finds & things
Back

Privacy Policy

Last updated: 17 October 2026

1. Who is responsible

The data controller for findsandthings.com is Creative Adventures Lab, SASU (Société par actions simplifiée unipersonnelle), Bureau 326, 59 rue de Ponthieu, 75008 Paris, France (SIREN 108 626 904). See our mentions légales.

2. Data we collect

  • Technical and connection data automatically logged by our hosting provider (Lovable): IP address, browser type and version, device and operating system, pages requested, referring page, date and time of access.
  • Error reports: if a page fails to load, our hosting provider, Lovable, records technical details of the error (page address, browser, error message) so it can be fixed.
  • Amazon buttons and links: every Amazon button and product link on this site is an Amazon affiliate link. When you click one, you continue on Amazon's website or app, where Amazon applies its own Privacy Notice and Conditions of Use. See section 4 for details.
  • Messages you send us: if you write to contact@creativeadventureslab.com, your email address and whatever you put in the message.

3. Why we use it and legal basis (GDPR)

  • Operating, securing and hosting the site: legitimate interest.
  • Affiliate attribution (Amazon Associates): legitimate interest.
  • Answering your messages: legitimate interest.

4. Third parties

  • Lovable (hosting) and its infrastructure providers (including Cloudflare) process technical data on our behalf.
  • Amazon. Every product link on this site, in a post, on a board or on the shop page, is an Amazon affiliate link, and as an Amazon Associate we earn from qualifying purchases, at no extra cost to you.
    • What happens when you click one. The product's page opens on the Amazon website in your browser, or in the Amazon app if you have it, and you leave finds & things. Depending on where you are, you may be taken to your local Amazon store. The link is a fixed address carrying only our associate tag. Once you are there, Amazon sees your IP address and standard request details, like any website you open.
    • Amazon counts the click, anonymously. This is how affiliate programs work. Amazon records that a click came from finds & things, and whether a purchase followed, so that the commission can be calculated. It may set its own cookies in your browser to connect a later purchase to that click, under its privacy terms, not ours. What comes back to us is only aggregate: how many people clicked a link, how many purchases followed, and the commission earned. Those reports name the products and the totals.
    • Amazon's own policies apply once you leave. Your activity on Amazon (browsing, signing in, and any purchase) is governed by Amazon's Privacy Notice and Conditions of Use, not by this policy. We never see your Amazon account, your basket or your payment details.
    • Entirely optional. Using these links is optional, and clicking one creates no account or profile with us.
    • Illustrations are stylised. The product pictures on this site are our own stylised illustrations, for reference only. They are not photographs and do not represent the actual appearance of each item. See the product's real photos and details on Amazon.

    Amazon and the Amazon logo are trademarks of Amazon.com, Inc. or its affiliates.

  • YouTube (Google). The home page shows the latest videos from our sister channel, Le Chantier. Their titles and links come from YouTube's public video feed, which our server reads; nothing about you is sent to YouTube in that step. Your browser then loads the thumbnail images from YouTube's image servers, which receive your IP address and standard request details, like any website you open. No YouTube player is embedded on this site, and no YouTube cookie is set here. Clicking a video or the channel link opens YouTube in your browser or the YouTube app, where Google's Privacy Policy and YouTube's Terms of Service apply, not this policy.
  • Google Fonts: fonts are loaded from Google servers, which receive your IP address.

Amazon and YouTube policies. Once you leave this site, these apply:

Some of these providers may transfer data outside the European Union under appropriate safeguards (such as Standard Contractual Clauses). We never sell your personal data.

5. Cookies

We set no advertising, analytics or profiling cookies. Two strictly necessary cookies are set by our hosting infrastructure:

  • __cf_bm: set by Cloudflare to distinguish human visitors from bots and protect the site. Necessary for security.
  • _dpl (also written __dpl): set by our hosting layer so that you are served one consistent version of the site. It identifies the deployment, not you, and cannot be switched off.

Because both are strictly necessary to deliver the site you asked for, they do not require your consent, and we therefore show no cookie banner. Amazon and YouTube set their own cookies only once you follow a link and arrive on their sites.

6. How long we keep it

Server logs are kept for a limited period by our host; messages for up to 3 years after our last exchange.

7. Security

The site is served over an encrypted connection (HTTPS). We and our providers take reasonable measures to protect the data described in this policy, but no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. Please do not send us sensitive personal data by email.

8. Your rights

You have the right to access, rectify, erase, restrict or object to the processing of your data, to data portability, to withdraw consent, and to set instructions for your data after death. To exercise them, write to contact@creativeadventureslab.com or to Creative Adventures Lab SASU, Bureau 326, 59 rue de Ponthieu, 75008 Paris, France. We reply within one month. For complex requests this can be extended by two more months, and we will tell you if it is. There is no fee unless a request is manifestly unfounded or excessive. You may also file a complaint with the CNIL at www.cnil.fr/fr/plaintes, or by post to CNIL, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

9. Changes

We may update this policy; the date at the top shows the latest version.

10. Children's privacy

finds & things is intended for people aged 16 and over, in line with the default age of digital consent under the GDPR (Article 8). By accessing and using this website, you confirm that you are at least 16 years old. The site is not directed to children under 16, and we do not knowingly collect personal data from children. If your local law requires a parent or legal guardian's consent and supervision for someone your age to use the site, you may use it only with that consent and under their supervision. Parents and legal guardians remain responsible for supervising their child's use of the site.

If you are a parent or guardian and believe your child has sent us personal data, for example in a message, contact us at contact@creativeadventureslab.com and we will take prompt steps to delete it.