Privacy policy

Who runs the site

markalappar.se is operated by Flowbic AB, registered in Sweden. Flowbic AB is the data controller for personal data processed via this site.

Contact for privacy questions: hello@markalappar.se.

What we collect

Configurator input: the text you type (such as the name on a sticker) and the option choices you make. We use this only to produce and ship the product you ordered.

Order data: when you check out, Shopify (our commerce platform) processes your name, shipping address, email address, and order details. Card payments are handled by Shopify's payment processors — we never see card numbers.

Cookieless usage analytics: we measure visits, page views, clicks and errors via PostHog (EU Cloud) before you make any choice in the cookie banner. In that mode nothing is stored on your device — no cookie, no localStorage — and your identity is replaced by a privacy-preserving hash computed at PostHog. Because no information is stored on or read from your device, this requires no consent. IP addresses are dropped at ingestion.

Cookie-backed usage analytics (only with consent): if you consent to analytics, PostHog instead stores an identifier on your device so we can recognise it between visits and see returning usage over time.

Session recording (only with consent): only once you consent to analytics do we record how the page is used in order to find errors. Anything you type is masked.

Marketing: with your consent, we load the TikTok pixel to measure and improve our TikTok ads. It shares a cookie/device identifier and the pages you view with TikTok. It is not loaded and sets no cookie unless you opt in.

Marketing: with your consent, we also load the Meta pixel to measure and improve our Facebook and Instagram ads. It shares a cookie/device identifier and the pages you view with Meta. It is not loaded and sets no cookie unless you opt in.

Marketing: we also use the Google Ads tag to measure conversions from our Google ads. The tag loads on the page but defaults to denied consent (Google Consent Mode) — it sets no advertising cookies and shares no identifier with Google unless you opt into marketing. Without consent the ad click id (gclid) is carried forward in the address bar between pages on markalappar.se so a purchase can still be attributed to the right ad, without anything being stored on your device. Only on consent are cookies (such as _gcl_au) set and a conversion linked to your device.

What we do not collect

We do not sell your personal data.

Apart from the TikTok pixel, the Meta pixel and the Google Ads tag described above, we embed no third-party advertising or social-media tracking, and they activate only if you opt into marketing.

Configurator text is masked in session recordings and is never sent to analytics or advertising partners.

Where data is stored

Order and customer data: Shopify, in the data residency Shopify provides for EU merchants.

Custom configuration metadata and design assets: Supabase, in the eu-west-1 (Ireland) region.

Usage analytics: PostHog EU Cloud, hosted in Frankfurt, Germany. Analytics events and session-replay payloads first transit Märka's Vercel infrastructure via the /ingest reverse proxy on markalappar.se before reaching PostHog. Märka briefly handles the payload in transit but does not store it; PostHog is the controller of record for the stored event.

Marketing analytics: if you consent to marketing, the TikTok pixel sends event data directly to TikTok (TikTok Technology Limited, Ireland), which processes it on infrastructure outside the EU. Such transfers rely on the EU Standard Contractual Clauses. TikTok is the controller for that data — see TikTok's own privacy policy.

Marketing analytics: likewise, if you consent to marketing, the Meta pixel sends event data directly to Meta (Meta Platforms Ireland Limited), which processes it on infrastructure outside the EU. Such transfers rely on the EU Standard Contractual Clauses. Meta is the controller for that data — see Meta's own privacy policy.

Marketing analytics: likewise, the Google Ads tag sends conversion data to Google (Google Ireland Limited), which may process it on infrastructure outside the EU. Such transfers rely on the EU Standard Contractual Clauses. Google is the controller for that data — see Google's own privacy policy.

How long we keep it

Orders and accounting records: retained for 7 years to comply with the Swedish Bookkeeping Act (Bokföringslagen).

Usage analytics events: retained per PostHog's default retention (currently 1 year on our PostHog plan).

Session replays: retained for 30 days, after which PostHog deletes them automatically.

TikTok pixel data: retained under TikTok's own retention policy, as TikTok is the controller for it.

Meta pixel data: retained under Meta's own retention policy, as Meta is the controller for it.

Google Ads conversion data: retained under Google's own retention policy, as Google is the controller for it.

Configurator state stored in your browser (the URL you can share): kept only as long as you keep that URL.

Your rights

Under GDPR you have the right to access the personal data we hold about you, request rectification of inaccurate data, request erasure, restrict or object to certain processing, withdraw consent at any time, and lodge a complaint with the Swedish data protection authority (Integritetsskyddsmyndigheten, IMY) at imy.se.

How to exercise your rights

Email hello@markalappar.se with the request and we will respond within one month, as required by GDPR.

To withdraw analytics or marketing consent without contacting us, click "Cookie settings" in the footer and turn off the relevant toggle.

Cookies and similar technologies

Strictly necessary: a Shopify cart session cookie (set by Shopify when you add items), a locale-preference cookie used by next-intl, a cookie named marka.consent.v2 that records your consent decisions so we don't ask again on every visit (mirrored to localStorage for browsers that block the cookie), and a localStorage entry named __ph_opt_in_out_ followed by our PostHog project key. The latter holds only the digit 0 or 1 and records whether cookie-backed analytics is on — it is not an identifier and cannot be used to recognise you.

Analytics (only with consent): PostHog stores a localStorage entry under the key ph_phc_x3eCcWVXp2P35csbyhZ7U9cWRb7WEWti5iykQFoh3phx_posthog containing an anonymous identifier so we can stitch together a single visit.

Marketing (only with consent): the TikTok pixel sets cookies (such as _ttp), the Meta pixel sets cookies (such as _fbp), and the Google Ads tag sets cookies (such as _gcl_au), used to attribute ad conversions and build advertising audiences.

The consent cookie is set on markalappar.se, so your choice also applies to our business site at foretag.markalappar.se — you are not asked the same question twice. Of the ad networks, only the Google Ads tag runs there; the Meta and TikTok pixels load only here in the consumer store.

If you decline analytics, no PostHog identifier is stored on your device and no session recording is made. We do continue to measure the visit cookielessly as described above, because that stores and reads nothing on your device. If you decline marketing, the TikTok and Meta pixels are never loaded, and the Google Ads tag sets no cookies and receives no identifier — it can then only count conversions statistically, with no link to you or your device.

Updates to this policy

We will update this policy when our processing changes. The date at the top reflects the last material update. For material changes affecting consented analytics, we will re-prompt you for consent the next time you visit.