Privacy policy

Who is responsible

The controller for By Hand, By Heart is Sward Solutions AB, Spannvagen 4, 168 35 Bromma, Stockholm, support@linesofyou.com.

What we collect and why

• Your journal details: the name for the cover, the cover colour and, if you add one, the dedication (who it is for, who it is from and a short message). We use them to print your journal. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• Shipping name and address, collected on the Stripe checkout page: to print and ship your journal. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Free sample: if you ask for the free week, we use your email address to send it (at your request, Art. 6(1)(b) GDPR) and keep nothing else. Only if you also tick the unticked box “Also email me now and then about the journal”, your email address is kept as a contact at Resend so we can send occasional emails about the journal, each with an unsubscribe link (your consent, Art. 6(1)(a) GDPR). You can unsubscribe or ask us to delete it at any time.
• Email address: to confirm your order, tell you when it ships and answer support requests. Legal basis: performance of the contract.
• Payment: you pay on Stripe's checkout page. We never see your card or bank details. Stripe tells us the payment status, amount and your email.
• Technical data: your IP address and browser details are processed by our hosting provider to serve the site and keep it secure, and we use your IP address for short-term rate limiting. Legal basis: legitimate interests in a secure service (Art. 6(1)(f) GDPR).
• Anonymous usage statistics: which pages and quiz steps are viewed, whether checkout is started or completed, and the ad campaign parameters in the link you arrived through. This uses no cookies or browser storage and contains no personal details. IP addresses are dropped, and visits are only told apart for one day by a hash computed on the analytics provider's server. Legal basis: legitimate interests in understanding and improving the site (Art. 6(1)(f) GDPR).
• Ad measurement, see “Meta Pixel and Conversions API” below. In the EU, the EEA, the UK, Switzerland and Quebec it runs only if you click Accept. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time. Elsewhere it is on by default and you can turn it off at any time.

Service providers (processors)

We share data only with these providers, and only what each needs:

• Stripe (Stripe Payments Europe Ltd., Ireland, and Stripe, Inc., USA): payment processing and the checkout page. Receives your email, payment details, shipping name and address and, attached to your order, your journal details (needed to print it after payment).
• [Printer, e.g. Lulu Press, Inc. (USA)]: prints and ships your journal. Receives the print files (with the name and dedication you chose) and your shipping name and address. It does not receive your email or payment details.
• Resend (Plus Five Five, Inc., USA): sends your order confirmation and shipping emails. Receives your email address and your order details.
• Vercel Inc. (USA): hosts this website, processes server logs and provides cookieless visitor statistics.
• PostHog Inc. (USA), data stored in the EU (Frankfurt): cookieless usage statistics as described above.
• Meta Platforms Ireland Ltd. (Ireland) and Meta Platforms, Inc. (USA): for ad measurement, see below.
• These providers process data on our behalf under their data processing terms. Where data goes to the USA, the transfer relies on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses included in those terms.

Meta Pixel and Conversions API

In the EU, the EEA, the UK, Switzerland and Quebec, nothing from Meta loads unless you click Accept in the cookie banner. Everywhere else ad measurement is on by default, unless your browser sends a Global Privacy Control signal, which we treat as turning it off. When it is on, the Meta Pixel sets cookies (_fbp, _fbc) and tells Meta about page views, quiz progress, entering your email, starting checkout and purchases, so we can see which ads work. When you enter your email, our server also sends that step to Meta's Conversions API with your email address and country as SHA-256 hashes, plus your IP address, browser user agent and the cookie ids. When you buy, it sends the purchase the same way, with your first name (hashed) and the order value added. Meta and we are joint controllers for the collection and transmission under Meta's Controller Addendum (facebook.com/legal/controller_addendum).

You can change your choice at any time with the cookie settings link below. If you reject or turn it off, we send nothing to Meta, and the site works the same.

Storage in your browser

We store your cookie choice in your browser (localStorage and a first-party cookie named “consent”, 180 days), because we must remember it. While ad measurement is on, ad campaign parameters from the link you arrived through (utm_… and fbclid) are kept in session storage until you close the tab and attached to your order. While it is off, they are kept only in page memory for the current visit and attached to your order, so we know which campaign led to a sale. They do not identify you.

How long we keep data

We do not run our own customer database. Your order details, email and shipping address are stored with your order in Stripe, and kept for 7 years as Swedish bookkeeping law (bokföringslagen) requires. We keep the print files only until your journal has shipped. The printer keeps order records under its own terms. Resend keeps delivery logs for a limited period under its own terms. Meta keeps data according to its own policies.

Your rights

You have the right to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interests and to withdraw consent at any time. Write to support@linesofyou.com. You can also complain to a data protection authority, such as Integritetsskyddsmyndigheten (IMY), imy.se, or the one in your country of residence.

We do not make automated decisions with legal or similarly significant effects.

This service is not intended for children under 16.