This policy explains what personal data we collect when you visit Layoverbag or place an order, why we collect it, who receives it, how long we keep it and what your rights are.
Last updated: November 2, 2026
Who is responsible
The controller of your personal data is MB CORPORATION EI, trading as Layoverbag, NA. Email: [email protected]. Our business is established in France, so we apply the EU General Data Protection Regulation (GDPR) and French data protection law to all the personal data we handle, wherever you live. If you live in California, see also “California residents” below.
What we collect and why
| Purpose | Data | Legal basis |
|---|---|---|
| Taking, shipping and supporting your order | Name, shipping and billing address, email, phone number if you give it, items ordered, messages about your order | Performance of our contract with you |
| Payment | You enter your card or wallet details with Stripe, not with us. We receive the payment result and limited details such as the card brand, last 4 digits, expiry date and country. | Performance of our contract |
| Accounting and tax records | Order, invoice and payment records | Legal obligation |
| Preventing fraud and handling payment disputes | The IP address and browser details stored with your order, the record of the terms and policies you accepted at checkout, tracking and delivery data, and our messages with you | Our legitimate interest in preventing fraud and defending our rights |
| Your customer account, if you create one | Email, password (stored in hashed form), addresses, order history | Performance of our contract |
| Cart reminders | Email and cart contents, if you leave checkout before paying | See “Cart reminder emails” below |
| Newsletter, if you subscribe | Your consent | |
| Website statistics (Google Analytics) | Pages viewed, device and browser, approximate location, how you arrived on the site | Your consent |
| Remembering your cookie choice | Your choice and its date | Legal obligation |
| Website security | IP address, browser details and pages requested, in server and security logs | Our legitimate interest in keeping the site secure |
We need your name, address and email to deliver your order: without them, we cannot sell to you. Stripe screens payments automatically for fraud and may decline one; if this happens, contact us and we will review it.
Cart reminder emails
If you enter your email at checkout and leave without paying, we may send you up to 2 reminders, about 1 hour later and the next day. A reminder may include a single-use discount code.
- If you live in the EU/EEA, the UK, Switzerland, Canada or Australia, we send reminders only if you ticked the reminder box at checkout (your consent).
- If you live in the United States, we may send reminders unless you unsubscribe (our legitimate interest in helping you complete your purchase).
- Every reminder has a one-click unsubscribe link, and we stop as soon as you use it.
- Abandoned cart data is deleted after 30 days at most.
Who receives your data
We share personal data only with the providers we need to run the store, each for its own task:
- Stripe Payments Europe, Ltd. (Ireland), our payment processor. Stripe also uses payment data as an independent controller, for fraud prevention and its own legal obligations, under its own privacy policy.
- CJ Dropshipping (China), our supplier, which packs and ships your order, and the carriers it uses (for example USPS, UPS, FedEx and local postal services): your name, shipping address, phone number if given, and the items ordered.
- Resend, Inc. (United States), which sends our emails: order confirmations, shipping updates and reminders.
- OVH SAS, which hosts our website and its database.
- Cloudflare, Inc. (United States), which delivers and protects the website.
- Google (Google Ireland Limited and Google LLC), for website statistics, only if you accept statistics cookies.
- 17TRACK (China): the tracking lookup on our Track page loads from 17TRACK only after you click to use it. 17TRACK then receives your tracking number and your IP address.
- Our accountant and legal advisers, and public authorities when the law requires it.
We do not sell your personal data, and we do not share it for targeted advertising.
Transfers outside Europe
Some of these providers are outside the European Economic Area. Transfers to the United States rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission’s standard contractual clauses. Sending your order details to our supplier and its carriers in China is necessary to deliver your order (article 49(1)(b) GDPR); where they offer them, we also use standard contractual clauses. You can ask us for more information about these safeguards.
Cookies and similar technologies
We use the cookies the site needs to work, and optional cookies only if you accept them in our cookie banner. You can change your choice at any time with the “Cookie preferences” link at the bottom of every page.
| Name | Purpose | Duration | Type |
|---|---|---|---|
| maleable_consent | Remembers your cookie choice | 180 days | Needed |
| woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_* | Keep your cart | Session to 2 days | Needed |
| __stripe_mid, __stripe_sid | Fraud prevention during payment (Stripe) | 1 year; 30 minutes | Needed |
| __cf_bm, cf_clearance | Set by Cloudflare only when needed to filter bots and attacks | 30 minutes; for cf_clearance, as long as the security check is valid | Needed |
| wordpress_logged_in_*, wordpress_sec_*, wordpress_test_cookie | Sign in to your account | Session, or 14 days if you choose to stay signed in | Needed |
| _ga, _ga_* | Website statistics (Google Analytics) | Up to 2 years | Optional |
| sbjs_* | Record how you arrived on the site, for our order statistics | Session | Optional |
| Recently viewed products (stored in your browser) | Show the products you looked at | Until you clear your browser data | Optional |
Until you accept, Google Analytics sets no cookies on your device; the Google tag may still send Google basic information without cookies (such as the page viewed, your browser type and your choice), which Google uses to estimate statistics. On product pages, express payment buttons load only after you accept optional cookies.
How long we keep data
| Data | Kept for |
|---|---|
| Orders and invoices, with the IP address, browser details and acceptance record stored with them | 10 years, as French law requires for accounting records and for contracts concluded online |
| Customer account | Until you delete it, or 3 years after your last activity |
| Support messages | 3 years after our last exchange |
| Abandoned carts | 30 days at most |
| Newsletter subscription | Until you unsubscribe, or 3 years without any interaction |
| Google Analytics data | 14 months at most |
| Cookie choice | 180 days |
| Security logs | 12 months at most |
Your rights
You can ask us to access, correct or delete your personal data, to restrict its use or to object to it (including, at any time, to marketing), to receive it in a portable format, and to withdraw any consent you gave, without affecting what was done before. You can also give us instructions about what happens to your data after your death. Email [email protected]: we answer within one month and may ask you to confirm your identity. Some data must be kept even after a deletion request, such as invoices. You can also complain to the French data protection authority, the CNIL (cnil.fr), or to the authority of the country where you live.
California residents
- We do not sell your personal information and do not share it for cross-context behavioral advertising.
- The categories of personal information we collect, their sources, purposes and recipients are listed above. You can use the rights described in “Your rights”, and we will not discriminate against you for using them.
- We do not disclose personal information to third parties for their own direct marketing purposes.
- We do not respond to browser “Do Not Track” signals; optional cookies are used only if you accept them in our cookie banner.
- Google (statistics, only if you accept) and Stripe (during payment) may collect information about your online activities over time and across different websites.
Children
Our store is not intended for children. We do not knowingly collect personal data from anyone under 16.
Security
The site uses encrypted connections (HTTPS), each provider receives only the data it needs, and card details are handled only by Stripe.
Changes to this policy
We may update this policy. The date at the top shows the latest version. If a change is significant, we tell you by email or with a notice on the site.
Contact
MB CORPORATION EI, NA. Email: [email protected].