically directed at children. We do not knowingly use children's personal data for marketing without an appropriate legal basis or required authorisation.

14. Changes to This Policy

We may update this policy when services, processing activities or legal requirements change. The current version and revision date will be published on this page. Where required, we will provide additional notice or request renewed consent.

15. Contact

For privacy questions or requests concerning your personal data, contact [email protected].