Privacy policy

This is a translation. The Danish version applies.

In short

• Who. FamilyPrint is responsible for your data. Write to hello@familyprint.app.
• What and why. We use your email, phone number, name and address, and the photos and texts you put in your book or calendar, to make it, take the payment, and print and deliver it. Not for advertising. We never sell your data.
• When. Your photos, texts and contact details leave your phone when you tap Fortsæt til betaling (Continue to payment), before you pay. Only the photos in the book are sent. Before that, the app removes the hidden information in the photos, for example where and when they were taken. Before then, the app only sends technical information to us, for example for the app’s security key. What you type in the address field goes to Apple Maps, so you get address suggestions.
• Who sees your photos. They are stored on our server at Microsoft in Sweden. Only Gelato and the printer that prints the book get them. We only look at them ourselves if it is necessary to solve a problem with your order.
• Who gets your other data. GLS (delivers the parcel), Stripe (the payment), Postmark (our emails), Apple (address suggestions, notifications and the app’s security) and our mailbox and website. None of them gets the photos in your book. Our mailbox only gets what you send us yourself. See all recipients in section 9.
• How long. We delete your photos 30 days after your order is closed. Name, address and phone number 90 days after the order is closed, and your email 27 months after. We keep bookkeeping data for 5 years, as the law requires.
• The app only sends error reports if you say yes.
• Your rights. You can get a copy of your data and have it corrected or deleted. You can also object to what we do on the basis of a legitimate interest. Write to hello@familyprint.app, or read how under Your data. You can complain to the Danish Data Protection Agency (Datatilsynet).

The rest of the page explains it all in detail. Where we write “book”, we also mean a calendar.

1. Who is responsible

FamilyPrint is the data controller for the data described here.

• Address: Koglevej 1, 2680 Solrød Strand, Danmark
• CVR: 46861280
• Email: hello@familyprint.app
• Phone: [TELEFON]

We don’t have a data protection officer (DPO), and the law doesn’t require one of us. Write to the email above and we will answer ourselves.

2. When your data leaves your phone

Until you tap Fortsæt til betaling on the overview of your order, the app does not send your designs, photos, texts or contact details to us. They stay on your phone. The app does talk to our server when it fetches prices and products, and when it creates its security key (section 3.8). Our server then sees your IP address. If you type an address, the app gets suggestions from Apple Maps (section 7).

When you tap Fortsæt til betaling, the app sends us two things so we can prepare the order:

• the photos in the book, in full quality;
• your email, phone number, name, address and the book’s title and texts, and on a calendar the special days and texts you wrote on the days.

This happens before you pay. If you don’t pay, we cancel the order after 14 days and delete it later (section 11).

The hidden information is removed. Before the app sends a photo, it removes the hidden information in the file (metadata): time, camera, location (GPS), captions, people, place names and the small thumbnail. If the photo is already the right way up and is a JPEG, the app copies it without changing the image. Other photos, for example HEIC, are saved by the app as a new high-quality copy that keeps only the image’s orientation. Either way, the hidden information is gone.

3. What we use your data for

3.1 Your order

• Data: your email, phone number, first and last name, address (street, any floor, door or c/o, postcode, town and country), what you ordered, the price, the order’s status, and which app and version you ordered from (for example iPhone, version 1.0), so we can help if something goes wrong.
• Purpose: to make, print and deliver the book, keep you informed about the order and show its status in the app. The app uses your email and the order’s reference together when it fetches the status from us.
• Legal basis: the contract with you, and before you have paid, the steps you asked for so you can order (GDPR art. 6(1)(b)).
• Must you provide it? Yes. Without email, phone number, name and address we cannot deliver the book. The carrier uses the phone number and email to tell you when the parcel is ready.
• If you send the book to someone else, we get the recipient’s name, address and the phone number you enter from you. We only use them to deliver the parcel. The legal basis is your and our legitimate interest in delivering the gift you ordered (art. 6(1)(f)). We overwrite them 90 days after the order is closed. At the back of every book and calendar there is a short note to the person who receives it about how we used their name and address. The recipient has the same rights as in section 12.
• How long: see section 11.

3.2 Your book or calendar: photos and texts

• Data: the photos in the book, the book’s or calendar’s title, subtitle, texts, layout and colours, the special days and texts you wrote on a calendar (for example birthdays), and the print file (a PDF with your photos and texts).
• Purpose: to make the print file, print the book and be able to print it again if there is a fault.
• Legal basis: the contract with you, and before you have paid, the steps you asked for so you can order (art. 6(1)(b)). On the people in your photos or mentioned in your texts, see section 4.
• How: The photos are stored on our server at Microsoft in Sweden. We automatically measure whether each photo has a high enough resolution to print, and the photos are scanned for viruses (section 3.8). We don’t look through your photos ourselves. We only look at them if it is necessary to solve a problem with your order, for example a fault in the print file or a complaint. If a photo appears to be illegal, we don’t print it and may report it to the police. The legal basis for a report is our legitimate interest in not taking part in criminal offences (art. 6(1)(f), and section 8(3) of the Danish Data Protection Act). Gelato fetches the print file and prints the book.
• How long: photos 30 days after your order is closed. The print file, the texts and the calendar’s special days 90 days after the order is closed. See section 11.

3.3 Payment

• Data: the payment’s id, amount and status, any refunds and an error message if the payment didn’t go through. Your card details go directly from the app to Stripe. We never see them.
• Purpose: to take the payment and send money back.
• Legal basis: the contract with you (art. 6(1)(b)) and our duty to keep accounts (art. 6(1)(c)).
• Stripe gets the amount and the order’s internal reference from us. When you pay, the app’s payment module sends your card details and technical information about the phone and the connection (for example IP address and phone model) directly to Stripe, so Stripe can complete the payment and detect fraud. This is a precondition for you to pay safely by card, and so it happens without separate consent (section 4 of the Danish cookie order, cookiebekendtgørelsen). Stripe is itself responsible for its fraud checks and for the checks the law requires, for example under anti-money-laundering rules. Read more in Stripe’s privacy policy. [HVIS STRIPE LINK ER SLÅET TIL: If you choose to pay with Stripe Link, Stripe keeps your email and phone number under Stripe’s own terms.]

3.4 Bookkeeping

• Data: order number, dates, products, quantities, prices, discount, VAT, payment and refund ids and the printer’s order number. [VÆLG ÉN: The receipt for the accounts does not contain your name or email. / The receipt for the accounts contains your name, because it is a copy of the receipt you received.]
• Purpose: to keep accounts, as the Danish Bookkeeping Act (bogføringsloven) requires.
• Legal basis: legal obligation (art. 6(1)(c), and bogføringsloven § 12).
• How long: 5 years from the end of the financial year the purchase belongs to. [Vores regnskabsår følger kalenderåret.]
• Your order confirmation by email is your receipt. Our auditor or bookkeeper may receive the bookkeeping data (section 9).

3.5 Emails about your order

• Data: your email, your name, the address, the book’s title, prices and the order’s status.
• Purpose: to send you the order confirmation and receipt, and to tell you when the book has been sent, is late, has been cancelled, or when you have been refunded.
• Legal basis: the contract with you (art. 6(1)(b)) and our duty to confirm the contract by email or another durable medium (art. 6(1)(c), and forbrugeraftaleloven § 13).
• Postmark sends emails for us. We ourselves only keep which email we sent and when, with the order.
• Our emails contain no tracking pixel and no click tracking. Postmark only records whether the email was delivered.
• If your mailbox rejects an email from us, or you mark it as spam, Postmark puts your email on a block list so we don’t send to it again. It stays there until we remove it. We do that when you ask for erasure (section 12).
• We don’t send newsletters or advertising. If we start, we will ask you first.

3.6 When you write to us

• Data: your email, what you write and what you attach, for example pictures of a fault.
• Purpose: to answer you, handle a complaint or a rights request, and be able to document what we agreed.
• Legal basis: the contract with you (art. 6(1)(b)) and our legitimate interest in answering enquiries and being able to document and defend a claim (art. 6(1)(f)).
• How long: [2 ÅR] after the case is closed.
• Safety complaints. If you write about a product that may be dangerous, we keep your message in our register of safety complaints for up to 5 years. The EU General Product Safety Regulation (art. 9) requires this, so the legal basis is a legal obligation (art. 6(1)(c)).

3.7 Error reports from the app (only if you say yes)

• When: The app asks you once, shortly after your first order. Until you say yes, the app sends nothing, and no id exists.
• Data: a random id for the app, created when you say yes; the app’s version, iOS version and phone model (as a code, for example “iPhone15,3”, never your phone’s name); the error message, from which the app tries to remove personal data; the time; the order’s reference when an error concerns an order; and reports from Apple’s MetricKit about when the app crashes or hangs. Never photos, name or address.
• Purpose: to find and fix errors in the app.
• Legal basis: your consent (art. 6(1)(a), and cookiebekendtgørelsen § 3).
• With whom: Microsoft (Application Insights) in Sweden.
• How long: 30 days. Reports that haven’t been sent are deleted by the app after 7 days.
• Change your mind: Turn off Send fejlrapporter (Send error reports) under Konto → Privatliv (Account → Privacy). The app then deletes the reports not yet sent and the app’s id. Reports we have already received are deleted after the 30 days. If you want them deleted sooner, write to us with your order number.

3.8 Security and operations

• Server logs: which function in our system was used, when, the response, the order’s reference and the app’s version. Your IP address is used to stop misuse, for example far too many attempts in a short time. It is only written to the log if it hits the limit. Logs are kept for 30 days.
• Storage logs: We log every time someone reads, writes or deletes something in our storage, including when your phone sends photos, with IP address and time. We use this to detect and investigate security breaches. They are kept for 90 days.
• Virus scanning: When a photo arrives, Microsoft Defender scans it for viruses and malicious code. This happens automatically in Sweden. Microsoft does not keep the photo, but may use a fingerprint of the file (a so-called hash) to recognise known malicious code. If the scan finds malicious code, we delete the file and don’t print the book. You then get your money back. We have a limit on how much can be scanned each month. If it is reached, or a scan doesn’t finish, we print the photo without a scan. We keep the scan result for 90 days.
• App Attest: The first time the app talks to our server, it creates a security key in the phone’s secure chip, and Apple confirms that the key comes from the genuine app. We keep the public part of the key, its id, a counter and Apple’s confirmation. Our server uses the key to check that orders and payments come from the app and not from a program pretending to be the app. The key doesn’t say who you are and isn’t used to track you or for advertising. We delete it 365 days after the app last used it. We don’t ask for consent to the key, because it is necessary to protect orders and payments against misuse (cookiebekendtgørelsen § 4).
• Short-lived file links: No one can download the files in our storage without a link we create ourselves. The links expire, for example after one day for the printer’s link to the print file.
• Legal basis: our legitimate interest in keeping the system secure and stopping misuse (art. 6(1)(f), and art. 32).

3.9 Backups

• Every night we take a copy of our tables with orders, so we can restore them after a failure. Photos are not in the copy.
• We keep each copy for 14 days. After that, it takes at most 14 more days before it is completely gone. So when we delete something, it is gone from all copies within 28 days. If we restore a copy, we delete again what has been deleted since.
• Legal basis: our legitimate interest in not losing orders (art. 6(1)(f)).

3.10 When you use your rights

• Data: the date, what we did, the order numbers and a code calculated from your email. Not the email itself, and not the content.
• Purpose: to be able to show that we did what you asked.
• Legal basis: our legitimate interest in being able to document that we have met your rights (art. 6(1)(f), cf. art. 5(2)).
• How long: 3 years.

3.11 Complaints and claims after delivery

• Data: your email, the order number and the order. For the first 90 days after the order is closed, also name, address, phone number, the print file and the texts.
• Purpose: to be able to print a new book or refund you if there is a fault (the print promise and the right to complain), and to be able to document and defend a claim.
• Legal basis: our legitimate interest in handling complaints and claims (art. 6(1)(f)). We keep name and address for 90 days so we can send a new book without asking you again. We keep the email for 27 months: the 2-year right to complain under the Sale of Goods Act, counted from when you collected the book, plus a little extra, because an order can be closed before you collect it. If a fault is repaired, we keep it 12 months longer.

4. People in photos and texts

Photos often show people other than the person ordering, for example family, friends and children. Texts and calendars may mention them by name, and a calendar may show their birthday. That is personal data too, and we process it.

• Where the data comes from: from the person ordering. We don’t collect photos or data about you ourselves.
• Purpose: only to print and deliver what was ordered, and to handle any complaint.
• Legal basis: legitimate interest (art. 6(1)(f)). The person ordering and we both have an interest in making a private photo book or calendar. We consider that this interest outweighs the impact on you, because the product is private, because we don’t examine who is in the photos, because we don’t use them for anything else, and because we delete them within the periods below.
• Sensitive matters. A photo or a text may reveal, for example, health or religion. We don’t use the photos to find out anything about the people: we don’t use face recognition, don’t tag people and don’t analyse what the photos show. We only use them to print the product. The only automatic checks are a measurement of the resolution and a virus scan of the file itself.
• Who sees them: the person ordering, and the people they give the product to. With us, the photos are stored at Microsoft (our server) and printed by Gelato and the printer Gelato uses. We only look at them ourselves if it is necessary to solve a problem with the order.
• How long: photos 30 days after the order is closed. The print file, the texts and the calendar’s special days 90 days after the order is closed. Gelato deletes its copy [GELATOS FRIST].
• Why we don’t tell you directly: We normally don’t know who the people are and have no way of contacting them. Finding out would require us to examine the photos, which is exactly what we don’t want to do. That is why this information is published here (art. 14(5)(b)).

Are you in a photo or mentioned in a text?

• You have the right of access, erasure and objection (section 12).
• We can only find photos through an order, not through your face. So write to hello@familyprint.app with what you know, for example who ordered, the order number or roughly when. If we can’t find anything from that, we will tell you.
• On access, you are told whether we have photos or texts about you, and get a copy of those we can find. You cannot get the rest of the other person’s order.
• If you object before the product is printed, we contact the person who ordered and assess whether we can print it. If the product has been printed, we delete the photos, the print file and the texts as soon as the order is closed, and we ask Gelato to delete its copy.
• We only send a copy of photos when we are sure they show you or your child, and we may ask for documentation of parental responsibility.
• If your child is under 15, you can, as a parent with parental responsibility, exercise the rights on the child’s behalf.

The person ordering confirms that they have the right to use the photos and texts, and that the book does not infringe other people’s right to privacy.

5. Children

You must be 18 or over to order. If we find that an order was placed by someone under 18, we cancel it, refund the money and delete the data. Many photo books and calendars show children. That is why we don’t analyse who is in the photos. We only use them to print the product, only our IT provider and the printer process them for us, and we delete them within the periods in section 11. Parents can exercise the rights for their children (section 4).

6. What stays on your phone

This is stored only on your phone:

• your drafts and your basket (a design is only sent when you tap Fortsæt til betaling);
• your saved addresses;
• the details for an order you are in the middle of paying for (email, phone number and address);
• the overview of your orders (Konto → Bestillinger);
• the temporary copies of your photos that the app keeps on the phone (those in the book are sent by the app when you tap Fortsæt til betaling);
• the app’s error log;
• error reports waiting to be sent, and the app’s id (only if you said yes);
• the secret part of the app’s security key, and your choice about error reports.

You can delete all of it, except the app’s security key and your choice about error reports, under Konto → Privatliv → Slet alt på denne telefon (Delete everything on this phone). This does not affect your orders with us. You change your choice about error reports in the same place. You can also delete your designs under Slet kladder (Delete drafts), your addresses under Leveringsadresser (Delivery addresses) or delete the app.

Del fejllog (Share error log) sends the app’s error log, but only if you tap it yourself and choose who it goes to. The log may contain titles and texts from a design the app could not open.

The app may show a notification on the phone when your photos are ready. The notification is created on the phone, and we don’t send it. Messages about your order we only send if you say yes (section 8).

7. Apple services in the app

• Your photo library. The app asks iOS for access to your photo library so you can choose photos. You can give access to all your photos or only to the ones you choose. The app only reads photos and saves nothing in the library. Your photo library stays on the phone, and we receive nothing from it until you tap Fortsæt til betaling. Then only the photos you put in the book are sent. You can always change the access in iOS Settings.
• iCloud. If a photo is only in iCloud, the app fetches it from Apple when it is needed in the book.
• Address suggestions. When you type an address, the app sends what you type to Apple Maps to get suggestions, and the postcode to Apple to find the town. We do this to avoid errors in the address, so the parcel arrives. The legal basis is the contract with you and our and your legitimate interest in a correct address (art. 6(1)(b) and (f)). You can also type the address entirely yourself without choosing a suggestion, but the app still sends what you type.
• App Attest. Apple confirms the app’s security key (section 3.8).
• Notifications. If you said yes to messages about your order, they go through Apple’s push service (section 8).

Apple (Apple Distribution International, Ireland) is itself responsible for its processing of this data under Apple’s privacy policy. According to Apple, the data may be processed in the USA under the EU Commission’s standard contractual clauses.

8. Notifications

The app can tell you on your phone when something happens with your order. It only does so if you say yes.

• When: After you pay, the app asks whether you want to hear about your order. Only if you say yes does iOS ask you for permission to show notifications. Without your permission we send none.
• Data: With your permission, the app sends us the phone’s push token: an address from Apple that can only be used to send notifications to the app on that particular phone. We keep the token with the order and your language (Danish or English). We keep at most 5 phones per order.
• Purpose: only to send messages about that order: when it goes to print, when it has been sent (with the tracking code), when it has been delivered, when you get money back (with the amount), and a reminder 10 minutes before the 60 minutes in which you can cancel are over. Never advertising.
• Legal basis: your consent (art. 6(1)(a), and cookiebekendtgørelsen § 3).
• With whom: The messages go through Apple’s push service (Apple Push Notification service). Apple gets the token and the text of the message, which may name the book’s title, the tracking code or the amount (section 9).
• How long: We delete the token 90 days after the order is closed. We delete it sooner if you ask us to delete your data, or if Apple tells us that the app is no longer on the phone.
• Change your mind: You can turn the notifications off at any time in iOS Settings. The phone then no longer shows them. If you also want the token deleted at our end, write to hello@familyprint.app with your order number.

9. Who we share data with

A processor may only use the data for what we ask. An independent controller also uses it under its own rules.

Microsoft (Azure: servers, storage, key vault, logs and virus scanning)

• Gets: everything we keep about your order, your photos, error reports and logs
• Why: runs our system
• Role: processor · Where: Sweden (EU)

Gelato (Gelato ASA) and the printers Gelato uses

• Gets: name, address, email, phone number and the print file with your photos and texts
• Why: prints and sends the book
• Role: processor; the printers are sub-processors · Where: Norway (EEA). Printer: [TRYKKERI OG LAND]

GLS (via Gelato)

• Gets: name, address, phone number and email
• Why: delivers the parcel and notifies you
• Role: independent controller · Where: Denmark

Stripe (Stripe Payments Europe)

• Gets: your card details and technical information about the phone directly from the app, the amount and the order’s internal reference
• Why: payment, refunds and fraud checks
• Role: processor for the payment; independent controller for its own fraud and anti-money-laundering checks · Where: Ireland and the USA

Postmark (AC PM, LLC, part of ActiveCampaign)

• Gets: your email and the content of our emails to you: name, address, order and prices. Postmark records whether the email was delivered, and whether it was rejected or marked as spam
• Why: sends our emails
• Role: processor · Where: USA

Microsoft 365 (our mailbox, hello@familyprint.app)

• Gets: emails to and from us and what you attach, and the copy of your data you ask for, for at most 7 days
• Why: our mailbox, and to share a copy of your data with you
• Role: processor · Where: EU ([LAND]). [HVIS GODADDY STADIG ADMINISTRERER ABONNEMENTET: GoDaddy manages the subscription: processor, USA, [GRUNDLAG].]

Microsoft (Azure Static Web Apps: our website)

• Gets: your IP address and technical information about your browser when you visit the website or open help, prices or Skriv til os (Write to us) from the app. If you come from an order, the order’s reference is in the page’s address
• Why: shows the website and keeps it secure
• Role: processor · Where: USA

Apple (Apple Distribution International)

• Gets: what you type in the address field, the postcode and the app’s security key, and if you said yes to notifications, the phone’s push token and the text of the messages
• Why: address suggestions, security and notifications about your order
• Role: independent controller · Where: Ireland and the USA

[REVISOR ELLER BOGHOLDER]

• Gets: bookkeeping data
• Why: accounts
• Role: [databehandler (bogføring) / selvstændigt dataansvarlig (revision)] · Where: Denmark

Authorities, for example the Danish Tax Agency and the police

• Get: what the law requires, or information about a possible criminal offence, for example if a photo appears to show child abuse
• Why: legal requirements and reporting serious crime
• Role: independent controllers · Where: Denmark

We have a data processing agreement with every processor. We don’t sell data and don’t share it with advertisers.

10. Transfers to countries outside the EU/EEA

Some providers may process data outside the EU/EEA. That only happens on a lawful basis: the EU Commission’s decision on the EU-U.S. Data Privacy Framework (art. 45) or the EU Commission’s standard contractual clauses (art. 46). We follow whether the framework for the USA changes, and use the standard contractual clauses if it falls away.

• Stripe may process data in the USA under the Data Privacy Framework and the standard contractual clauses.
• Microsoft stores our data in the EU. Microsoft support may, in special cases, get access from countries outside the EU under the standard contractual clauses and the Data Privacy Framework. This also applies to our mailbox.
• Microsoft serves our website from the USA (Azure Static Web Apps) under the standard contractual clauses and the Data Privacy Framework.
• Apple, according to Apple, may process data in the USA under the standard contractual clauses.
• Gelato uses IT providers such as Amazon Web Services and Google, and printers in many countries. If data goes outside the EU/EEA, it does so under the Data Privacy Framework and/or the standard contractual clauses. [HVIS TRYKKERIET LIGGER I STORBRITANNIEN: The printer is in the United Kingdom, which the EU Commission has approved (art. 45).]
• Postmark sends and stores our emails in the USA, at the data centre Deft and Amazon Web Services, under the standard contractual clauses.
• [HVIS GODADDY STADIG ADMINISTRERER ABONNEMENTET: GoDaddy may access our mailbox from the USA under [Data Privacy Framework / standardkontraktbestemmelserne].]

Write to us if you want a copy of the agreements that protect your data when it is sent outside the EU.

11. How long we keep your data

When is an order closed? When we have been told the book has been delivered, when the order has been cancelled, or when we have refunded you because the book could not be printed. If we are not told the book has been delivered, we treat the order as closed 60 days after it was sent. If an order stalls, for example because of a fault at the printer, we close it ourselves, and the periods run from then. If a photo is also in another order, we keep it until that order is closed too.

12. Your rights

You have the right to:

• access: to be told what we hold about you, and get a copy;
• rectification: to have incorrect data corrected;
• erasure: to have your data deleted;
• restriction: that for a period we only store the data and don’t use it;
• data portability: to receive the data and photos you gave us in a common machine-readable format;
• objection: see below;
• withdrawal of consent: at any time, without affecting what we have lawfully done before.

Your right to object. When we process data on the basis of a legitimate interest (section 3.1 on gift recipients, 3.2 on reports, 3.6, 3.8, 3.9, 3.10, 3.11, 4, 7 and 16), you can object at any time on grounds relating to your particular situation. We then stop, unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is necessary to establish or defend a legal claim. Write to hello@familyprint.app.

How to do it

Step by step, and what you get, is under Your data.

• Write to hello@familyprint.app from the email you ordered with, and give your order number. The easiest way is to tap Få en kopi af mine data (Get a copy of my data) or Slet mine data hos FamilyPrint (Delete my data at FamilyPrint) under Konto → Privatliv. The app then opens a ready-made email with the orders from your phone.
• We only send answers and copies to the email on the order. If you want a copy with photos, we also ask you for something that isn’t in the order confirmation, namely the last four digits of the card you paid with. We do this because the email on an order may have been mistyped, and photos are the last thing we may send to the wrong person.
• We find your orders from the email you write from. If you ordered with more than one email, write from each of them. We don’t include an order with another email, even if you know its order number.
• If you no longer have access to that email, or you didn’t order yourself (for example if you are in a photo or received a gift), write anyway. We will find another secure way.
• We answer within 1 month. If the case is complex, the deadline may be extended by up to 2 months. You will then be told within the first month.
• It is free.

A copy. You get a link to a file with your data and the photos and print files we still have. The link works for at most 7 days. Only the person with the link can download the file. We share the file from our Microsoft 365 and delete it when the link has expired.

What erasure means with us

• If the order is closed, we immediately delete your photos, print files and the phone’s push token and overwrite name, address, phone number, texts, the calendar’s special days, tracking details and email.
• An order you never paid for, we delete completely.
• If the book is on its way, we can only delete once it has been delivered. Within the first 60 minutes you can cancel the order.
• We must keep the bookkeeping data for 5 years (bogføringsloven).
• We ask Gelato to delete your order and print file. Gelato deletes them [GELATOS FRIST VED SLETNING].
• Postmark, which sends our emails, deletes its copies of them 45 days after they were sent. If your email is on Postmark’s block list, we remove it.
• We ourselves keep emails to and from us, including your erasure request, for [2 ÅR] after the case is closed, so we can document what we agreed and did.
• Stripe keeps payment information under its own legal requirements.
• In our own systems, what you asked us to delete is gone from the backups within 28 days, from deleted files within 14 days and from server logs within 30 days. Storage logs and virus scan results, which may contain your IP address, are gone within 90 days.
• What is on your phone, you delete yourself (section 6).
• Once we have deleted your email, we can no longer find the order from it. Keep your order confirmation if you may want to complain later.

Rectification. If something is incorrect, write to us. Before the book goes to print, the easiest way is to cancel within 60 minutes and order again. If you entered a wrong address and the 60 minutes are up, write to us straight away. We will try to have it corrected, but can’t promise it once the book has been sent to print. A book that has been printed cannot be changed.

Consent. You turn off error reports under Konto → Privatliv (section 3.7). You turn off notifications in iOS Settings (section 8).

13. Automatic checks

We don’t use profiling. Two technical checks happen automatically: we measure whether your photos have a high enough resolution to print, and Microsoft scans the files for malicious code. If the check finds malicious code, or a photo’s resolution is too low to print, we don’t print the book, and you get your money back. Write to us if you think it is a mistake. We will then look at it ourselves.

14. Security

• The app talks to our server over an encrypted connection (HTTPS with at least TLS 1.2).
• Our data is stored at Microsoft in Sweden. Microsoft encrypts everything stored in our storage.
• No one can download the files in our storage without a link we create ourselves, and the links expire.
• Secret keys, for example for payment and printing, are kept in a key vault (Azure Key Vault), not in the app.
• We scan the photos you send for malicious code (section 3.8).
• We log who uses our storage, so we can detect and investigate security breaches.
• We never see your card details. Only Stripe has them.

No IT system is completely secure. If there is a security breach, we report it to Datatilsynet as the law requires. If the breach may pose a high risk to you, we will also tell you.

15. Complaints to Datatilsynet

If you are unhappy with how we process your data, you can complain to the Danish Data Protection Agency:

Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, phone +45 33 19 32 00, dt@datatilsynet.dk, datatilsynet.dk. See how to complain.

Feel free to write to us first, and we will try to resolve it.

16. The website

When you visit the website, or when the app opens a page from it (help, prices and Skriv til os), our hosting provider, Microsoft (Azure Static Web Apps, processor, USA), processes your IP address and technical information about your browser to show the page and keep it secure. If you open Skriv til os from an order, the order’s reference is in the page’s address, so we know which order you are writing about. The legal basis is our legitimate interest in a secure website (art. 6(1)(f)). The data is deleted after [PERIODE]. The website uses no cookies and no tracking. Read more about cookies.

17. Changes

If we change the policy, we update the date at the top. If the change is significant, we will also tell you in the app.