Privacy (Integritetspolicy)

Who holds your data

Art. 13(1)(a) — company name, organisation number and address: TBC — not yet available

We have not appointed a data protection officer. You can reach us about anything on this page through the contact page.

What we hold, and why

Your account: the email address you sign in with, your name if you gave one, and when the account was created. We hold these so you can sign in and see your own orders.

Optional profile details: if you choose to tell us your gender (female or male) — on the profile-completion page or under Your account → Your data — we use it only in aggregate statistics, for example how many of our customers are women. It is never required, never affects your orders, prices or support, and clearing the field (back to “Not stated”) deletes the answer. It is deleted with your account in every case.

Your date of birth: we ask for it and require it before your first order, because we only sell to adults (18+) and the full date lets us check that exactly on the day you buy. In statistics we only ever use broad age ranges — never your date on its own. It is deleted with your account in every case.

Your delivery address: collected when you complete your profile and required before your first order, because an order needs somewhere to go. It is used to deliver what you buy — including when the payment provider does not pass an address back to us — and you can change it on the profile-completion page. It is deleted with your account; the address on an already-placed order is kept only as long as that order's records are.

Where an address search box is offered, it is powered by Google: what you type in the search box is sent to Google to fetch suggestions. The ordinary address fields send nothing to Google — the search is a convenience, never a requirement.

Your orders: what you bought, what you paid, the delivery address you entered, and an email address to write to you about the order. We hold these to sell you the goods and to deal with anything that goes wrong afterwards.

Support messages: what you wrote to us and what we answered. We hold these to answer you and to know what was already said if you write again.

Technical records: sign-in sessions, which carry the IP address and browser the session was created from, so we can end a session that is not yours.

Art. 13(1)(c) — the lawful basis for each purpose above: TBC — not yet available

Art. 13(1)(d) — the legitimate interests, where that is the basis: TBC — not yet available

Art. 13(2)(e) — whether providing the data is a statutory or contractual requirement: TBC — not yet available

Who else sees it

Stripe processes your payment. They receive what a payment needs, including the card or Klarna details you enter — those go to Stripe directly and never through this website, so we never hold your card number.

Our email provider delivers the messages we send you about an order or a support case.

Our accounting provider holds the invoices we are required to keep.

We do not sell your data, and we do not share it for anyone else's marketing.

Art. 13(1)(f) — transfers outside the EEA and the safeguards for them: TBC — not yet available

How long we keep it

The periods are set out in full on our storage-periods page. In short: settled support cases and their messages are deleted after 30 days of no contact; a closed account is deleted after 30 days; dead sign-in sessions are deleted after 30 days; messages we sent you are deleted from our sending queue after 90 days. Some order details are kept longer because bookkeeping law requires the record of a sale to be preserved.

Server and access log retention — no deploy target exists yet, so there is nothing to describe honestly: TBC — not yet available

Backup retention, and when a deleted account ages out of backups: TBC — not yet available

What you can make us do

From your account you can download everything this website holds about you, correct your name, object to direct marketing, and ask us to close your account or erase your data. Those are buttons, not requests — the page is called Your data.

You can also ask us to correct or restrict something, or to send your data to another company, by contacting us.

If you think we have handled your data wrongly you can complain to the Swedish authority for privacy protection, Integritetsskyddsmyndigheten (IMY).

Art. 13(2)(c) — withdrawing consent, once the lawful bases in 13(1)(c) are settled: TBC — not yet available

Automated decisions

Nothing about you is decided automatically. No profiling is used to decide whether you can buy, what you pay, or how a support case is handled.