Privacy Policy

Who we are

This website is operated by [LEGAL ENTITY NAME], with its registered office at [REGISTERED ADDRESS], [COUNTRY]. That company is the controller of the personal data described in this policy. In this policy, "we" and "us" mean that company. [IF THE CONTROLLER HAS NO ESTABLISHMENT IN THE EU:] Our representative in the European Union under Article 27 of the GDPR is [EU REPRESENTATIVE NAME], [EU REPRESENTATIVE ADDRESS IN FRANCE OR ANOTHER MEMBER STATE], [EU REPRESENTATIVE EMAIL]. You and any supervisory authority may contact the representative, instead of or as well as us, on all issues relating to the processing of your personal data. [IF THE CONTROLLER HAS NO ESTABLISHMENT IN THE UK:] Our representative in the United Kingdom under Article 27 of the UK GDPR is [UK REPRESENTATIVE NAME], [UK REPRESENTATIVE ADDRESS], [UK REPRESENTATIVE EMAIL]. Our data protection contact is [DPO ROLE], reachable at privacy@prepouches.com. These details are placeholders pending confirmation.

Questions about privacy: privacy@prepouches.com.

What this site is today

The site contains product information, a shop preview, a FAQ, and information and policy pages listed on the Policies page. It is served as static files by a small web server that only delivers those files. There is no database of visitors, no checkout, no payment, no contact form and no user accounts. The shop preview lets you put items in a bag to see how the shop will work; it cannot take an order. The one thing our server can store is the launch waitlist described below, and only once it is open.

This policy describes the site exactly as it works on the effective date above. It is a living document: every time a feature is added, this page is updated and the change is recorded in the Change log at the bottom.

What we collect

Waitlist details, correspondence and technical request information. The following sections explain these uses. On this site we do not:

• ask for your name, phone number, address or any details other than the waitlist email described below;
• set cookies;
• run analytics or count visitors;
• load advertising trackers or social media pixels;
• create accounts or profiles;
• keep a database of any kind.

3D models and WebGL

The home page uses WebGL to draw 3D models. The rendering happens locally in your browser, on your own device. Nothing about it is sent to us.

Local storage on your device

The site uses localStorage for the shop preview bag (pre.bag), your motion choice (pre.motion), waitlist completion (pre.waitlist), whether you revealed the preview offer (pre.offer), your shopping country (pre.region) and your language (pre.lang). It uses sessionStorage for the completed home introduction (pre.introSeen) and for an unanswered country question when no country could be suggested (pre.regionAsked). These values stay on your device and the site does not upload them. The language shown can still be told from the text file your browser downloads for it (see Country, currency and language). The waitlist details you submit are sent separately as described below. See the Cookie policy storage inventory for purposes, durations and controls.

Country, currency and language

On your first visit the site suggests the country you are shopping from, which sets the currency prices are shown in, and a language for the page. To make that suggestion it reads your device's time zone and your browser's language settings. This happens only inside your browser: the site never sends your time zone or language settings to us, and a suggested country only picks the language once you confirm it. Your browser then downloads the country and time-zone lists and the prices from our own host, like every other file of the site (see Web hosting); these files are the same for every visitor. The text of the page is different: each language has its own files (for example /assets/i18n/fr/common.json), so, like any file request, our host's logs can see which language file your browser downloaded, and so the language the page was shown in. Separately, every browser tells the websites it visits which languages it prefers; our server does not use or record that.

The country you confirm or choose is stored in localStorage as pre.region (its two-letter code, for example FR, with a confirmed flag and a version number), so the question is not asked again. The language shown is stored as pre.lang (for example fr) when you confirm a country or pick a language. Closing the question without answering keeps the suggested country, if there is one, and stores it the same way. A link that names a country or a language (for example ?region=FR or ?lang=fr) stores it too. Neither entry has an automatic expiry. If your browser blocks storage, your choice is kept only while the page is open. You can change both at any time with the language button at the top of the page and the country button at the bottom.

If you email us

If you write to any of our addresses (help@, press@, privacy@ or security@prepouches.com), we receive your email address, your name if you include it, and whatever you choose to tell us. Purpose: to answer you and, where you ask about buying PRE, to take the steps you ask for before any sale. Legal basis: our legitimate interest in answering the people who write to us (GDPR Article 6(1)(f)) or, where your enquiry is a step towards a purchase, Article 6(1)(b). We keep correspondence for [12] months after our last reply, or longer while a matter is still open or a legal obligation requires it. You can object to this use at any time by writing to privacy@prepouches.com.

Our mailboxes (help@, press@, privacy@ and security@prepouches.com) are provided by Google Workspace, contracted with [Google Asia Pacific Pte. Ltd. or Google Ireland Limited, confirm from the Workspace admin console]. Google stores and delivers our email on our behalf as our processor under its Cloud Data Processing Addendum. Email may be stored on Google servers outside the EU/EEA, including in the United States. For those transfers we rely on [the EU-US Data Privacy Framework, under which Google LLC is certified, and the European Commission's standard contractual clauses included in that addendum]; you can ask us at privacy@prepouches.com for a copy of the clauses we rely on, or read Google's published addendum. A deleted message leaves Google's systems after the deletion period set out in that addendum.

The launch waitlist

The site shows a "Be first to know" form only once the waitlist is open. If you use it, we ask for your email address, an optional flavour preference and your tick in the consent box. We store exactly three things: the email address, the flavour you picked (or "any") and the time you signed up. We do not store your IP address, your browser details or anything else with it.

Why: to send you one email when PRE launches. We send no reminder and no other marketing email to this address; the only other messages you receive are replies to anything you write to us, including confirmation that we have removed you. Legal basis: your consent, given by ticking the box (GDPR Article 6(1)(a)); you can withdraw it at any time. Where: in a file on our web host's servers (Railway, see below), readable by us and, as our host, by Railway under the agreement described under Web hosting. How long: until the launch email has been sent plus 30 days, or until you ask us to delete it, whichever comes first. Unsubscribe or delete: reply to any email we send, or write to privacy@prepouches.com. We stop emailing you as soon as we read your request, and never later than 10 business days after it, and we send one confirmation. We delete your entry within one month of your request.

The form has a hidden anti-bot field instead of a CAPTCHA, and our server accepts only a few sign-ups per IP address per ten minutes. We never share, sell or rent the list.

Web hosting

Like every website, this one is delivered by a web host: Railway (Railway Corporation, railway.com). To send you the page, the host's servers necessarily receive your IP address, your browser's user agent (browser, operating system and device type) and the files you requested. The host may keep this in standard server logs under its own policies.

Legal basis for the host receiving this data on our behalf, and for the rate-limit counters below: our legitimate interest in delivering the site and protecting it from abuse (GDPR Article 6(1)(f); Recital 49 recognises network and information security as such an interest). You can object by writing to privacy@prepouches.com, although a page cannot be delivered without the request that asks for it.

Railway Corporation is a company established in the United States. Our server, its logs and the waitlist file run in Railway's [REGION, for example EU West (Amsterdam, Netherlands)] region. Railway processes this data on our behalf as our processor under its Data Processing Agreement. Because Railway is a US company, giving it this data is a transfer outside the EU/EEA even though the servers are in [COUNTRY]. [There is no adequacy decision covering Railway for this purpose, so we rely on the European Commission's standard contractual clauses contained in that agreement. / Railway is certified under the EU-US Data Privacy Framework.] You can read the agreement at railway.com/legal/dpa or ask us for a copy at privacy@prepouches.com.

We do not use those logs for analytics, advertising or profiling. The request log written by our own server records only the request method, the page or file path, the response status and how long the response took. It does not record IP addresses or user agents.

Rate limiting. To protect the site from abuse, our server keeps IP-keyed request counters in memory. Depending on the route, request-counting windows are one, five or ten minutes. These windows are not deletion deadlines: inactive records are removed by periodic cleanup and can remain for roughly two windows, or longer if cleanup is delayed. Continued requests can keep a record active. The counters are not written to disk or stored in a database. Excessive requests are temporarily refused.

Third-party services the page loads

None. This section covers what your browser loads. The companies that handle our email and our hosting are named under If you email us and Web hosting. Every file the pages need (the code, the 3D component and models, the photos and, since 22 September 2026, the typefaces) is served from our own host. Your browser makes no request to any other company's servers when you use this site, so no third party receives your IP address or browser details through it.

If that ever changes, the service will be named here, with what it can see, before it goes live.

Cookies and similar technologies

We do not set cookies or use analytics or advertising trackers. The browser storage described above is listed in our Cookie policy. There is no consent banner at present; consent rules can still apply to localStorage and sessionStorage.

How long we keep data, and how we protect it

We retain waitlist entries as described in the launch waitlist section and correspondence for the period stated under “If you email us”. The waitlist is a file on our host, not a visitor database. IP-keyed rate-limit records live in server memory and are cleaned up as described under Web hosting; their counting windows are not deletion deadlines. Our own request log records method, path, status and response time, without separate IP-address or user-agent fields.

Sharing and selling

We do not sell personal data or share it with advertisers or data brokers. We use waitlist entries and correspondence for the purposes described above.

The companies that process data for us are Railway (hosting and the waitlist file) and Google (email), as described above; they act only on our instructions.

Your rights

If you are in the EU, the EEA or the UK, you have the right to ask us for access to the personal data we hold about you, to have it corrected or erased, to restrict or object to its processing and, for data you gave us with your consent, to receive it in a structured, commonly used, machine-readable format. You may also complain to a data protection supervisory authority, for example the authority of the country where you live or work; in France this is the CNIL (www.cnil.fr).

Wherever you are, where we rely on your consent, for example for the launch waitlist, you may withdraw it at any time. Withdrawing does not affect processing carried out before you withdrew.

To exercise any of these rights write to privacy@prepouches.com. We reply without undue delay and at the latest within one month. For complex or numerous requests EU law allows us up to two further months; if we need more time we tell you within the first month and explain why. We may ask you to confirm the request from the email address concerned before we act on it. Exercising these rights is free of charge.

Where we rely on our legitimate interest (answering your messages, delivering and securing the site), you have the right to object at any time under GDPR Article 21; where we rely on your consent (the waitlist), you can withdraw it at any time without affecting what was done before.

Adults only

PRE is intended for adults. This site is not directed at children, and we do not knowingly collect personal data from children.

When this changes

The site will grow. Before each of these features goes live, this policy will be updated to cover it:

• Sending the launch email: which email service sends it, if any, what that service can see, who the email names as sender, and how unsubscribing works. Whatever we use, every email will show our postal address and a way to unsubscribe that takes no more than one reply or one click.
• Analytics: which tool, what it measures, whether it uses cookies, whether a consent banner is needed, and how to opt out.
• Online shop and payments: order and delivery details, the payment processor and what it handles, delivery partners, how long order and tax records are kept, and how age is checked.
• Accounts: what an account stores, how sign-in details are protected, and how to close an account and delete its data.
• Any new third-party script, font, embed or host: added to the list of third-party services above.
• Launch market confirmed: the legal bases and regulator details that apply in any further market.

Changes to this policy

When we change this policy we update this page, change the "Last updated" date at the top and add a line to the Change log below. We have no way to notify visitors directly, because we do not hold their contact details; if a change affects the launch waitlist before the launch email goes out, we say so in that email.

Contact

This website is operated by [LEGAL ENTITY NAME], with its registered office at [REGISTERED ADDRESS], [COUNTRY]. That company is the controller of the personal data described in this policy. In this policy, "we" and "us" mean that company. [IF THE CONTROLLER HAS NO ESTABLISHMENT IN THE EU:] Our representative in the European Union under Article 27 of the GDPR is [EU REPRESENTATIVE NAME], [EU REPRESENTATIVE ADDRESS IN FRANCE OR ANOTHER MEMBER STATE], [EU REPRESENTATIVE EMAIL]. You and any supervisory authority may contact the representative, instead of or as well as us, on all issues relating to the processing of your personal data. [IF THE CONTROLLER HAS NO ESTABLISHMENT IN THE UK:] Our representative in the United Kingdom under Article 27 of the UK GDPR is [UK REPRESENTATIVE NAME], [UK REPRESENTATIVE ADDRESS], [UK REPRESENTATIVE EMAIL]. Our data protection contact is [DPO ROLE], reachable at privacy@prepouches.com. These details are placeholders pending confirmation.

See also the Terms of Use.

Change log

Every change to this policy is listed here, newest first.