Privacy policy

Last updated: 8 October 2026

1. Introduction

Flattered AB ("Flattered", "we", "us") is responsible for the processing of your personal data as described in this privacy policy. We are the data controller.

This policy applies to you as a customer, website visitor, newsletter subscriber or visitor to our flagship store, and to contact persons at companies we work with. It explains what personal data we collect, why we use it, who we share it with and what rights you have.

Flattered AB, Erik Dahlbergsallén 15, 115 20 Stockholm, Sweden. Organisation number 556936-9027. Contact: support@flattered.com.

2. What personal data we collect

We collect personal data when you place an order, create an account, sign up for our newsletter, contact customer service, leave a review, shop in our flagship store or visit our website.

• Contact details: Name, email address, phone number, delivery and billing address
• Order and purchase data: Products bought, order number, order history, returns, exchanges and claims
• Payment data: Payment method and transaction details. Card details are handled by our payment providers, not stored by us
• Customer service data: Messages, emails, attachments and the history of your support cases
• Account and preferences: Login details, newsletter subscription and marketing preferences
• Technical and usage data: IP address, device and browser type, pages visited, and cookie identifiers, depending on your cookie choices
• Reviews: Your rating and review if you choose to leave one

We may also receive information from third parties, for example payment providers and credit information agencies when you choose an invoice or instalment payment, or carriers about the delivery status of your order.

If you do not provide the information we need to fulfil your order, we will not be able to deliver it.

3. Why we use your data and our legal basis

We only use your personal data when we have a legal basis for it under the GDPR.

Processing and delivering orders, handling returns, exchanges, warranty claims and refunds
Legal basis: Performance of our contract with you

Answering your questions and handling customer service cases, including with AI support (see section 4)
Legal basis: Performance of contract, and our legitimate interest in providing fast and efficient customer service

Managing your customer account
Legal basis: Performance of contract

Sending newsletters and marketing emails
Legal basis: Your consent, which you can withdraw at any time

Personalising marketing emails based on your purchase history (see below)
Legal basis: Your consent to marketing emails, and our legitimate interest in sending relevant content

Inviting you to review your purchase
Legal basis: Our legitimate interest in collecting customer feedback

Website analytics and personalised advertising using cookies and similar technology
Legal basis: Your consent through our cookie banner

Preventing fraud and keeping our website and systems secure
Legal basis: Our legitimate interest in protecting our business and customers

Bookkeeping, tax and other legal requirements
Legal basis: Legal obligation

Establishing, exercising or defending legal claims
Legal basis: Our legitimate interest

Personalised marketing. If you have agreed to receive marketing emails from us, we analyse your purchase history, for example when you last shopped and your estimated customer value, to make our emails more relevant to you. For instance, we may send you a reminder or offer if you haven't shopped with us for a while. This analysis does not lead to decisions with legal or similarly significant effects for you. You can object to it at any time, or unsubscribe from our marketing emails via the link in each email.

Where we rely on legitimate interest, we have assessed that our interest does not override your rights. You can always object to such processing (see section 9).

We only use your data for the purpose it was collected for, or for a compatible purpose. If we want to use it for a new, unrelated purpose, we will inform you first.

4. Customer service and AI

We use an AI-based customer service tool to answer your questions quickly. The tool is provided by a service provider that processes your data only on our behalf and under a data processing agreement.

When you contact us, the tool reads your message and retrieves relevant order, shipping and return information from our systems. It then suggests or sends a reply. When you chat or email with us, we tell you when you are interacting with AI.

Returns and claims. Returns that are registered within our return policy are approved automatically. A return can only be declined after our warehouse staff have inspected the item and found that it is no longer in its original condition. Warranty claims and complaints are always assessed and decided by a member of our team, not by AI. If you disagree with a decision about your return or claim, contact us at support@flattered.com and a person will review your case.

You can always ask to be helped by a person instead of the AI tool.

5. Who we share your data with

We share personal data only when it is needed for the purposes in section 3. We do not sell your personal data.

Service providers acting on our behalf (processors). These providers may only process your data according to our instructions and under a data processing agreement.

• E-commerce platform: Shopify
• Customer service: Zendesk, Minimal AI (AI customer service)
• Email and newsletters: Klaviyo
• Warehouse and logistics: Ongoing
• Returns and exchanges: Yayloh
• Flagship store checkout: PayPal POS
• Sales and marketing analytics: Dema
• Accounting and reporting automation: Actigate
• AI assistants for internal work: Anthropic (Claude), OpenAI (ChatGPT)

Partners that act as independent controllers. These partners decide themselves how they use your data for their own purposes, and their own privacy policies apply.

• Payments: Klarna, Shopify Payments, Mollie, PayPal, Apple Pay
• Delivery: PostNord, DHL, Posti, Bring
• Reviews: Trustpilot
• Advertising and social media: Meta (Facebook, Instagram), Google, TikTok, Pinterest, only with your cookie consent

We may also share data with authorities when required by law, and with advisers or courts in connection with legal claims.

6. Transfers outside the EU/EEA

Some of our service providers and partners, or their subcontractors, are located or process data outside the EU/EEA, for example in the United States.

When your personal data is transferred outside the EU/EEA, we make sure one of the following safeguards applies:

• an adequacy decision by the European Commission, including the EU-U.S. Data Privacy Framework for certified US companies, or
• the European Commission's Standard Contractual Clauses, together with additional security measures where needed.

You can contact us to receive more information about the safeguards used for a specific transfer.

7. How long we keep your data

We keep personal data only as long as needed for the purpose it was collected for, or as required by law.

• Customer service cases: 24 months after the case is closed
• Order and payment records: 7 years, as required by the Swedish Bookkeeping Act
• Customer account: Until you close your account, or after 3 years of inactivity
• Newsletter subscription: Until you unsubscribe or withdraw your consent
• Cookies: As stated in our cookie banner

Data may be kept longer if needed to establish, exercise or defend a legal claim.

8. How we protect your data

We use appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, such as access controls and encrypted connections. We require the same of our service providers. If a personal data breach occurs that poses a high risk to you, we will inform you without undue delay.

9. Your rights

You have the following rights under the GDPR. To use them, contact us at support@flattered.com. We will respond within one month.

• Access: to get a copy of the personal data we hold about you.
• Rectification: to have incorrect data corrected.
• Erasure: to have your data deleted, unless we must keep it by law, for example for bookkeeping.
• Restriction: to ask us to limit the processing of your data in certain cases.
• Data portability: to receive data you have given us in a machine-readable format, or have it sent to another company.
• Objection: to object to processing based on our legitimate interest. You can always object to direct marketing.
• Withdraw consent: to withdraw your consent at any time, for example by unsubscribing from our newsletter via the link in each email or by changing your cookie settings.
• Human review: to have a decision about your return or claim reviewed by a person (see section 4).

If you believe we process your data incorrectly, you can file a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se, or with the supervisory authority in your country of residence.

10. Cookies

We use cookies and similar technology on our website. Necessary cookies are used to make the website and checkout work. Cookies for analytics and personalised advertising, including from Meta, Google, TikTok and Pinterest, are only used if you consent in our cookie banner, which is provided by Shopify. You can change or withdraw your consent at any time via the cookie settings link at the bottom of our website.

11. Links and social media

Our website contains links to other websites and social media such as Instagram, Facebook, TikTok, Pinterest and LinkedIn. When you visit or interact with them, their own privacy policies apply.

12. Changes to this policy

We may update this policy, for example when we start using new services. The latest version is always available on our website, and we will inform you of significant changes.

13. Contact

If you have questions about this policy or how we process your personal data, please contact us:

Flattered AB
Erik Dahlbergsallén 15
115 20 Stockholm, Sweden
Organisation number: 556936-9027
Email: support@flattered.com