Legal

Privacy Policy

This policy explains how FoxHeaven Studio collects, uses and protects your personal data. Compliant with GDPR and Hungarian data protection law.

1. Data Controller

FoxHeaven Studio is the trade name of Pinkóczi Kornél, a sole trader (sole proprietor) registered in Hungary.

Pinkóczi Kornél acts as data controller for all personal data collected through this website.

2. Legal Basis and Purpose of Processing

Purpose / Processor	Legal basis / Notes
Order fulfilment (delivery address, name, measurements)	Performance of contract — GDPR Art. 6(1)(b)
Invoice creation and accounting records	Legal obligation — GDPR Art. 6(1)(c) \| Hungarian Accounting Act (2000. evi C. tv.)
Customer account management (profile, saved addresses, order history)	Performance of contract — GDPR Art. 6(1)(b)
Newsletter and marketing communications	Consent — GDPR Art. 6(1)(a) \| withdrawable at any time
Website security, fraud prevention, session management	Legitimate interest — GDPR Art. 6(1)(f)

3. Data We Collect

Identity and contact data: name, email address.

Delivery data: shipping and billing address, phone number.

Measurement data: body measurements you enter for custom-fit products (stored in your account profile, used solely for production).

Order and transaction data: order contents, payment status, production status. We do not store card numbers — payment is processed by Stripe.

Account data: password hash (never readable), nickname, newsletter preference.

Technical data: IP address, browser type, session cookies — collected automatically to operate the site securely.

Newsletter consent: if you opt in at registration, we record the timestamp and method of consent as required by Hungarian advertising law (2008. evi XLVIII. tv.). You may withdraw consent at any time via Account > Profile or by emailing us.

3a. Note on Sensitive Data (GDPR Article 9)

Our products — harnesses, collars, leashes, accessories — are used across a wide range of lifestyle contexts including fashion, cosplay, and alternative communities. Purchasing these products does not constitute processing of special category (sensitive) data within the meaning of GDPR Article 9.

FoxHeaven Studio does not collect, infer, or record data about your sexual preferences or orientation. The purchase of products associated with a particular community does not, by itself, establish or reveal a special category characteristic: wearing a harness or collar is a lifestyle and fashion choice that does not inherently indicate any protected attribute. Accordingly, GDPR Article 9 does not apply to the data processed in connection with your orders.

4. Data Processors and Recipients

We share data only to the extent necessary to operate the service. The following processors act under data processing agreements:

Purpose / Processor	Legal basis / Notes
Supabase Inc. — database and authentication hosting	EU region (Frankfurt). DPA in place.
Stripe, Inc. — payment processing	US-based. Standard Contractual Clauses (SCC) apply.
Resend Inc. — transactional and marketing email	US-based. SCC apply.
Vercel Inc. — website hosting and edge delivery	US-based. SCC apply.
Kvikk / MPL, FoxPost, GLS — shipping label generation	EU-based couriers. Name and address shared for delivery only.
Szamlazz.hu (KBOSS Kft.) — invoice generation	Hungarian company. Name and address shared for legal invoicing.
Umami — privacy-first, cookie-free website analytics	US-based. Anonymised page view data only. No personal data shared. SCC apply.

We do not sell, rent or trade personal data to any third party.

5. Data Retention

Order and invoice data: retained for 8 years from the date of the transaction, as required by Hungarian accounting law (2000. evi C. tv. 169. §).

Customer account data: retained until you delete your account. You may delete your account at any time from the Account > Profile page.

Newsletter consent: retained until you withdraw consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Session and security logs: retained for a maximum of 90 days.

If you delete your account, your profile, measurements, addresses and newsletter subscription are erased immediately. Order records that must be kept for tax purposes are anonymised (personal identifiers removed) rather than deleted.

6. Your Rights Under GDPR

You have the following rights in relation to your personal data. To exercise any of them, contact us at [email protected]. We will respond within 30 days.

Purpose / Processor	Legal basis / Notes
Right of access (Art. 15)	Obtain a copy of the data we hold about you.
Right to rectification (Art. 16)	Correct inaccurate or incomplete data.
Right to erasure (Art. 17)	Request deletion where no legal retention obligation applies.
Right to restriction (Art. 18)	Limit how we use your data in certain circumstances.
Right to data portability (Art. 20)	Receive your data in a machine-readable format.
Right to object (Art. 21)	Object to processing based on legitimate interest.
Right to withdraw consent	Withdraw newsletter consent at any time via your account or by emailing us.

You also have the right to lodge a complaint with the Hungarian supervisory authority: Nemzeti Adatvedelmi es Informacioszabadsag Hatosag (NAIH) — naih.hu — 1055 Budapest, Falk Miksa utca 9-11.

7. Cookies and Analytics

We use only strictly necessary cookies required to operate the website:

Session cookie: maintains your login state during a browser session.

Cart cookie: preserves your shopping cart between page loads.

Age verification and cookie notice: stored in localStorage (not transmitted to the server).

We do not use advertising or tracking cookies.

We use Umami Analytics, a cookie-free, privacy-first analytics service. It collects anonymised page view statistics (page URL, referrer, browser type, approximate country) without placing any cookies on your device and without storing personally identifiable information. Data is processed by Umami (umami.is). No personal data is shared with Umami.

8. Data Security

All data is transmitted over HTTPS (TLS 1.2 or higher). Passwords are hashed using bcrypt and are never stored or transmitted in plain text.

Access to personal data is restricted to the operator. Database access requires authentication. Service role keys are never exposed to the browser.

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Art. 33-34.

9. International Transfers

Some of our service providers are based outside the European Economic Area (EEA), specifically in the United States. These transfers are carried out under the European Commission's Standard Contractual Clauses (SCC), which provide appropriate safeguards for your data in accordance with GDPR Chapter V.

Affected processors: Stripe, Resend, Vercel. Supabase data is stored in the EU (Frankfurt region) and is not transferred outside the EEA.

10. Children's Data

This website is intended for adults aged 18 and over. We do not knowingly collect personal data from persons under 18. If you believe a minor has submitted data to us, please contact us at [email protected] and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The current version is always available at www.foxheavenstudio.com/privacy. Material changes will be communicated by email to registered account holders.

Last updated: June 2026

12. Contact and Complaints

For any questions about this policy or to exercise your data rights: [email protected]

Supervisory authority: Nemzeti Adatvedelmi es Informacioszabadsag Hatosag (NAIH) | naih.hu | 1055 Budapest, Falk Miksa utca 9-11. | +36-1-391-1400