Privacy policy

1. Who is responsible

Sunread Sweden AB, org. no. [FILL], [FILL: address], Sweden, is the controller for the personal data described here. Sunread Sweden AB runs Fabriken, and invoices say "Fabriken LABS c/o Sunread Sweden AB". Questions about your data: order@fabrikenlabs.se.

This policy covers fabrikenlabs.se, the shop, the app and our API.

2. What we keep and why

• Account and sign-in: your email address and the name you give us. You sign in with an email link, with BankID through tic.io (The Intelligence Company AB, Sweden), or with Google, Microsoft or Apple. From BankID we receive [FILL: what tic.io passes on, for example your name and personal identity number]. We need this to give you an account and keep your orders together (our contract with you).
• Uploaded files: the 3D models you upload, and what we work out from them: the check, the grams, the print time and the price. We use them only to price and print your order (our contract with you).
• Orders: what you ordered, the prices, discount codes and the order's status, to deliver the order and for our bookkeeping (our contract with you, and the Bookkeeping Act).
• Addresses: the name, delivery address, email and phone number you give in the checkout, to deliver your order (our contract with you).
• Payments: you pay in Kustom Checkout. Kustom handles the payment details under its own privacy notice. We receive the payment's status, never your card number.
• Shipping: we book the delivery through Fraktjakt, which passes your name, address and contact details to the carrier you choose.
• Email: order confirmations, sign-in links, shipping notices and chat answers you have not seen are sent through Resend (Resend, Inc.), from its EU region in Ireland. Each email carries your email address and what the email is about, for example your name and the order's details.
• Messages: what you write in the contact form, so that we can answer you (our legitimate interest in answering).
• Support chat: what you write to us in the chat on the website, in the shop or in the app, your email address if you are not signed in, and, while the chat is open, the page you are on and the part, quote, cart or order it shows. We use it to answer you faster (our legitimate interest in answering, and our contract with you when it is about an order). Only Fabriken's staff read it, it is stored in our own database in the EU, and no outside chat service is used. If you have left the page when we answer, the answer is emailed to you.
• Analytics, only with your consent: PostHog counts visits and records how the public site and the shop are used, with session replay. Everything you type is hidden, and your files are never included. In the app, at sign-in and on order pages, only page views are counted, never what you click or type. You can take your consent back at any time under Cookie settings.
• Technical logs: our servers log requests, including IP addresses, to keep the service running and secure (our legitimate interest).

3. Who receives your data

We never sell personal data. These companies handle it for us, each only for its own task:

• Kustom, for payments.
• Fraktjakt and the carrier you choose, for delivery.
• Resend, for email.
• tic.io for BankID, and Google, Microsoft or Apple if you sign in with them.
• PostHog, for analytics, only with your consent.
• Our hosting provider in the EU, UpCloud (UpCloud Ltd, Finland; our server is in Stockholm), and our bookkeeping system [FILL: confirm which].

4. Where your data is kept

• Our servers, our database and your files are in the EU. Your files never leave the EU.
• PostHog is a US company. We use its EU cloud, with the data stored in Frankfurt, Germany.
• Resend is a US company. Our emails are sent from its EU region in Ireland, but Resend stores its records of the emails, such as logs and email metadata, in the United States. [FILL: the safeguard for the transfer, for example the EU-US Data Privacy Framework or the standard contractual clauses in Resend's data processing agreement]
• If you sign in with Google, Microsoft or Apple, they handle that sign-in under their own terms, which may involve countries outside the EU.

5. How long we keep it

• Bookkeeping records, such as orders, receipts and invoices: 7 years, as Swedish bookkeeping law requires.
• Uploaded files: [FILL].
• Your account: until you ask us to delete it. For now you do that by email to order@fabrikenlabs.se.
• Messages from the contact form: [FILL].
• Support chats: 12 months after the chat is closed. [FILL: confirm once the automatic deletion is built]
• Analytics: [FILL: how long PostHog keeps it]. Your answer to the cookie question: 12 months.
• Technical logs: [FILL].

6. Your rights

Under the GDPR you may:

• get a copy of the personal data we hold about you;
• have wrong data corrected;
• have data deleted when we no longer need it or may not keep it;
• ask us to limit how we use it, or object to it;
• get the data you gave us in a machine-readable form;
• take back a consent at any time, without affecting what was done before.

7. Questions and complaints

Write to order@fabrikenlabs.se. We answer within one month.

You can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se.

8. Cookies and your browser

• Sign-in: cookies that keep you signed in to the app. The service needs them.
• Language: the cookie fabriken_locale remembers the language you chose in the switcher, for one year.
• Theme and cart: your choice of light, dark or automatic appearance, and the shop's cart, are kept in your browser's local storage. The cart reaches us only when you go to the checkout, or while you have an open support chat with us.
• Support chat: if you write to us in the chat without signing in, the cookie fabriken_chat keeps your chat for 180 days, so you can read our answer. The cookie fabriken_chat_open tells the page that you have a chat. The chat needs them.
• Your answer to the cookie question: the cookie fabriken_consent, for 12 months.
• Analytics: PostHog's cookies, only after you say yes. Declining is as easy as accepting, and you change your answer under Cookie settings at the bottom of every page.

9. Changes

We may change this policy. The date at the top says which version you are reading.