Delivered before Christmas in France if you order by

GitShirt

Privacy policy

Last updated ·

Last updated: November 10, 2026

This page explains which personal data we use on git-shirt.com, why, who we share it with, how long we keep it and what your rights are.

1. Who is responsible for your data

The data controller is Humansix SAS, RCS Nantes 538 173 188, 3-5 rue des Rémouleurs, 44190 Clisson, France.

For any question about your data: the contact form.

2. The data we use

  • Your contact details: name, email address, phone number, postal address.
  • The recipient's details, if you send a gift to someone else: name, postal address and, if the carrier needs it, phone number.
  • Your order: products, sizes, options, gift message, amount, history and messages with customer service.
  • The GitHub username you type, and the graph and stats made from that account's public data.
  • Payment: handled by Stripe. We receive the payment status, but never your full card number.
  • Your email address, if you leave it to get our news, to be told about a launch, or to receive your “My year in commits” card in high definition with a reminder before the last order date for Christmas.
  • Your cart, if you have not checked out.
  • Technical data: your IP address, to limit the number of requests and protect the site, and a session cookie.

3. About the GitHub username

To create the design, the site reads the public contribution calendar of the account typed, on github.com (our server does this reading). We only read public data. We have no access to any private data of the account.

If you type someone else's username, we use that username and its public data only to make your order.

Do you hold a GitHub account and not want your graph printed? Write to us at the contact form. You can object to this processing. We can then block your username for future orders.

4. Why we use it, and on what legal basis

  • Processing your order (production, delivery, confirmation and shipping emails, customer service, gift cards): necessary to perform the contract.
  • Keeping our accounts (invoices, accounting records): a legal obligation.
  • Securing payments and preventing fraud: our legitimate interest, and Stripe's, in protecting payments.
  • Protecting the site (limiting requests per IP address): our legitimate interest in keeping the site available and safe.
  • Printing another person's graph as a gift: our legitimate interest and yours in offering a personalised product, based on data that person has made public.
  • Keeping your cart: our legitimate interest in letting you find your cart again.
  • Sending you our news, your year card and the Christmas reminder: your consent, given by ticking the box next to the email field. Every email has an unsubscribe link.
  • Measuring site traffic: your consent, given through the cookie banner.

Without your contact details, we cannot process or deliver your order.

We do not sell your data.

5. Who receives your data

Only the Humansix SAS team has access to your data, together with our service providers, each for its own task only:

  • Printful: production and shipping. Printful receives the order content, the print file, the name, the delivery address and, if needed, the phone number. Printful passes them on to the carrier.
  • Stripe: payment and fraud prevention. Stripe also processes some data for its own obligations; see its privacy policy on stripe.com.
  • OVH SAS: hosting of the site and its database, on a dedicated server located in France.
  • Google (Google Workspace): our email, for the emails you send us and we send you.
  • Google (Google Analytics): audience measurement of the site, only if you accept it in the cookie banner.
  • Brevo (Sendinblue SAS): sending the site's emails (order confirmation and shipping, year card, Christmas reminder), from servers located in the European Union.

We may also pass data to public authorities when the law requires it.

6. Transfers outside the European Union

Some data may be processed outside the European Union:

  • by Printful, which also has production facilities in the United States;
  • by Stripe, whose group is based in the United States;
  • by Google, for email and audience measurement.

These transfers are covered by the safeguards provided by the GDPR: an adequacy decision of the European Commission (for example the EU–U.S. Data Privacy Framework, for certified companies) or standard contractual clauses adopted by the European Commission. You can ask us for more information about these safeguards.

If you have an order delivered outside the European Union, we must send the delivery address to the country concerned to carry out the order.

7. How long we keep it

These are the periods we apply:

  • Orders and invoices: 10 years, to meet our accounting obligations.
  • Emails left to receive our news (prospects): 3 years from collection or from your last contact with us. If you unsubscribe earlier, we stop all emails.
  • Carts not checked out: 13 months.
  • IP addresses used for rate limiting: 10 minutes for rate limiting, 14 days in the server logs.
  • Cookies: see our Cookies page.

At the end of these periods, the data is deleted or made anonymous.

8. Security

We protect your data: encrypted connection (HTTPS), access limited to the people who need it, payment handled by Stripe without your card being stored by us.

9. Your rights

At any time, you can:

  • access your data and get a copy;
  • have it corrected;
  • have it erased, unless the law requires us to keep it;
  • ask us to restrict its use;
  • object to its use, in particular for marketing;
  • get the data you gave us in a common format (portability);
  • withdraw your consent, without affecting what was done before;
  • tell us what you want us to do with your data after your death.

Write to us at the contact form or to Humansix SAS, 3-5 rue des Rémouleurs, 44190 Clisson, France. We reply within one month. If we have reasonable doubts about your identity, we may ask you for proof.

10. Complaint to the CNIL

If you think your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority:

If you live in another EU country, you can also contact the data protection authority of your country.

11. Changes

We may update this policy. The date of the last update is shown at the top of the page.