Privacy policy
Who is responsible
Merla Jewelry, Stockholm, Sweden. Questions: [email protected]
What we collect
When you order we collect your name, email, phone number and delivery address. We need this to ship the item and to meet Swedish bookkeeping law. The legal bases are performance of a contract and legal obligation.
Newsletter
If you sign up for the newsletter we store your email address only, along with the date you signed up and where on the site you did it. The legal basis is consent. We first send a confirmation email; the address goes on the list only when you click the link in it, and we also store the time of that click. We keep the address until you unsubscribe, and you unsubscribe in the same place you signed up — My account — or by emailing us. We never send anything but notices about new pieces, and we never share the list.
Ticking the box at checkout puts your address on the same list. If you leave it unticked we use your address for your order only.
Signing in
When you sign in we email you a one-time link. It is valid for 15 minutes and can only be used once. Once you click it we set one cookie that keeps you signed in for 30 days. It holds nothing but a random number — no email address, no name — and the page's own scripts cannot read it. Signing out deletes it immediately, both in your browser and on our side. The legal basis is performance of a contract: without it we cannot show you your orders.
Visitor statistics
We use Cloudflare Web Analytics to see how many people visit and which pages they look at. It sets no cookies, stores nothing in your browser and builds no profile of you — it counts page views, nothing else. We cannot see who you are, and the statistics cannot be tied back to an individual visitor. No ad networks, no Google Analytics, no retargeting.
Cookies and browser storage
The only cookie on the site is the sign-in cookie above, and it is set only when you sign in yourself. Because it is necessary for a function you asked for, no consent is required, which is why there is no cookie banner. No cookies from other companies, no advertising cookies.
Your bag and your saved pieces live in your browser's own storage (localStorage) on your own device — they are never sent to us and we cannot read them. Your bag leaves your device only when you go to checkout.
Who else sees your data
Four companies process data on our behalf. We never sell your data to anyone.
- Stripe — handles the payment and receives what it needs for it.
- PostNord — receives your name and address to deliver, and your email or phone number if you are to be notified.
- Cloudflare — runs the website, stores the order and forwards email to us. The data centres are in Europe.
- Resend — sends sign-in links and dispatch notices.
How long
Order records are kept for 7 years under Swedish bookkeeping law, then deleted.
Your rights
You can ask what data we hold about you, and have it corrected or deleted. Email [email protected]. If you are unhappy you can complain to the Swedish Authority for Privacy Protection (IMY).