Privacy Policy

Last updated: September 2026. This page sets out our policy commitments in plain language. It is a governance doctrine, not a substitute for jurisdiction-specific legal advice — have it reviewed by counsel before relying on it in production.

FFC Fischer Fritz PBC ("Fischer Fritz," "we," "us") respects the people who come to this site — whether you're requesting support, buying from our marketplace, contributing, or just reading. This notice explains what personal data we collect, why, and what rights you have over it, in line with the EU General Data Protection Regulation (GDPR) and comparable US state privacy laws.

Who is responsible for your data

FFC Fischer Fritz PBC, incorporated in Delaware, USA, is the data controller for information collected through this site. We have not yet appointed a representative in the European Union under Article 27 GDPR. Until we do, EU visitors can direct any GDPR-related question or request to privacy@fischerfritz.org and we will respond directly.

What we collect

Support requests

When you submit a request through our Request Support page, we collect your name, email, phone number (if provided), how you prefer to be contacted, your city/region, the area of support you choose, the details you share about what's needed and what it would change, your estimate of the cost, whether a quote already exists, whether the request is time-critical, and any referral source you name. If you submit a request on someone else's behalf — for example for your children, another person, or an institution — we collect only what's necessary to evaluate and fulfil that request. We do not ask you to upload documents when you first get in touch; if we need something for the review, we will ask you for it and explain why.

Marketplace purchases

Payments for shop purchases are processed by Stripe. We do not receive or store your full card details — Stripe handles that directly under its own privacy policy. We do receive confirmation of payment, the amount, and the email address you provide at checkout.

Makers on our marketplace

Women who list products with us provide their name (or the name they wish to display), a description of their product, and payment details required to receive their share of proceeds.

Website usage

See our Cookie Policy for details on any cookies or similar technology used on this site.

Why we process your data, and our legal basis

To respond to support requests — legitimate interest in operating our support programs, and your consent when you submit the form.
To process purchases and contributions — performance of a contract (completing your order or contribution) and compliance with financial record-keeping obligations.
To list marketplace products — performance of our agreement with the maker.
To communicate with you about a request, order, or contribution — legitimate interest and/or contractual necessity.

Who we share data with

We share data only where necessary to deliver the service you asked for: Stripe (payment processing), local partner salons and hairdressers (only the details needed to fulfil a Salon Sessions appointment), and, where you've asked, the family, teacher, or organisation who referred you. We do not sell personal data.

International transfers

Because Fischer Fritz is a US company, data from EU visitors may be transferred to and processed in the United States. Where required, we rely on Standard Contractual Clauses or an equivalent safeguard with our processors (including Stripe) to protect that transfer.

Children's data

Our programs support children — through the studio's work on their rooms, and through support for birthdays and other milestones — but requests are always submitted by an adult (a parent, guardian, or referring professional) — we do not knowingly collect personal data directly from children through this site.

How long we keep your data

Support-request data is retained for up to 24 months after your request is resolved, for our own accountability and reporting, after which it is deleted or anonymised. Payment and contribution records are retained for up to 7 years, in line with standard financial and tax record-keeping requirements in the jurisdictions where we operate. Marketplace maker data is retained for as long as a listing is active, plus the same 7-year period afterward for any related financial records. These periods are provisional pending confirmation by counsel (see the note at the top of this page) and may be revised.

Your rights

Subject to applicable law, you may have the right to:

Access the personal data we hold about you
Correct inaccurate data
Request deletion of your data
Restrict or object to certain processing
Receive your data in a portable format
Lodge a complaint with your local data protection supervisory authority

To exercise any of these rights, contact us at privacy@fischerfritz.org.

Security

We use reasonable technical and organisational measures to protect the personal data we hold, including relying on Stripe's PCI-compliant infrastructure for payment data rather than handling card details ourselves.

Changes to this notice

We'll update this page as our practices evolve, and note the date of the most recent revision at the top.

Contact

Questions about this notice or your data can be sent to privacy@fischerfritz.org.