Privacy Policy

Data we collect

• Order data: name, shipping address, email, and order contents, needed to fulfil and ship your order.
• Payment data: handled by Stripe; we never see or store your full card details.
• Communications: emails you send us and the messages we send you (order confirmations, withdrawal confirmations, shipping updates).
• Notes: what you write in the note form and, if you give one, an email address to reply to.
• Team gift: from the buyer, the company name, the buyer's name, work email and the office address with a phone number for the courier; from each colleague who picks, a first name, the piece picked and, only if they give one, an email address.

Why we process it (legal basis)

• To perform our contract with you (process, fulfil, and ship your order).
• To comply with legal obligations (accounting, consumer-law records such as withdrawal requests).
• With your consent, where we ask for it (e.g. marketing email).

Who we share it with

• The fulfilment partner, to produce and ship your order.
• Stripe, to process your payment.
• Resend, to send transactional email.
• Google, website analytics, only if you accept analytics cookies (see “Cookies, analytics and ads”).
• Reddit, to measure which ads work: only if you accept cookies (in the EU) or have not opted out (in the US).
• Meta (Facebook and Instagram), to measure which ads work: only if you accept cookies (in the EU) or have not opted out (in the US).
• LinkedIn, to measure which ads work: only if you accept cookies.

We do not sell your personal data.

The note form

An email address given in the note form is used only to reply to the note. It is sent to the site owner's inbox and kept in the shop's mail log until someone asks for it to be deleted. To have it deleted, write to privacy@binaryandthread.com.

The team gift

Colleagues who pick. We ask for your first name so the buyer can hand out the right piece, and we store the piece you picked (design, colour and size). An email address is optional: if you give one, we send you one email with a link to change your pick, and use the address for nothing else. We never ask the buyer for colleagues' email addresses. Your browser remembers your pick so you can come back and change it; that is essential storage and needs no consent.

Who sees it. The buyer sees each first name and the piece picked, on the buyer's private page and in the order confirmation. We see it to pack and send the order.

Why. For the buyer, to carry out the order. For colleagues, our and the buyer's legitimate interest in getting each gift to the right person. The optional email is used only because you chose to give it.

Which link started the team. Under the same cookie choice as “Which ad brought you” below, we save on the team the campaign tag of the link that brought the buyer, and nothing else, so we know which outreach works. With “Essential only” nothing is saved.

How long. Colleagues' first names and email addresses are deleted 30 days after the team's order is delivered, or 30 days after the pick date if the team never orders. The first names on the order itself stay with the order record, which we keep for seven years as accounting law requires.

Cookies, analytics and ads

Essential cookies. Your cart and checkout session are always active. The store cannot work without them, so they need no consent.

Visit counting without cookies. Our own server counts page visits: which page, which country and kind of device, the site you came from, and any campaign tag in the link. Nothing is stored on your device and your IP address is never saved. To count visitors rather than page views we keep a scrambled visitor code that changes every day, so we cannot recognise you from one day to the next.

Analytics and advertising. Google Analytics, the Reddit pixel, the LinkedIn Insight Tag and the Meta pixel (Facebook and Instagram) load only after you choose “Accept” in the cookie banner. Until then, and if you choose “Essential only”, no analytics or advertising storage is placed on your device. The one exception is shopping from the United States, described below. We use Google Consent Mode, which defaults to denied.

Which ad brought you. If you accept, we remember for 30 days which ad or link brought you, and save it with your order. That is how we know which ads are worth paying for.

Telling Meta about a purchase. If you accept, then after you buy we send Meta a record of the purchase from our own server, together with your browser type and the identifiers Meta's pixel stored on your device. Your email address and country are first turned into a one-way code, so Meta receives codes, not the addresses themselves. Meta can still match a code to its own records, and that is how it learns which ads lead to orders. We send nothing if you choose “Essential only”.

Shopping from the United States. There we remember which ad or link brought you, run the Meta pixel and send Meta that purchase record, unless you choose “Essential only”, use “Do not sell or share my personal information” at the bottom of the page, or your browser sends a Global Privacy Control signal.

Changing your mind. Use “Cookie settings” at the bottom of every page to see the banner again and make a new choice. Choosing “Essential only” deletes the stored ad source.

Data outside the EU

Some of the services above are based in, or store data in, the United States: our fulfilment partner, Stripe, Resend, Google, Reddit, LinkedIn and Meta. When your data leaves the EU, it is protected by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses.

How long we keep it

Order and payment records: seven years, as Swedish accounting law requires. Team gift picks: see “The team gift” above. Everything else: only as long as we need it for the purpose it was collected for, then deleted.

Your rights

Under the GDPR you can request access to, correction of, or deletion of your personal data, and object to or restrict its processing. You can also lodge a complaint with the Swedish Authority for Privacy Protection (IMY).

To exercise any of these rights, contact us at privacy@binaryandthread.com.