Privacy policy

L'Épatage is the trading name of Lepotazh LLC (ООО «Лепотаж»), a limited liability company registered in the Republic of Belarus (registration number, УНП: 592048136; registered address: 161 Dzerzhinskogo St., premises 80, 230005 Grodno, Grodno Region, Republic of Belarus). We decide why and how your personal data is used, so we are its controller (its "operator" under Belarusian law).

For any question or request about your data, write to Darya Makey at contact@lepatage.com. Lepotazh LLC has appointed a person responsible for internal control over the processing of personal data, as Article 17 of Law No. 99-Z requires; you can reach them at the same address.

We process personal data under the Law of the Republic of Belarus No. 99-Z of 7 May 2021 "On Personal Data Protection". If you are in the European Union, the European Economic Area or the United Kingdom, the GDPR or the UK GDPR also protects you when you buy from us.

When you place an order on the website:
- your name, e-mail address, phone number and delivery address (and company name, if you add one), to confirm the order, agree payment and delivery with you and ship it;
- what you ordered, including any personalisation: body measurements for made-to-measure pieces, notes about the fit, and initials for an engraved plate;
- your messages to us about the order.

When you send a made-to-measure request: your name, contact details and how you prefer to be contacted, a social media link if you give one, your measurements and comments about your figure, the initials and metal for the plate, the delivery address and the date you'd like the piece by.

When you have an account: your name, e-mail address, phone number if you add it, and your order history. There is no password: you sign in with a link or a code we e-mail to you. The account is created the first time you sign in with such a link, including from an order e-mail or the e-mail confirming your subscription; orders placed with that address without signing in appear in it. Sign-in links and codes work once and only briefly (15 minutes; the link in an order e-mail, 7 days); we store only secure hashes of them, and hashes of your address and IP address to limit how often sign-ins can be requested. Your sign-in is kept in your browser in a secure cookie for up to 90 days or until you sign out.

When you write to us on Instagram: your username and profile name, the ID Meta assigns you for our account, and the messages, photos and posts you send us. See "Instagram messages and our AI assistant" below.

When you write to our atelier bot on Telegram (@lepatage_atelier_bot): your Telegram ID, name and username, app language, and the messages, photos and contact details you send it. See "Our atelier bot on Telegram" below.

When you e-mail us: your address and our correspondence.

When you subscribe to our newsletter: your e-mail address, the language and country of the site you subscribed on, the consent wording, when you subscribed and when you confirmed your address. See "Newsletter" below.

When you browse the site: technical data your browser sends (IP address, browser and device type, pages viewed), cookies and, depending on your choice, analytics and advertising data. See "Cookies and analytics" below.

When you save pieces to your favourites and, if your cookie choice allows, when you view, search for and add pieces to your bag: your favourites and that history. See "Your customer profile, favourites and reminder e-mails" below.

There is no online payment on the site yet: our manager agrees payment with you directly. The website never receives or stores card details.

Body measurements and notes about your figure are personal, and we treat them with particular care. We use them only to cut and fit your piece (and, if you ask, a later piece to the same pattern). Only the people who make and handle your order see them: the atelier team, including in our internal Telegram orders channel, our AI assistant when it helps the team with your order, and our atelier bot on Telegram if you give it your measurements. Measurements and initials are never sent to analytics or advertising services; at most they learn that a piece is made to measure. Once your order is complete, you can ask us to delete your measurements at any time.

When you send a direct message to @lepatage, Meta delivers it to our order system through Instagram's official API. We keep the conversation with your order history, so anyone in the team can answer you and see what you ordered before. We use it only to answer your questions, take and fulfil orders and help with aftercare, never for advertising.

An AI assistant helps our team. It runs on our own server and uses language models from third-party providers: it reads new orders and conversations and writes short summaries and draft replies. A team member checks every reply and sends it. The assistant makes no decisions that have legal or similarly significant effects on you: prices, accepting orders, refunds and everything else that matters are decided by people. The model providers process this data on our behalf as service providers and do not use it to train their models.

The team sees draft replies and order summaries in our internal Telegram chats. These include your first name, city and country and what you ordered with its options (including measurements), but never your phone number, e-mail or address.

Meta handles the Instagram messages themselves under its own privacy policy, as a separate controller.

The @lepatage_atelier_bot bot answers questions about our pieces, measurements, timing and care, shows photos and helps you prepare an order request. It replies on its own, without a person checking each reply, using language models from third-party providers: with each reply, your conversation with the bot is sent to them. The providers process it on our behalf and do not use it to train their models. The bot can make mistakes: a manager confirms prices, timing and acceptance, and a request becomes an order only then.

We keep your conversation with the bot and the requests it prepares with your order history, as with Instagram messages. The bot's own working copy of the conversation is limited to the last 400 messages and 180 days. Telegram handles the messages themselves under its own privacy policy, as a separate controller.

When you review an order, we receive your rating, text, signature and up to four photos (we shrink them and strip location and camera data from the files before they are sent). After moderation, your review may be published on the site with your signature. If you give your consent, we may use your photos to promote the brand: on the site, on social media, in newsletters, in advertising and in other L'Épatage materials. You can withdraw consent at any time by writing to us: we then stop using the photos in new materials and remove them from the site and our posts.

You can subscribe to our newsletter on the site. We write rarely: about new pieces, our shoots and the atelier's offers. A subscription starts only once you confirm it: we send an e-mail with a link and send nothing else until you open it; an unconfirmed address is deleted after 30 days. Once you confirm, we may send you a discount code for your first order.

The legal basis is your consent. You can unsubscribe at any time with the link in every newsletter e-mail or by writing to us; e-mails about your orders still reach you after you unsubscribe. The confirmation e-mail is sent by Cloudflare and the newsletter e-mails by Resend (see "Who else receives your data"). We record whether a newsletter e-mail was delivered, opened and whether a link was clicked: the e-mail contains an invisible image, and its links pass through our server. These records are linked to your customer profile, not your address, and we don't keep your IP address or browser details for them. We keep your address until you unsubscribe; after that we keep only the address, marked as unsubscribed and with any code it received, so we don't write to you again or issue the code twice, and we delete that too if you ask.

Cookies the site needs to work are always on: your bag, your sign-in, your region and language, and your cookie choice. They are not used to track you.

With your consent (see below), we also use:
- Google Analytics 4 (Google), to count visits and understand how the site is used;
- Yandex Metrica (Yandex), including Webvisor, which records scrolling, mouse movements and clicks on our pages so that we can find what's awkward to use;
- the Meta Pixel (Meta), to measure our Instagram and Facebook ads and show them to people likely to be interested.

When you place an order, our server also reports the purchase to Google (Measurement Protocol) and Meta (Conversions API): the order value and items, and your e-mail, phone, name, city, postcode and country in hashed (irreversibly encoded) form, so the platform can match the purchase with an ad it showed you; and to Yandex Metrica, with Metrica's anonymous visitor ID. This happens only if your cookie choice allows it. Measurements and initials are never sent.

How we ask:
- In the EU, the EEA, the UK and Switzerland, nothing that tracks you runs until you click "Accept" in the cookie banner. Until then Google receives only signals without cookies or identifiers (Google Consent Mode v2), and Yandex Metrica and the Meta Pixel don't load at all.
- In Belarus and Russia, analytics and advertising cookies are on by default and no banner is shown; you can switch them off at any time with the "Cookie settings" link at the bottom of the page.
- Everywhere else, they are also on by default, the banner says so, and you can switch them off at any time.

We decide which rules apply from the country of your IP address and the store region in the page address. You can change your choice at any time with the "Cookie settings" button on the site, or by clearing cookies in your browser. We remember your choice for 6 months.

Google, Yandex and Meta also process this data under their own terms. Yandex Metrica data is stored in Russia.

Our own cookie, _lp_aid, is described in the next section.

To write to you less often but more usefully, we keep a customer profile: we link your orders, newsletter subscription, reviews and favourites into one record. Records are joined when you sign in to your account, confirm your subscription or place an order. For this we keep a keyed hash of your e-mail address (an irreversibly encoded form of it); we don't use browser or device fingerprinting, and we never join people by IP address.

Favourites are kept in your browser. If you are signed in or have confirmed your subscription, we also keep the list ourselves, so it is on all your devices.

Your history on the site. If your cookie choice allows, the site sets our own cookie, _lp_aid (a random identifier, 13 months), and records which pieces you view, search for, save and add to your bag: in the EU, the EEA, the UK and Switzerland only after you click "Accept"; in Belarus and elsewhere until you switch cookies off in "Cookie settings". We don't collect this for visitors from Russia. We use the history for e-mails only if you subscribe to our newsletter. The history itself is kept for 13 months; after that only overall counts remain.

Reminder e-mails. If you subscribe to our newsletter, we may send e-mails in sequences: a welcome series, a reminder about a checkout you didn't finish, a note about a piece you saved, a review request and care advice after delivery, a piece that would complement your purchase and, if you haven't visited for a while, our news. We send no more than one such e-mail a day, three a week and eight a month, and only between 10:00 and 20:00 in your time zone. A small random share of recipients (about 10%) doesn't receive particular sequences, so we can check whether the e-mails really help. We record whether an e-mail was delivered, opened and whether a link was clicked. You can stop all reminder e-mails with the unsubscribe link in any of them.

Inviting friends and our programme for regular clients. If you invite a friend with your link or code, we keep who invited whom and with which order, to give your friend their gift and you your reward, and we check that an invitation isn't used by the person who sent it. Your regular-client level is worked out from the total and number of your L'Épatage orders over 24 months (Makey purchases don't count); the level decides its benefits and a standing discount on your orders, applied in your bag automatically.

Clients of the Makey atelier (makey.by). Makey is a separate company. With Makey's permission, we receive the e-mail address, first name, country and purchase history of its clients (the phone number only as a keyed hash), and we keep this up to date from Makey's records: when Makey deletes an order, we delete our copy too. We send each of them, in L'Épatage's name, a personal invitation of no more than three e-mails: the invitation and, if you haven't clicked anything in it, subscribed or unsubscribed, up to two reminders with the same offer. We record whether the invitation was opened and whether its links were clicked: once you click a link, visit the site or subscribe, no more reminders are sent. The invitation shows pieces chosen to suit those purchases, links to our website and Instagram, an offer on a first order and a button to subscribe to our e-mails. If Makey's permission covers only the invitation (the default), we don't write again unless you subscribe yourself: you press the button in the invitation and confirm with the link in our e-mail; from then on you get our e-mails and newsletter issues like any subscriber. Opening the e-mail doesn't count as subscribing: mail apps open e-mails automatically. So that we never write twice, we keep a keyed hash of your e-mail address on our "don't write" list, and without your subscription we don't use the address for any other e-mail. If Makey's permission also covers further e-mails, after the invitation we write to you as we do to subscribers: about new pieces, pieces left in your basket or favourites, caring for your pieces and seasonal dates, and we send you our newsletter issues. You can unsubscribe from the invitation and from any of our e-mails at any time with the link in every e-mail; after that we don't write again. Your Makey purchase history is kept in your customer profile until you ask us to delete it: we use it to choose pieces for you, and if you subscribe and have bought a lot at Makey, our AI assistant may draft a personal e-mail for you under the rules below. We keep no personal details of clients in Russia (only the hash) and send them no invitation. Makey may also compare its list with ours by keyed hashes, without passing on addresses; we answer only with the number of matches.

Personal suggestions. For customers and regular clients, our AI assistant may prepare a personal e-mail or offer, such as a discount within limits we set in advance. It receives only your first name, country, the titles of pieces you ordered and saved, and summary figures, never your measurements, phone number, address or full e-mail address; this isn't done for clients in Russia. Before it is sent, every such e-mail is checked automatically against our rules: no promises we don't make, no personal details beyond the first name, no prices or dates that don't come from the shop and no discount above the limit. An e-mail that passes may be sent without a person; one that doesn't is sent only if someone on our team corrects and approves it. The team sees all these e-mails and reviews them, and can switch automatic sending off at any time. Prices in the shop and whether we accept an order never depend on them; we make no automated decisions with legal or similarly significant effects.

Newsletter and reminder e-mails are sent by Resend (see "Who else receives your data"). You can object to the profile or ask us to delete it at any time by writing to us; unsubscribing from the newsletter stops all reminder e-mails.

When we check friend invitations, we compare keyed hashes (irreversibly encrypted values) of the e-mail address, phone number and delivery address on orders, not the details themselves; the hashes are kept while your invitation code exists.

Scores in your profile. Once a day we automatically work out summary figures from your profile: how recently, how often and how much you have ordered, how interested you seem in our pieces (from your favourites and, where allowed, your history on the site; in Belarus the history counts only if you subscribe to our newsletter, and in Russia it doesn't count), which categories suit you, and when you might want your next piece. We use them to choose which reminder e-mail and which pieces to show you; prices, discounts and whether we accept an order never depend on them.

We send care advice and a review request after delivery to customers who haven't subscribed to our newsletter too, except in the EU, the EEA, the UK and Switzerland: these are e-mails about your order, and you can stop them with the link in the e-mail as well. If you subscribe to our newsletter but haven't clicked a link in our e-mails for a long time, we ask once whether to keep writing, and if you don't answer we stop sending the newsletter; e-mails about your orders are not affected.

Our AI assistant may also prepare a personal e-mail for a subscriber who hasn't ordered yet but has shown clear interest in our pieces (for example, saved several and started a checkout), under the same rules: only the first name, country, titles of pieces and summary figures, never for clients in Russia, and with the same automatic check before sending. Such drafts are sometimes prepared in a nightly batch; the assistant's suggestions are kept with your profile and deleted with it.

Choices on the site. If your cookie choice allows your history on the site, the site may use it and your profile's summary figures to order pieces "for you" and to choose pieces to wear with one; simple rules do this, not AI, and prices and discounts never depend on it. We don't do this in Russia. The "Recently viewed" list is kept only in your browser (localStorage) and is never sent to us; you can delete it by clearing the site's data in your browser.

• Orders, made-to-measure requests and answering questions about them: necessary to enter into and perform our contract with you (Law No. 99-Z; GDPR Art. 6(1)(b)).
• Your customer profile, linking your orders, reviews and favourites, inviting friends and our programme for regular clients: performing our contract and our legitimate interest in running a small atelier attentively (GDPR Art. 6(1)(b) and (f)); where the law requires consent (including in Belarus), the consent you give by subscribing to our newsletter.
• Your history on the site and reminder e-mails: your consent, through your cookie choice and your newsletter subscription. You can withdraw it at any time.
• Accounting and tax records: required by law (GDPR Art. 6(1)(c)).
• The newsletter: your consent, which you give by subscribing and confirming your address (Law No. 99-Z; GDPR Art. 6(1)(a)). You can withdraw it at any time by unsubscribing.
• Answering messages that aren't about an order (including the Telegram bot's replies), the AI assistant's help to the team, and keeping the site secure: our legitimate interest in running a small, responsive business, balanced against your interests (GDPR Art. 6(1)(f)). Where the law requires consent for these, we ask for it.
• Using photos from reviews to promote the brand: your consent, which you give with the tick box in the review form.
• Analytics, advertising and reporting purchases to ad platforms: your consent. In the EU, the EEA, the UK and Switzerland you give it by clicking "Accept"; elsewhere you can opt out at any time. Withdrawing consent doesn't affect what was done before.

We don't sell personal data. Only people who need it for their work can access it, and service providers who process it on our behalf:
- Hetzner Online GmbH (Germany): our servers and database, in a data centre in Helsinki, Finland (EU);
- Resend, Inc. (USA): sends our newsletter and reminder e-mails;
- Cloudflare, Inc. (USA): delivers the website, stores product photos, sends our order e-mails and runs our atelier bot on Telegram;
- third-party language model providers (including in the USA): run the team's AI assistant and our atelier bot on Telegram;
- Telegram: the team's internal chats (summaries without contact details) and our atelier bot;
- Meta (Meta Platforms Ireland Ltd. and Meta Platforms, Inc., USA): Instagram messaging, and the Meta Pixel and Conversions API if your choice allows;
- Google (Google Ireland Ltd. and Google LLC, USA): Google Analytics, if your choice allows;
- Yandex (Yandex LLC, Russia): Yandex Metrica, if your choice allows;
- the postal or courier service that delivers your order: the recipient's name, address and phone number;
- public authorities, where the law requires it.

We are based in Belarus, and our database is in Finland (EU). Some of the providers above are in the USA, Russia or elsewhere, so your data may be processed outside your country, including in countries that the EU, the UK or Belarus do not consider to protect personal data to the same standard. When you order from the EU or the UK, sending your order to us in Belarus is necessary to perform our contract with you. Where the GDPR or the UK GDPR applies, transfers to providers in other countries rely on standard contractual clauses or the EU-US Data Privacy Framework, depending on the provider. Under Belarusian law, transfers to countries without adequate protection happen when they are needed to perform our contract with you, or with your consent.

• Orders and their documents and correspondence: as long as accounting and tax law requires (generally five years after the end of the year of the order), then deleted.
• Measurements and fit notes: three years after your last order, so we can make a repeat piece to the same pattern; sooner if you ask.
• Your customer profile and the record of our e-mails: while you buy from us or subscribe to our newsletter, and three years after your last activity; your history on the site: 13 months; the hash of your address on our "don't write" list after you unsubscribe, complain or ask for deletion: for as long as it's needed so that we don't write to you again.
• Made-to-measure requests that didn't become an order: one year.
• Instagram, Telegram and e-mail conversations: three years after the last message, unless they are part of an order.
• Reviews and their photos: while the review is published or until you ask us to delete them; photos in posts and ads already published: for as long as those materials are in use.
• Your account: until you delete it or ask us to.
• Newsletter subscription: until you unsubscribe; after that, only the address marked as unsubscribed, until you ask us to delete it too. Unconfirmed subscriptions: 30 days.
• Google Analytics: up to 14 months; Yandex and Meta keep data under their own terms.
• Sign-in links and codes: a day after they expire; the link from an order e-mail, 30 days after, so the sign-in form can fill in your address.
• Server logs: briefly, normally no longer than 30 days.
• The record of a deletion request (code, dates, status): three years, to show that we carried it out.

You can ask us at any time to:
- tell you whether we process your data, what data, why and who receives it, and give you a copy;
- correct inaccurate data;
- delete your data, unless the law requires us to keep it;
- restrict or object to processing, including processing based on our legitimate interest;
- send you your data in a common machine-readable format;
- withdraw your consent, without affecting what was done before.

Write to contact@lepatage.com. We reply free of charge: within five working days if you ask what data we hold, and within 15 days for other requests, as Belarusian law requires. We may ask you to confirm that the request comes from you.

If you think we are not respecting your rights, you can complain to the National Personal Data Protection Center of the Republic of Belarus (cpd.by), to the data protection authority in your EU country, or to the Information Commissioner's Office (ico.org.uk) in the UK. We'd be glad if you wrote to us first, so we can try to put it right.

E-mail contact@lepatage.com or send a direct message to @lepatage on Instagram saying "Delete my data". Step-by-step instructions: https://lepatage.com/data-deletion. We delete your data within 15 days, except what the law requires us to keep (accounting records of orders), which we keep only for that purpose and only for as long as required.

Your data is stored on our servers in the EU, the site uses encrypted connections (HTTPS), and only team members who need it for their work can access it, with personal accounts. No system is perfectly secure; if a breach affects your data, we will tell you and, where required, the supervisory authority.

Our pieces are made for adults. We don't knowingly collect data from children under 16.

We update this policy when the way we work changes; the date at the top shows the current version. We will announce significant changes on the site.