PRIVACY
POLICY.

Last updated 14 July 2026

This policy explains what personal data Plan V collects when someone visits the store or places an order, why it is collected, who it is shared with, and what rights the person it belongs to has under the General Data Protection Regulation (Regulation (EU) 2016/679).

1. Who is responsible for the data

Plan V is a vegan apparel brand operated by Reisper, a company registered in Portugal. Reisper is the data controller for all personal data described in this policy.

Reisper is not required to appoint a Data Protection Officer. Data protection questions go to help@planvstore.com.

2. What data is collected, and why

Plan V collects only what is needed to sell, print and deliver a piece of clothing, and to keep the accounts straight afterwards.

Data	Purpose	Legal basis (Art. 6 GDPR)
Name, delivery address, email address, phone number if given	Producing the order, shipping it, sending the confirmation and tracking	Performance of a contract — Art. 6(1)(b)
Order contents: design, garment type, size, quantity, price paid, order reference	Fulfilling the order, handling returns and warranty claims	Performance of a contract — Art. 6(1)(b)
Payment data: payment status, payment method type, billing country, last four digits of the card	Taking payment, matching payments to orders, refunds, fraud prevention	Contract — Art. 6(1)(b); legitimate interest in preventing fraud — Art. 6(1)(f)
Invoice and transaction records	Portuguese tax and accounting obligations	Legal obligation — Art. 6(1)(c)
Emails sent to help@planvstore.com and their contents	Answering the question, resolving the complaint	Contract — Art. 6(1)(b); legitimate interest in running customer support — Art. 6(1)(f)
Server logs held by the hosting provider: IP address, browser user agent, requested URL, timestamp	Keeping the site available, blocking abuse and card-testing attacks	Legitimate interest in the security of the service — Art. 6(1)(f)

Card details are never seen by Plan V

Card numbers, expiry dates and security codes are entered on a payment page hosted by Stripe and go directly to Stripe. They never reach Plan V's servers and Plan V never stores them.

The newsletter form does not store an email address

The "10% off" form on the home page does not send anything anywhere. It reveals a discount code in the browser and the address typed into it is discarded when the page is closed. Plan V does not currently operate a mailing list.

3. Cookies and browser storage

No cookie is set for advertising until you say yes. The store carries one advertising tag — the Google tag, used to measure which Google Ads campaigns lead to a purchase — and it starts in a fully denied state (Google Consent Mode v2). On a first visit a banner asks for a choice. Until "Accept" is pressed, and permanently if "Reject" is pressed, the tag stores nothing on the device and sends Google no advertising identifier: what still reaches Google is an anonymous, cookieless signal carrying the address of the page and the technical data present in any web request, such as the IP address and the browser's user agent. Google uses it only to estimate, statistically and without identifying anyone, how many purchases its ads produced. The store works identically either way.

If you accept, the Google tag (measurement ID AW-18114998714) may set cookies in the google.com and googleadservices.com domains, and may read the advertising click identifier (gclid) from the address of the page, in order to link a purchase back to the ad that brought you here. Google Ireland Limited processes that data as an independent controller. Legal basis: your consent — art. 6.º(1)(a) GDPR and art. 5.º(3) of Lei 41/2004. You can withdraw it at any moment, as easily as you gave it, through the Cookie choices link in the footer of every page. Google's own explanation is at policies.google.com/technologies/ads.

Separately, the store uses the browser's local storage for four strictly necessary items, which require no consent:

• planv_cart_v1 — the contents of the shopping bag, so it survives a page reload. It stays in the browser and is only sent to the server when checkout starts.
• planv_orders — a copy of each checkout started from this browser: the items, the total, the order reference and the time. It is written before the payment page opens, so it also keeps a line for a checkout that was abandoned. It never leaves the browser; its only purposes are to show the confirmation on return from Stripe and to prove that the order being confirmed came from this device.
• planv_conv — the references of the orders already reported to Google Ads, so the same purchase is not counted twice.
• planv_consent — the cookie choice itself, so the banner is not shown again on every page.

All four can be cleared at any time from the browser's settings. None of them is used to profile anyone.

The payment page at checkout.stripe.com is Stripe's own page and sets Stripe's own cookies, which Stripe uses for fraud prevention and to make the payment work. See Stripe's privacy policy at stripe.com/privacy.

4. Who the data is shared with

Personal data is shared only with the service providers needed to run the store. Each acts as a processor or, where indicated, as an independent controller of the data it collects itself. None of them is allowed to sell the data or use it for their own marketing.

Recipient	What it receives	Why
Stripe Stripe Payments Europe, Ltd. (Ireland), with Stripe, Inc. (USA)	Name, email, billing and delivery address, card data, amount	Processing the payment and preventing fraud. Stripe is also an independent controller for its own anti-fraud and regulatory duties.
Printful Printful, Inc. (USA) and its European production companies	Name, delivery address, email, order contents	Printing the garment and shipping it. Printful is Plan V's production partner and does not brand the parcel.
Vercel Vercel, Inc. (USA)	Technical connection data — IP address, user agent, requests to the site	Hosting the store and its checkout endpoints.
ImprovMX and Google (Gmail)	The content of emails sent to help@planvstore.com	Forwarding and storing the store's mailbox.
Google Google Ireland Limited, with Google LLC (USA) — only if the cookie banner is accepted	With consent: advertising identifiers, the pages visited and the value of a completed order. Without consent: an anonymous, cookieless signal with no advertising identifier (see section 3)	Measuring which Google Ads campaign led to a purchase. Google acts as an independent controller for this data.
Reisper's accountant and the Portuguese tax authority	Invoice data	Legal accounting and tax obligations.

Data is also disclosed where a law, a court or a competent authority requires it.

5. Transfers outside the European Union

Printful, Vercel, Stripe and Google are established in, or have parent companies in, the United States, so some data is transferred outside the European Economic Area. Those transfers are covered by:

• the Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914), which form part of the data processing agreements Reisper has with these providers; and/or
• the EU–US Data Privacy Framework, where the provider is certified under it.

When an order is delivered outside the EU, the delivery address is necessarily transferred to the carrier and the customs authority of the destination country, so that the parcel can be delivered and cleared.

6. How long the data is kept

Data	Retention
Invoices and accounting records	10 years, as required by Portuguese tax law
Order and delivery records	3 years after delivery, matching the legal conformity guarantee period, then deleted or anonymised
Support emails	24 months after the conversation ends
Server logs	Short-lived, per the hosting provider's default retention (typically about 30 days)
Payment records held by Stripe	As required by Stripe's own legal and anti-money-laundering obligations

7. Rights of the data subject

Anyone whose personal data Plan V holds has the right to:

• Access the data and get a copy of it (Art. 15);
• Rectify data that is wrong or incomplete (Art. 16);
• Erase the data, where it is no longer needed and no legal obligation requires keeping it (Art. 17);
• Restrict processing while a dispute about it is resolved (Art. 18);
• Portability — receive the data in a structured, machine-readable format, or have it sent to another controller (Art. 20);
• Object to processing based on legitimate interest (Art. 21);
• Withdraw consent at any time, where processing is based on consent, without affecting what was done before the withdrawal.

To exercise any of these, email help@planvstore.com with the order reference if there is one. Plan V answers within 30 days. Proof of identity may be requested where there is genuine doubt about who is asking — this is only ever used to verify the request and is then deleted.

Complaints

Anyone who believes their data has been mishandled can complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt — or to the supervisory authority of their own country of residence.

8. Automated decisions and profiling

Plan V does not make automated decisions with legal or similarly significant effects. Stripe runs automated fraud checks on payments, which can result in a payment being declined. A payment declined this way can be queried at help@planvstore.com.

9. Children

The store is not directed at children and Plan V does not knowingly collect data from anyone under 16. If such data has been provided, email help@planvstore.com and it will be deleted.

10. Security

The site is served over HTTPS. Payments are handled by a PCI-DSS certified provider. Access to order data is limited to the people who need it to fulfil the order and keep the books.

11. Changes to this policy

This policy may be updated when the store changes or the law does. The date at the top always shows the current version. Material changes affecting existing orders are communicated by email.