Draft — still being reviewed.

Privacy

Your name and your address are yours. Here you can read which data we keep about you, why, for how long, and what you can do about it.

Who is responsible for your data?

België

We are responsible for the personal data on this website. Do you have a question? Send us a message through the contact page.

Which data we use, and why

• Account: your email address, your language choice and the addresses you save. This lets you log in and find your orders. You log in with your email address or with your Google account. If you choose Google, we receive your email address from Google, and Google knows that you log in with us. An account is not required: you can also order as a guest. Legal basis: the contract with you.
• Orders: your design, your name, your email address, the address the pillow goes to (with a gift, sometimes someone else's address), possibly a different billing address and a gift message, and whether you have paid. This lets us make, send and invoice your pillow. Legal basis: the contract with you, and for invoices our legal duty to keep accounts.
• Checkout: to prevent misuse, such as guessing discount codes or starting a payment over and over, we keep a scrambled form of your IP address for up to 24 hours. Legal basis: our legitimate interest in preventing misuse.
• Logging in: to prevent misuse, such as sending login codes to someone else's address, we keep a scrambled form of your IP address for up to 24 hours. Legal basis: our legitimate interest in preventing misuse.
• Contact messages: your name, your email address, possibly an order number and your message, so that we can answer you. To prevent misuse of the form, we also keep a scrambled form of your IP address for up to 24 hours. Legal basis: our legitimate interest in answering questions and preventing misuse.
• Technical data: our hosting provider processes your IP address briefly in log files, so that the website works and stays safe. Legal basis: our legitimate interest in keeping the website safe and working.

Who we share data with

We don't sell your data. For a few things we get help. These parties only receive the data they need:

• Supabase (in the EU): our database and logging in, and keeping your designs, your own fonts and your invoices, in storage only we can open.
• Stripe: payments. Your card and bank details go straight to Stripe and never reach us.
• Our email provider: sends our emails to you, such as your order confirmation.
• Our hosting provider: keeps the website online.
• The carrier: receives the name and address the parcel is going to.

Does one of these parties also work outside the EU? Then we make sure your data stays protected under the European rules.

How long we keep your data

• Your account and your saved addresses: until you have them deleted.
• Orders and invoices: as long as the law requires. For our accounts and VAT that is at least seven years.
• Orders that were never paid (expired, or replaced by a changed order): 30 days after they were closed. We delete the pictures and fonts that came with them after only 48 hours. An order that a payment came in for stays until we have settled it.
• Contact messages: until a year after the last message.
• Log files: a short time.
• The scrambled form of your IP address from logging in, the contact form and the checkout: up to 24 hours.

After that we delete your data, or we make it anonymous.

Our database makes a backup every day that is kept for seven days: what we delete may still be in it for up to seven days.

What are your rights?

You can ask which data we have about you, and have it corrected or deleted. You can also ask us to restrict the processing, take your data to another party, or object to the processing. Send us a message through the contact page to do so. We answer within a month.

Are you not happy with how we handle your data? Then you can file a complaint with the Data Protection Authority (Gegevensbeschermingsautoriteit), the Belgian supervisor for data protection: dataprotectionauthority.be.

Cookies

We only use strictly necessary cookies: cookies the website needs to work.

Our own cookies

• Logging in: as soon as you start logging in, we set cookies that make the login secure. After you have logged in, they keep you logged in until you log out.
• Your language choice (NEXT_LOCALE): set as soon as you choose a language with the language switch or open an English page, and kept for one year. This lets us open the website in the same language next time.

Stripe's cookies, when you pay

Stripe only loads the payment form once you reach the Pay step. Stripe then sets two cookies to prevent fraud, such as payments with a stolen card:

• __stripe_mid: kept for one year.
• __stripe_sid: kept for 30 minutes.

These cookies are strictly necessary too: without them we cannot offer a safe payment.

We use no analytics or tracking cookies. That is why you don't see a cookie banner here.

What your browser keeps

We keep your cart, and how far you got with checking out, in your own browser, not with us. You can clear this yourself by deleting this website's data in your browser.

Your cart

Your cart stays in your browser until you check out: your designs in IndexedDB, and the number of pillows, your discount code and the country you ship to in localStorage. We don't keep your cart. When you change a design, this tab remembers that for a moment (in sessionStorage), so that your cart can tell you. The design studio remembers in localStorage which language it shows its buttons in.

Checking out

While you check out, this tab remembers what you fill in and how far you got (in sessionStorage, softy-checkout), so you lose nothing if you reload the page. When you go to pay, it also remembers which designs are in your order (softy-checkout-lines), so that we can take them out of your cart after you have paid. What is in sessionStorage is gone when you close the tab.