Only what it takes to send you a lamp.
Who's responsible
Vitgranen AB (org. no. 559421-9791), Vitgransgatan 9, 247 33 Södra Sandby, Sweden, is the data controller for the personal data described here. Questions about your data go to order@porous.systems.
What we collect, and why
- When you order: your name, email address, delivery address, phone number if you give one, what you bought and how much you paid. We need these to deliver your lamp and handle returns and complaints (to fulfil our contract with you), and to keep our accounts (a legal obligation).
- When you pay: card and payment details go straight to our payment provider, Stripe. We never see your full card number.
- When you contact us or withdraw from a purchase: what you write to us, so we can answer and handle it.
- When you visit the site: our host keeps short-lived technical logs, such as your IP address and browser, to run the site and keep it secure (our legitimate interest). The site sets no tracking or advertising cookies.
Who else handles it
We use a few providers, each bound by a data processing agreement:
- Stripe, for payments and checkout. Stripe is also independently responsible for the data it needs for fraud prevention and its own legal obligations; its privacy policy is at stripe.com/privacy. If you pay with Klarna, Klarna's privacy notice applies too.
- Vercel, which hosts this site.
- Resend, which sends our order and withdrawal emails.
- Google, for our email inbox and for the fonts on this site, which your browser loads from Google's servers.
- The carrier delivering your parcel, who gets your name, address and contact details.
Some of these companies are based in the United States. Where data leaves the EU/EEA, it's protected by the EU–US Data Privacy Framework or the EU's standard contractual clauses.
How long we keep it
Order and payment records are kept for seven years, as Swedish bookkeeping law requires. Emails about an order are kept for as long as you could still make a complaint, which is three years after delivery, and then deleted. We never sell your data or use it for marketing without asking you first.
Your rights
You can ask for a copy of the data we hold about you, and ask us to correct it, delete it, restrict how we use it, or hand it over in a portable format. You can also object to how we use it. Some data we have to keep by law, such as accounting records. Email order@porous.systems and we'll reply within a month. If you think we're handling your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se.