Privacy Policy

Last updated: 2026-11-03 · Guldstrand Utveckling AB · Org. no. 559225-3909

This policy explains how Guldstrand Utveckling AB (org. no. 559225-3909) handles personal data in SealedReviews. It also contains our Data Processing Agreement with shops.

1. Who is responsible

For shop accounts (the people who sign in) we are the controller. For the shop's customers (order emails and review requests) the shop is the controller and we are its processor. Contact: hello@sealedreviews.com.

2. Shop accounts

We process the email address, company and shop name, domain, billing details (handled by Stripe) and usage logs, to provide the service, bill it and keep it secure. Legal basis: contract and legitimate interest (security). Kept while the account is active and up to 12 months after, billing records for 7 years (Swedish accounting law).

3. Shop customers (order emails)

From each BCC copy we keep the customer's email address, first name, order number and purchased products, to send one review request and at most one reminder. The full email is deleted immediately after processing (at the latest after 1 day). The customer's email address is deleted after the reminder, or earlier if they review or unsubscribe; a one-way hash is kept so unsubscribed addresses are never emailed again by that shop. Logs of received order emails contain no email addresses and are kept for 13 months.

4. Reviewers

A published review shows the rating, text, date and the name the reviewer chose, shown as first name and initial. The reviewer can ask us to delete their review at any time.

5. Website visitors

The public pages and the widget set no cookies and do not track visitors. Signed-in shop users get a necessary session cookie (30 days) and a non-secret marker cookie that shows 'My account' on the site.

6. Sub-processors

Amazon Web Services EMEA SARL (hosting, email and storage in AWS region Stockholm, Sweden) and Stripe Payments Europe Ltd (payments, only for shop accounts). Data is stored in the EU.

7. Security

Encryption in transit and at rest, signed sessions, rate limits, monitoring with alerts, access limited to what each part of the system needs.

8. Your rights

You have the right to access, rectify and erase your data, to restrict or object to processing and to data portability. Contact us at the address above. Shop customers should contact the shop, which is the controller; we help the shop answer. You can complain to the Swedish Authority for Privacy Protection (IMY), imy.se.

9. Data Processing Agreement (shops)

When the shop sends order emails to SealedReviews, we process its customers' personal data on the shop's behalf and only to send review requests and publish reviews, as instructed through the service. We keep the data confidential, use the security measures above, use only the sub-processors listed above (with 30 days' notice of changes, during which the shop may object by cancelling), help the shop with data subject requests and breaches without undue delay, delete the data as described above and when the account is closed, and give the shop the information needed to show compliance. Transfers outside the EU/EEA do not take place.

10. Changes

We may update this policy; material changes are announced on this page and by email to shop accounts.