Privacy Policy
Last updated: 2 September 2026
Stillna keeps only what it needs: an email address when a person provides one, and what it takes to send and account for an order of cards. The website uses no cookies, no analytics and no tracking of any kind. The app collects no data at all: no account and no analytics. What is written here applies to the website and the shop. Personal data is never sold, rented or shared for anyone else's purposes. Any person may request deletion of their data at any time by asking through the contact form.
1. Data controller
Stillna AB, organisation number 559599-7148, a company registered in Sweden with its registered office in Stockholm, is the data controller for the personal data described in this policy.
All enquiries relating to this policy, and all requests to exercise the rights set out in section 7, should be sent through the contact form.
2. Personal data we collect, and for what purpose
Waiting list. When a person submits an email address through the form on stillna.app, we store that address. A confirmation message is sent to it, and the address is added to the list only after the recipient has confirmed it. The address is used only for important news about Stillna, for example an invitation to try a test version of the app before its release, or word that the cards can be bought. The same list serves the fields on the Köp kort page.
Contact form. When a person writes to us through the contact form, we receive their email address, their message, and their name if they choose to provide one. This information is used to respond to the enquiry. If the person also ticks the box for updates, the address is added to the waiting list through the same confirmation step described above.
Orders. When a person orders cards, we process their name, delivery address, email address, phone number, what was ordered and the payment. This data is used to take and send the order, for the order confirmation and delivery notices, for withdrawal, complaints and returns, and for bookkeeping. Name, address, phone number and email address are passed to PostNord, which uses them to deliver the letter and notify its arrival. We ask for the phone number because PostNord needs it to notify the delivery. Stripe also receives the email address and phone number with the payment. Stripe handles the payment; we never see or store card numbers.
Website visits. Stillna operates no web analytics, no measurement pixels and no cookies. We therefore hold no record of who visits stillna.app, how often, or from where. Our hosting provider processes technical data, including IP addresses, to the extent necessary to deliver the website and protect it against attack.
Language preference. A visitor's choice of Swedish, English or French is stored locally in their own browser so that the site can display the same language on a return visit. This information remains on the visitor's device and is never transmitted to us.
3. Legal bases for processing
Processing for the waiting list is carried out on the basis of consent, Article 6(1)(a) of the General Data Protection Regulation (GDPR). Consent is given by confirming the email address and may be withdrawn at any time.
Processing carried out in order to answer an enquiry sent to us is based on our legitimate interest, Article 6(1)(f) GDPR, in responding to correspondence initiated by the individual.
Processing an order is based on contract, Article 6(1)(b) GDPR: the data is needed to perform the sale. Bookkeeping is carried out to meet a legal obligation, Article 6(1)(c), under the Swedish Bookkeeping Act (bokföringslagen, 1999:1078).
4. Recipients and processors
We engage a small number of service providers. Those who process personal data on our behalf do so under written data processing agreements and may not use it for their own purposes. The exceptions are noted in the table below.
| Provider | Function | Location of processing |
|---|---|---|
| Resend | Delivery of confirmation, order and update emails; storage of the waiting list | United States, with email routed from the EU (Ireland) |
| Cloudflare | Website hosting and protection; storage of orders and the login to the order tool | European Union, with global infrastructure. The orders are stored in the EU |
| Stripe | Payment. Stripe receives the buyer's email address, phone number with the payment, and is an independent controller for part of the processing, such as fraud and anti-money-laundering checks | European Union and United States |
| PostNord | Carriage and notification of the letter. Independent controller for the carriage | Sweden, and the destination country's postal operator for letters abroad |
| Gandi | Operation of the Stillna mailbox | European Union (France) |
| Mail account in which correspondence to Stillna is read. Governed by Google's own consumer terms rather than by a data processing agreement | European Union and United States |
Where Stripe is an independent controller, Stripe's own privacy policy applies: stripe.com/privacy.
Personal data is not sold, rented or exchanged. It is disclosed to third parties only where we are required to do so by law.
5. International transfers
The waiting list is stored by Resend in the United States, and correspondence sent to us may be processed in the United States by Google. These transfers take place under the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which both providers are certified, and in Resend's case additionally under Standard Contractual Clauses. Stripe may process payment data in the United States on the same basis; Stripe is certified under the same framework. The orders are stored with Cloudflare in the EU. Outgoing email from stillna.app is routed through servers within the European Union (Ireland). All other processing described in this policy takes place within the European Union.
6. Retention
| Data | Retention period |
|---|---|
| Confirmed addresses on the waiting list | Until the person unsubscribes or requests deletion |
| Unconfirmed addresses | Deleted after six months |
| Messages received through the contact form | 24 months from our final reply |
| Orders and payments (accounting records) | Seven years after the end of the calendar year in which the financial year closed, under the Bookkeeping Act |
| Phone number and other delivery data | Part of the order and kept with it. Nothing is deleted earlier |
7. Rights of the data subject
Every individual whose personal data we process has the right to request access to that data, its rectification, its erasure, restriction of its processing, and its transfer to another controller in a machine-readable format, and to object to the processing. Where processing is based on consent, that consent may be withdrawn at any time, most simply through the unsubscribe link included in every message we send.
Requests should be sent through the contact form. We respond within one month, as provided in Article 12 GDPR. No fee is charged.
8. Complaints
An individual who considers that we process their personal data unlawfully has the right to lodge a complaint with the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), imy.se, +46 8 657 61 00.
9. Security
Access to personal data is limited to those who need it in order to operate Stillna. Credentials are stored separately from the systems that use them, all transmission takes place over encrypted connections, and the domain is protected by SPF, DKIM and DMARC. Orders can be reached only through a login protected by Cloudflare Access.
10. Automated decision-making
We carry out no automated decision-making and no profiling within the meaning of Article 22 GDPR.
11. Children
The website is directed at adults. We do not knowingly collect personal data from children. A parent or guardian who believes that a child has provided us with personal data may contact us through the contact form, and the data will be deleted.
12. Changes to this policy
Any change to this policy is reflected in the date at the top of this page. Where a change is material, we inform those on the waiting list before it takes effect.