Privacy policy

1. Controller and contact

The seller operating Husdjurskonst is the controller for the store's processing. Identity and contact details appear under Contact and seller information. Email Husdjurskonst customer support about your data or rights. This notice informs you about processing; it does not replace consent where required.

2. What we process and why

• Purchases and delivery: name, email, telephone if provided, billing and delivery addresses, order choices, payment status and transaction references. Purposes: contracts, payments, production, delivery and complaints. Legal basis: contract (GDPR Article 6(1)(b)). Accounting records are also processed under a legal obligation (Article 6(1)(c)).
• Portraits: uploaded photos, names, quotes, instructions and final print files to create and deliver your order (contract). Avoid uploading sensitive personal data or unnecessary photos of people. We receive the material directly from you.
• Customer service and accounts: messages, order references, login codes and session details to provide requested services and manage purchases (contract), and establish or defend legal claims (legitimate interests, Article 6(1)(f)). Our interest is resolving and documenting cases.
• Security: technical information, IP addresses and security logs to prevent fraud, abuse and unauthorised access (legitimate interests). We balance interests and limit processing to what is necessary.
• Optional analytics: a random session ID, normalised page and landing paths, scroll thresholds, visibility, named clicks, product choices, configurator steps, add-ons, cart, checkout starts, fixed error/exit codes and broad country/device information for visit and sales analysis after separate consent (Article 6(1)(a)). Analytics is optional even when it uses sessionStorage instead of cookies.
• Optional campaign measurement: if you separately accept marketing and analytics, approved campaign values (source, medium, campaign and content) and a simplified traffic source may be attached to the analytics session to measure which channels lead to visits and purchases (consent). This is sent to Husdjurskonst’s own API; this flow uses no third-party tags or advertising pixels. New events are not linked to your subscription or email address. Newsletters require separate signup and confirmation and can be ended using the email link or by contacting us.

We also receive payment, production and delivery status from providers. Information needed to complete a purchase is required; without it we cannot accept or deliver your order. Optional analytics and marketing are not purchase requirements. We do not sell personal data.

3. Recipients and providers

Necessary information is shared with Cloudflare (hosting, database and file storage), Stripe (payments), Gelato and appointed production/carrier partners (printing and delivery), and Resend (order/service emails and authorised marketing). They receive only what their task requires. Some providers act as independent controllers for their own statutory purposes, such as payment checks.

If you use an AI support chat, messages and order details necessary for your question may be processed by Anthropic to provide a response. Avoid sensitive information in chat. A person handles the case where needed. We may disclose data where required by law or for legal claims. Purchase alone does not authorise advertising use of uploaded photos or finished portraits.

Optional behaviour analytics and, when you have also accepted campaign measurement, campaign source data go to Husdjurskonst’s own API and database hosted by Cloudflare. This flow excludes names, email, addresses, order contents, images and personal text. No Google Analytics, Google Tag Manager, Meta or other third-party tag or advertising pixel is used in this flow. Raw IP addresses are not stored in analytics tables. Abuse prevention uses a salted IP code rotating every minute; temporary counters expire after approximately two minutes. Cloudflare’s separate infrastructure logs must be checked.

4. Transfers outside the EU/EEA

Providers' global operations and support may involve processing outside the EU/EEA. Such transfers must comply with GDPR, for example through a valid adequacy decision covering the recipient or European Commission Standard Contractual Clauses with necessary supplementary safeguards. Contact us for recipient and country details and a copy of the safeguards applying to your data.

5. Retention and deletion

We retain data no longer than its purpose and applicable duties require. Current technical cleanup uses the following default periods; cleanup runs periodically rather than at an exact minute:

• Raw photos: normally 30 days after an unpaid order closes, or 90 days after a paid order closes through dispatch/delivery, refund or cancellation. The latest closing event starts the period. Orders stuck without a closing event have a technical long-stop of 365 days from order/payment.
• Detailed analytics events: technical cleanup threshold 180 days, with bounded batches; backlog and backups can delay complete deletion. Live presence is pruned after one hour of inactivity. Support chats: normally 90 days after last activity. Login codes: 7 days. Account sessions: normally removed 30 days after expiry.
• Order/accounting records: required accounting information is retained for seven years after the end of the calendar year in which the financial year ended. Data may need to be kept for ongoing legal claims.
• Final portraits/print files and separate customer service cases: used for the order, reorders and claims. They are not covered by automatic raw-photo 30/90-day cleanup. Contact us for deletion or objection; necessary records may need to be retained by law. We must reassess the need and remove data no longer required.
• Marketing records: used for emails while your subscription is active. After unsubscribing, limited suppression and consent records may be retained to respect your choice and demonstrate compliance.

6. Your rights

You may request access, rectification, erasure, restriction and, where conditions apply, data portability. You may object to processing based on legitimate interests and always to direct marketing. Withdraw consent at any time without affecting the lawfulness of earlier processing. Rights are not absolute; accounting duties may, for example, prevent erasure.

We normally respond within one month. For complex or multiple requests, we may extend by up to two months, explaining why within the first month. Proportionate identity checks may be needed. You may complain to the Swedish Authority for Privacy Protection (IMY) or the competent supervisory authority where you live or work.

Draft – confirm before publication: Who is the legal controller? Which Cloudflare agreements, processing countries, transfer safeguards, log and backup periods apply? Are 180-day analytics retention and six-month consent memory justified? How should legacy subscriber-linked analytics and already scheduled personalised mail be retired?

7. Device storage and automation

See the Cookie policy for storage periods and controls. We do not use solely automated decisions producing legal or similarly significant effects on you. Automated order emails and AI support text do not finally determine your statutory rights.

Separate choice: device recognition and IP

“Device recognition & IP” is off by default and also requires Analytics. Following an affirmative choice, the browser creates a SHA-256 fingerprint from browser version, language, platform, screen, timezone, processor/memory category, touch support, common fonts, canvas and WebGL. Only the hash is sent to Husdjurskonst’s API hosted by Cloudflare, with a tab-session ID. The API also stores the network IP address, broad device class and country. The purpose is recognising returning browsers and diagnosing repeated use; the legal basis is consent. A signature does not reliably identify one unique person and is not linked to names, emails or customer images.

Diagnostics have a technical deletion threshold of 30 days after last activity. Cleanup runs on diagnostic requests and in bounded scheduled sweeps; outages, backlogs and backups can delay complete deletion. Withdraw the choice through Cookie settings to stop new collection; withdrawal does not automatically erase previous data. Contact us about erasure.

Dialog counters and optional Google Analytics

Dialog views, Accept, Customise and saved category choices are counted as daily totals by country and dialog type. Counters contain no visitor ID, IP, page path or link to browsing history. They monitor how the consent interface works; the technical deletion threshold is 180 days. Requests involve network traffic processed by the hosting provider. Analytics and marketing consent remain separate from newsletter signup.

If Google Analytics 4 is configured and you choose Analytics after this notice, registered visit events may also go to Google. The tag loads only after that choice; localhost preview sends nothing to Google. Google may use analytics cookies beginning with _ga, with a configured base lifetime of 180 days that may renew on use, and process browser/visit data. Advertising signals and ad personalisation are disabled. Raw IPs and device fingerprints are not forwarded as custom Google event fields; Google receives the connection IP but states GA4 does not log or store it. Recipients, GA4 account retention and transfer safeguards must be established before publication. Older analytics choices without this notice do not activate GA4. Withdrawal stops our event forwarding and removes the integration’s accessible analytics cookies.