Skip to content
Masaya Studios

Masaya Studios

Privacy policy

How Masaya Studios collects, uses and stores personal data under GDPR — what we take at checkout, who we share it with, and the rights you have.

Last updated: 13 October 2026

Masayastudios (“we”, “us”) is the data controller for masayastudios.se. This policy explains what we collect when you visit the site, place an order, or join the mailing list.

What we collect

  • Orders: name, email, phone, shipping address, what you bought, and payment status. Card and Swish details are handled by Stripe — we never see full card numbers.
  • Mailing list: your email, if you subscribe.
  • Technical: IP address, browser, and basic usage data from our host (Cloudflare) needed to run and protect the site.
  • Site totals: we count successful requests for our public HTML pages on the server. Counters contain the day, public page path and a broad referring source, such as Pinterest, Instagram or Google. Other referring websites are grouped together. We do not store individual page-request records, IP addresses, full referring URLs, browser fingerprints, visitor or session identifiers, UTM values or advertising click identifiers in these counters. No analytics script, statistics cookie or analytics browser storage is used.
  • Shop totals: created checkouts and confirmed paid shop transactions are counted separately. Hashed checkout identifiers prevent duplicate transaction counts; they are not linked to page requests, referring sources or browsing history.

We do not run advertising pixels and we do not sell personal data.

Why we use it

  • To take payment, pack, and ship your order (contract).
  • To send order confirmation and shipping updates (contract).
  • To send emails you asked for (consent — unsubscribe any time).
  • To keep records required by Swedish bookkeeping and consumer law (legal obligation).
  • To prevent fraud and keep the site up (legitimate interest).
  • To understand use of our public pages and the shop’s overall activity (legitimate interest). We minimise the already received request information immediately into daily counters and do not build individual browsing profiles. This data stays with Masaya and our hosting processor; it is not sent to advertising platforms.

Browser storage and traffic counting

The shop uses necessary browser storage for your cart and shipping country, and a necessary cookie when an administrator logs in. Traffic counting does not set or read a statistics cookie and does not create an analytics identifier on your device. We respect Do Not Track and Global Privacy Control headers when counting public page requests.

This report counts page requests, not unique visitors. Reloads can count again, a browser cache can prevent a new request, and a hidden referring source is reported as direct / unknown. Shop payments are separate totals and cannot be attributed to a visitor, pin or advertisement by this method.

The former consent-based browser measurement was retired on 13 October 2026. The current shop no longer loads the browser measurement client. Former identifiers cannot create new browser-measurement records. Any former consented records remain subject to their original 90-day expiry and your data rights. Order and required bookkeeping records are separate.

Who we share it with

Only processors that run the shop:

  • Stripe — payments (card, Klarna, Swish, Apple Pay, Google Pay).
  • Cloudflare — hosting, CDN, order/stock storage and daily traffic and shop-total storage.
  • Resend — transactional and list emails, when configured.
  • PostNord — delivery, once an order ships.

They may process data in the EU/EEA or in countries with an adequacy decision or Standard Contractual Clauses.

How long we keep it

Orders and invoices: as long as Swedish bookkeeping law requires (currently 7 years). Mailing-list addresses: until you unsubscribe. Server logs: a short period for security.

Daily page counters and shop-count records are available for 90 days. Expired records are deleted during daily cleanup when the counter or its report is next used. The shop report’s paid total includes tax and shipping; refunds are not yet reflected there. No historical browsing data is reconstructed.

Your rights

You can ask to access, correct, delete, or export your data, or object to certain processing. Email info@masayastudios.se. You can also complain to Integritetsskyddsmyndigheten (IMY).

Contact

Masaya Studios, Swedenborgsgatan 5A, 118 48 Stockholm, Sweden
info@masayastudios.se · +46 72 316 69 75