Privacy Policy

1. Introduction

Sartorium is a members-only directory and showcase for classic menswear houses. This Privacy Policy explains how DIRO s.r.o. ("we", "us", "our") collects, uses, and protects your personal data in compliance with the General Data Protection Regulation (GDPR).

It covers both sides of the platform: individuals who hold an account to browse the directory, and houses that publish a page on it.

2. Data Controller

The Data Controller for your personal information is:

DIRO s.r.o.

Roháčova 145/14, Žižkov, 130 00 Prague 3, Czech Republic.

Email: hello@sartorium.net

3. What Data We Collect

We collect only what a given feature needs, and most of the list below depends on what you actually do — opting into location alerts, claiming a house, requesting an appointment.

• —Account: your name, your email address, a hashed password (the password itself is never stored), the account type you chose at signup (individual or house), and your language preference.
• —Session and technical data: signing in creates a session record holding your IP address, your browser's user-agent string, and timestamps. It keeps you signed in and helps us detect abuse.
• —Watched cities (optional, individuals): if you opt in to proximity alerts, the cities you ask to be notified about, with coordinates deliberately rounded to two decimal places — roughly one kilometre. We do not store a precise position, and turning the option off erases these fields.
• —Fit preference (individuals): your preferred cut. Body measurements and the digital wardrobe are not yet available; this policy will be updated before either of them collects anything.
• —House page (houses): everything you choose to publish — house name, description, tagline, founding year, website, Instagram handle, logo, photographs, and shop addresses. This content is by design visible to every signed-in member.
• —Images: photographs you upload are re-encoded on our servers, which strips all embedded metadata — including EXIF GPS coordinates — before the file is stored.
• —Appointment requests: which trunk-show slot you requested, on what date, and its status.
• —Billing (houses): references issued by our payment provider — a customer identifier and a subscription identifier. We never see, receive, or store card details.
• —Usage analytics: cookieless measurement of page views and interactions. No persistent identifier is written to your device and no analytics profile is built about you.
• —Waitlist: if you joined our pre-launch waitlist, the name and email address you gave at the time.

4. How We Use Your Data

We use your data to:

• —Operate your account — signing in, session security, language, password reset.
• —Deliver the service — showing the directory and house pages to signed-in members, letting a house publish and edit its page, and handling house claims and appointment requests.
• —Notify you when a trunk show is announced near a city you asked to watch. This only ever happens if you opted in.
• —Bill houses for their subscription and issue the corresponding receipts.
• —Protect the platform — rate limits, abuse detection, and protection of the directory against bulk extraction.
• —Understand in aggregate how the directory is used, so we can improve it.
• —Send you updates and newsletters, if you asked for them. Every such email carries an unsubscribe link.

5. Legal Basis for Processing

Under Article 6 of the GDPR, we process your personal data on the following legal bases:

• —Performance of a contract (Art. 6(1)(b)): creating and running your account, giving you access to the directory, publishing a house page, handling appointment requests, and administering a house subscription.
• —Consent (Art. 6(1)(a)): proximity alerts and the watched cities they require, newsletters and marketing communications, and the pre-launch waitlist. You may withdraw your consent at any time, without affecting the lawfulness of what came before.
• —Legitimate interest (Art. 6(1)(f)): keeping the platform secure and available, preventing abuse, protecting the curated directory against bulk extraction, and analysing usage in aggregate. You may object to processing on this basis at any time.
• —Legal obligation (Art. 6(1)(c)): retaining accounting records relating to paid subscriptions for the period required by law.

6. Third-Party Services & Data Processors

To operate the platform we rely on the providers below. Each acts on our instructions under a data processing agreement, and we choose an EU-hosted option wherever one exists.

• —Neon: our database, hosted in the European Union (Frankfurt). Account, profile, house and booking data are stored there.
• —Vercel: our hosting and application platform, which processes technical request data such as IP addresses and browser information in order to serve the site.
• —Vercel Blob: object storage for the images houses upload — logos, hero images and gallery photographs.
• —Brevo: a European provider used for transactional email (account emails, proximity alerts, booking notices) and for our contact lists.
• —Geoapify: a geocoding provider hosted in Austria, which turns a place name into coordinates. It is called only from our servers — your browser never contacts it — and every result is cached so the same place is looked up once.
• —OpenFreeMap: the interactive map loads its tiles from OpenFreeMap. When the map is displayed, your IP address is transmitted to their servers as part of the standard tile request.
• —PostHog (Cloud EU): product analytics, run without cookies and without a persistent identifier.
• —Sentry: error monitoring, on its European data region. When something breaks, a report of the failure is sent so we can fix it. Reports are filtered before they leave our servers: no session cookie, no email address, no measurement, and an account is identified by its internal id rather than by name.
• —Paddle: our Merchant of Record for house subscriptions. Paddle collects and processes payment and billing information directly and securely.
• —Upstash: short-lived rate-limit counters, keyed on an account identifier or an IP address. No message content or personal profile is stored there.

7. What a House Can See About You

Sartorium has two sides, so a small amount of data reaches a house. Once it does, that house is a separate controller for what it goes on to do with it.

• —If you request a trunk-show appointment, the house sees your name, your language, and the slot you asked for — and nothing else.
• —A house never receives your email address, your postal address, your watched cities, or any measurement, through Sartorium.
• —A house is never told which members viewed its page. Reading a house page does not reveal your identity to it.

If you contact a house directly using the website, Instagram or address shown on its page, you leave Sartorium and that exchange is between you and them, under their own privacy practices.

8. Cookies

We use two strictly necessary cookies: one that keeps you signed in, and one that remembers your language. Neither requires consent under the ePrivacy rules.

Our analytics run without cookies and without any persistent identifier, which is why you are not shown a cookie banner. We use no advertising and no cross-site tracking cookies. Should this ever change, we will update this policy and ask for your consent first.

9. International Transfers

Our database, our email provider, our analytics and our geocoder all process data within the European Union. Some providers — notably our hosting platform and our payment provider — are established outside the EEA or may process data there. In those cases the transfer relies on the European Commission's Standard Contractual Clauses or on an adequacy decision.

10. Data Retention

We keep your account data for as long as your account exists. Deleting your account erases it — your profile, your watched cities, your appointment history and, for a house, its page and its photographs — immediately and by cascade. The only exception is records we are legally required to keep, such as accounting records for a paid subscription.

You can delete your account yourself at any time from your account settings; you do not need to write to us. Newsletters and the waitlist are ended by the unsubscribe link carried in any of our emails.

11. Your GDPR Rights

Under the GDPR, you have the right to:

• —Access: Request a copy of the personal data we hold about you.
• —Rectification: Request correction of inaccurate or incomplete data.
• —Erasure (Right to be Forgotten): Request the deletion of your personal data.
• —Restriction: Request that we limit the processing of your data.
• —Data Portability: Receive your data in a structured, commonly used format.
• —Objection: Object at any time to the processing of your data based on our legitimate interests, and to direct marketing.
• —Withdrawal of Consent: Withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
• —Complaint: Lodge a complaint with a supervisory authority — in our case the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, www.uoou.cz) — or with the authority of your country of residence.

Erasure is available to you directly in your account settings. For anything else, contact us at hello@sartorium.net.

12. Changes to This Policy

We update this policy whenever we add a feature that processes new data, and we do it before that feature ships rather than after. Significant changes are announced by email or by updating the date at the top of this document.