Privacy policy
Last updated: 23 July 2026 English is the store’s base language. The French version is the legally authoritative version and prevails in the event of any discrepancy.
Minimalist Labs values the protection of your privacy and your data. We are committed to offering the highest standards in products and services. We value each of our existing and potential customers and aim to maintain appropriate protection of your personal data (“Data”).
This Privacy Policy explains how Minimalist Labs collects and processes your Data when you use our website (the “Site”) and when you buy our products via the Site, as required by data protection regulations in the territories where we operate.
1. Who we are
The controller of personal data collected via lessismore.co is:
Minimalist Labs SAS (“less is more”), a French SAS with a share capital of €30,400, 39 rue du Sentier, 75002 Paris — RCS Paris B 901 204 271 (SIREN 901 204 271). Contact: hello@lessismore.co
This policy is based on Regulation (EU) 2016/679 (“GDPR”) and the amended French Data Protection Act of 6 January 1978. It supplements the legal notice and the terms of sale.
2. What data, for what purposes?
Any information allowing you to be identified directly (e.g. your name) or indirectly (e.g. your unique customer ID) is “personal data”.
More specifically, Minimalist Labs may collect, record, transfer and use your Data relating to:
- your identity: title, surname, first name, date of birth where applicable;
- your contact details: email address, delivery and billing postal address, phone number;
- the management of your orders: purchase history, amount, basket contents, delivery method, tracking number, returns and refunds;
- your payment data: transaction data, tokenised payment method for the subscription (your full banking details are never accessible to us);
- your customer account: login credentials, preferences, subscription status;
- your interactions with us: exchanges with customer service, survey responses, product reviews, contest participation, referrals;
- your browsing on the Site: IP address, device and browser type, pages viewed, data from cookies and trackers (see section 8).
We only collect the Data strictly necessary for the following purposes:
| Purpose | Data concerned | Legal basis |
|---|---|---|
| Customer account, orders, delivery and returns | Identity, contact details, delivery address, purchase history | Performance of the contract |
| Payment, invoicing and accounting | Transaction data (banking details are processed by our payment providers and are not accessible to us) | Legal obligation |
| Email marketing to consumers (newsletter, offers) and ad personalisation | Email, preferences, browsing behaviour | Consent |
| Commercial prospecting of professionals (hospitality, retailers) | Publicly available or provided business contact details | Legitimate interest (B2B business development), with the right to object at any time |
| Referral programme | Referee’s email (provided by the referrer) | Consent / legitimate interest |
| Satisfaction surveys, product reviews, statistics, contests | Identity, email, responses | Legitimate interest (improving our products and services) |
| Pre-litigation and litigation management | Data in the relevant file | Legitimate interest (evidence of a right) |
| Subscription (recurring payments) | Identity, tokenised payment method, chosen frequency | Performance of the contract |
Data is collected directly from you, except for the referral programme. Under the “Refer a friend” programme, we may collect your email address to offer you a discount voucher on your first order. In that case, one of your contacts will have entered your email address on our Site, which is why we will contact you (indirect collection).
3. Who has access to your Data?
Your Data is only shared with recipients who need it for the relevant purpose:
| Recipient | Role | Location | Privacy policy |
|---|---|---|---|
| Shopify Inc. | Hosting and e-commerce platform | Canada (outside EEA, adequacy decision) | shopify.com/legal/privacy |
| Shopify Payments / Shop Pay | Card payment on the Site | Canada / Ireland | shopify.com/legal/privacy |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Payment | Luxembourg (EEA) | paypal.com |
| Apple Inc. | Payment (Apple Pay) | United States (outside EEA) | apple.com/legal/privacy |
| Épicerie Fine Cosmétique | Order preparation and dispatch | 39 route d’Herqueville, 27430 Andé, France (EEA) | — |
| La Poste / Colissimo and carrier partners | Delivery | France / European Union (EEA) | laposte.fr |
| Klaviyo Inc. | Email marketing to retail customers | United States (outside EEA) | klaviyo.com/legal/privacy |
| lemlist | Prospecting of professional customers | France / European Union (EEA) | lemlist.com |
| Inflate | Product review collection and display | European Union (EEA) | inflate.review/fr/privacy |
| Trustpilot A/S | Brand review collection and display | Denmark (EEA) | trustpilot.com |
| Revoq (BuschBytes) | Online withdrawal request management | Germany / EU hosting (EEA) | consumer-withdrawal.eu/privacy |
Where applicable, your Data may also be shared with the relevant courts, mediators, lawyers, bailiffs, accountants and statutory auditors.
Under no circumstances is or will your Data be sold by Minimalist Labs to anyone.
4. Is your Data transferred outside the European Union?
Some of our providers (notably Shopify, Klaviyo and Apple) are located or host Data in Canada and the United States, as indicated in the table above.
Any transfer is covered either by a European Commission adequacy decision (article 45 GDPR — the case for Canada and for US companies certified under the Data Privacy Framework) or by appropriate safeguards (article 46 GDPR), notably standard contractual clauses, supplemented by technical and organisational measures ensuring a level of protection substantially equivalent to that required by the GDPR.
5. How long do we keep your Data?
We keep your Data for as long as necessary for the purpose for which it was collected. This means that data in our systems is destroyed, deleted or anonymised as soon as it is no longer needed. We take all appropriate steps to ensure your Data is kept:
- for the time needed to provide you with a service;
- for the time required by law, the contract or our legal obligations;
- for the time needed for the purpose for which the Data was collected, or longer if the contract or applicable law requires, with appropriate safeguards.
In practice:
- Prospects (non-customers): kept, unless you object or request deletion, for three (3) years from the last contact.
- Customers: three (3) years after the last purchase in the active database, then restricted-access intermediate archiving for up to five (5) years (dispute management).
- Invoices and accounting records: ten (10) years (legal obligation).
- Proof of identity: one (1) year where a right of access, rectification, restriction, erasure, portability or objection is exercised.
- Cookies and trackers: see section 8.
6. Your rights
You have the following rights over your Data:
- Right of access: obtain confirmation that your Data is processed and receive a copy.
- Right of rectification: have inaccurate or incomplete Data corrected or completed.
- Right to erasure: obtain the deletion of your Data, in particular where it is no longer necessary or you withdraw your consent.
- Right to restriction: obtain the temporary freezing of the processing of your Data.
- Right to object: object to processing based on our legitimate interest for reasons relating to your particular situation, and object at any time and without justification to direct marketing.
- Right to portability: receive the Data you provided to us in a structured, commonly used and machine-readable format.
- Right to withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand.
- Right to give directives on the fate of your Data after your death.
To exercise your rights, you can:
- email hello@lessismore.co, specifying the right exercised;
- or write to Minimalist Labs SAS, 39 rue du Sentier, 75002 Paris, France.
In case of reasonable doubt about your identity, proof of identity may be requested (article 12.6 GDPR). We respond within one (1) month.
You may lodge a complaint with the CNIL (French data protection authority — www.cnil.fr) if you believe your rights are not respected.
7. Security
We implement appropriate technical and organisational measures, having regard to the nature of the Data and the risks its processing entails, to protect the security and confidentiality of the Data against loss, unauthorised access and disclosure. These measures include in particular:
- TLS encryption of all exchanges with the Site;
- limiting access to the Data to authorised persons only, on a need-to-know basis;
- strengthened authentication of access to administration tools;
- the use of providers offering sufficient guarantees, bound by processing agreements compliant with article 28 of the GDPR.
Despite all the confidentiality and security measures put in place by Minimalist Labs, we draw your attention to the fact that communications over the internet are never fully secure. Minimalist Labs therefore declines any liability in the event of an internet communication failure or any other case of force majeure.
8. Cookies and trackers
8.1. What is a cookie?
When you visit a website, data may be stored in or retrieved from your browser, generally in the form of cookies. This information may relate to you, your preferences or your device, and is mainly used to ensure the site works properly. The information generally does not identify you directly, but may give you a more personalised experience. Because we respect your right to privacy, we give you the option not to allow certain types of cookies.
8.2. Your consent
On your first visit, a consent banner lets you accept, refuse or customise cookies, with the same degree of simplicity for each choice. You can change your choice at any time via the “Manage my cookies” link in the footer.
Any settings you apply may alter your browsing on the Site. We decline any liability for the consequences of degraded operation of our services resulting from the inability to store or read the necessary cookies following the settings changes you have made.
8.3. Categories of cookies used
Strictly necessary cookies — These cookies are essential for the Site to work: they store your basket contents, keep you logged in, secure payment and record your cookie choices. Without them, the Site cannot work properly and you could not place an order. They are exempt from consent and cannot be disabled from our banner.
Audience-measurement cookies — These cookies let us count visits, identify the most-viewed pages and understand how visitors navigate the Site. The information collected is aggregated and used solely to improve the Site’s usability and content. If you refuse them, we will not know that you visited the Site, without this affecting your browsing.
Personalisation and advertising cookies — These cookies, set by us or our partners (social networks, ad networks), let us offer you content and offers tailored to your interests, on our Site and on other sites, and measure the effectiveness of our campaigns. They rely on building a browsing profile. If you refuse them, you will still see advertising, but it will be less relevant. These cookies are only set with your consent; the relevant third parties may process your Data under their own privacy policies.
8.4. Retention periods
In line with CNIL recommendations, your choice (consent or refusal) is kept for six (6) months, trackers have a maximum lifespan of thirteen (13) months, and information collected via these trackers is kept for a maximum of twenty-five (25) months.
8.5. Tracking pixels in our emails
Our emails may contain tracking pixels that let us know whether the message was opened and whether you clicked the links it contains, in order to measure the interest of our communications and improve their relevance. In accordance with the CNIL recommendation on tracking pixels, this is only implemented with your consent. You can object at any time by writing to hello@lessismore.co or via the unsubscribe link at the bottom of each of our emails.
9. Updates to this policy
Minimalist Labs reserves the right to amend this policy at any time. The date of the last update appears at the top of the document. In the event of a substantial change to processing, you will be informed visibly on the Site or by email.
10. Contact and disputes
For any question, you can contact: hello@lessismore.co.
This policy is governed by French law. In the event of a dispute, an amicable solution will be sought before any action; the jurisdiction rules in section 16 of the terms of sale apply.