Privacy policy
Last updated: 30 October 2026
Controller
This English translation is provided for convenience. The French version prevails.
NG WORKS, a SASU with a share capital of 100 €, registered office 173 rue de Courcelles, 75017 Paris. Contact for your data: contact@buildour.world.
Data processed and why
- Account: e-mail address, full name, pseudonym, e-mail language and password (stored only as an irreversible scrypt hash). To create and secure your account and sign your contributions (performance of the contract). A place ordered without an account opens the account with the name and e-mail address given at the payment, without a password until you choose one.
- Contributions: bricks, chosen signature form, message, date, the date to remember if you give one, and the two first names of a place “for us”. To display them on the edition and produce your souvenirs (performance of the contract). They are public in the signature form you choose, the date to remember with it; “invisible” shows “Anonymous”. The two first names of a place “for us” are its signature, public: only give the first name of someone who agrees to see it there.
- Gifts: the name of the person you give an area to, or the first names of the two people, and, if you give it, their e-mail address and the language of the e-mail. To sign the area for them and give them the link that hands it over (performance of the contract). Until they receive the gift, only their initials are public; their e-mail address is erased as soon as they have received it, and the link is only kept as a fingerprint. Only give the address of someone who agrees to receive this message.
- Gift vouchers: the size, the price, your note and the name of the person you give (printed on its card), the e-mail address to send it to and the day chosen. To deliver the voucher and its code (performance of the contract). The code is kept only as a fingerprint; in clear, only long enough to show it after the payment (30 minutes) and until its e-mail leaves on the day chosen. Only give the address of a person who agrees to receive this message.
- Printed souvenirs: the delivery name and address (and, if you give one, a phone number for the carrier), the size, the frame, the delivery, the price and the poster ordered, with the signature and message as they are printed. To make and deliver your order (performance of the contract). Your account’s cart keeps the posters you add to it (their settings, size and finish) until you order or remove them. Your account’s address book keeps the addresses of your orders to fill in the next ones; you can remove one at any time. The poster’s QR code leads to its certificate, which anyone who reads it sees: number, edition, size, date, and the zone with the public signature you chose; never the buyer, the address, the price or the message.
- Purchases: amounts, payment status and proof of your acceptance of the terms (version and date). To perform the sale and prove your consent (legal obligation and legitimate interest). Card data is processed by the payment provider, never by Build Our World.
- Purchase-journey statistics: per day, language and country of connection (the one our host gives), the number of visits that reach each step (home, wonder, place proposed, place held, place paid, poster paid). These counts hold no identifier, no network address and no cookie: they cannot recognise anyone. For a held place only, the language and country it was chosen from stay with its order until its payment is counted, 4 days at most. To learn where the journey loses visitors and improve it (legitimate interest).
- News by e-mail, if you accept them (a box on a place's payment page or in “My account”, never ticked for you): your e-mail address, your language, your places and their dates, the date and version of your consent, and the e-mails already sent. To write to you six times a year at most, never twice on the same day: your place's poster, the anniversary of your signature, the holidays to give a place, the end of an offer (consent; article L. 34-5 of the French Post and Electronic Communications Code). Every e-mail lets you withdraw your consent in one click, and so does “My account”, at any time; withdrawing does not stop service e-mails (receipts, your gifts' links).
- Signature of Wonders concierge: the questions you ask it and its answers, for the time it takes to answer. To inform you (legitimate interest). Build Our World does not keep them nor link them to your account; write to it without personal data.
- Security: sign-in session, the host’s technical logs, the date you confirmed your e-mail address and the date of your last visit (to the day, to delete unused accounts). To limit repeated sign-ups and sign-ins: a fingerprint of your network address, hashed with a key that changes every day, never the address itself. To protect the service against fraud, robots and abuse (legitimate interest).
Build Our World does no targeted advertising, data resale or profiling.
Recipients and processors
- Vercel Inc. (website hosting, United States).
- Neon (database, hosted in Frankfurt, Germany).
- Cloudflare R2 (encrypted backup copies of purchases and accounts, kept in the European Union; Cloudflare cannot read them).
- Resend (account e-mails, receipts, gifts, poster tracking and, if you accept them, the news, sent from Ireland; sending-account data in the United States). No open or click tracking.
- OVHcloud (domain name and the contact@buildour.world mailbox, France): the messages you write to us are received and kept there.
- For a printed souvenir: Prodigi (partner printer, United Kingdom) receives the name, the delivery address, the phone number if you give one and the poster's file, never your e-mail address. It prints in the workshop nearest the delivery address, in the European Union or elsewhere depending on the country. Cloudflare makes the print file from the order and keeps it in the European Union.
- Stripe (payment provider, Ireland; data also processed in the United States), when card payment is open: the account's e-mail address, the amount and the purchase's reference, and, for a poster paid on its page, the delivery address entered there. Your card details are entered with Stripe, never with Build Our World. If you choose another way of paying on its page (PayPal, Klarna, iDEAL, Bancontact…), that service receives the amount and the purchase's reference from Stripe, and you pay with it, under its own privacy policy.
- If Build Our World turns it on, Cloudflare Turnstile (anti-robot check of the sign-up form and of the payment page of a place ordered without an account).
- If Build Our World turns it on, Anthropic (automatic moderation of messages and pseudonyms, United States): only the text to check is sent, never your account or address.
- If Build Our World turns it on, Anthropic (the Signature of Wonders concierge's answers, United States): only the current conversation and the page it is asked from are sent, never your account or address.
Transfers outside the European Union rely on the EU–US Data Privacy Framework or on the European Commission’s standard contractual clauses; the United Kingdom (Prodigi) benefits from an adequacy decision of the European Commission. Each processor is bound to NG WORKS by a data processing agreement (article 28 of the GDPR).
Retention
- Account: while you use it. Unused for 3 years (no sign-in, no visit with the session open), it is deleted, after a warning e-mail a month before. Erased then: the e-mail address, password, sessions and preferences. The name or pseudonym is kept only if a paid zone shows it, as that zone’s signature. Sales data stay for their legal durations (below).
- Public contributions: for as long as the edition is operated.
- Gifts: the recipient’s name, with the area; their e-mail address until they receive the gift (at most while the buyer’s account is kept).
- Gift vouchers: like the sales data; the person’s e-mail address, until the end of the voucher’s validity (12 months after its payment), then erased.
- Proof of consent and sales data: 5 years (limitation period).
- Address book and cart: like the account; a poster leaves the cart as soon as it is ordered or removed. Printed-souvenir orders, with their address: like sales data, and 10 years for what accounting and VAT require. Print files: 90 days after they are made, then erased (a reprint makes them again from the order).
- Accounting records: 10 years (legal obligation).
- Sign-in session: 30 days at most; expired sessions and links are erased every day.
- Password-reset links: valid for 60 minutes, single use, deleted once expired.
- E-mail confirmation links: valid for 48 hours, single use, deleted once expired. The receipt's link of a place ordered without an account: 30 days.
- An account opened at the payment of a place that was not paid: deleted after 7 days, with its order and consent.
- Network-address fingerprints of the anti-robot limits: 2 days at most.
- Encrypted backup copies of purchases and accounts: 90 days, then deleted; data deleted from the site leaves these copies within 90 days.
- Purchase-journey statistics: the counts, anonymous, for as long as the site runs; a held place’s language and country, until its payment is counted, 4 days at most.
- News by e-mail: your consent, until you withdraw it or your account is deleted; the date of a withdrawal, as proof; the e-mails sent and their unsubscribe links, 400 days.
Your rights
You can access, correct and erase your data, restrict its processing, object to processing based on legitimate interest and port it: the “My account” page lets you edit your details and download all your data (JSON). For any other request: contact@buildour.world. You can also lodge a complaint with the CNIL (www.cnil.fr).