privacy.md
Privacy Policy
Last updated: 2026-06-23
namesprout respects your privacy. This policy explains what personal data we collect, why, and your rights under the EU General Data Protection Regulation (GDPR).
Data we collect
- Order data: name, shipping address, email, and order contents — needed to fulfil and ship your order.
- Payment data: handled by Stripe; we never see or store your full card details.
- Communications: emails you send us and the messages we send you (order confirmations, withdrawal confirmations, shipping updates).
Why we process it (legal basis)
- To perform our contract with you (process, fulfil, and ship your order).
- To comply with legal obligations (accounting, consumer-law records such as withdrawal requests).
- With your consent, where we ask for it (e.g. marketing email).
Who we share it with
- Our fulfilment partner — to produce and ship your order.
- Stripe — to process your payment.
- Resend — to send transactional email.
- Vercel — website hosting and cookieless traffic analytics (see “Cookies & analytics”).
We do not sell your personal data.
Cookies & analytics
Essential cookies (your cart and checkout session) are always active — the store cannot function without them, so they require no consent.
We use no analytics or advertising cookies at all, so there is no cookie banner and nothing for you to accept or refuse. Our traffic measurement (Vercel Web Analytics) stores nothing on your device — no cookie, no identifier — and cannot follow you to other sites or recognise you when you return.
We measure which pages are visited and a small number of anonymous product events — for example that someone continued from the name generator to the preview, or added an item to their bag. These records carry no name, no email address and no order number: your order number is removed from the page address before anything is sent. The name you type into the generator is never sent either — only how many letters it had.
Your rights
Under the GDPR you can request access to, correction of, or deletion of your personal data, and object to or restrict its processing. You can also lodge a complaint with the Swedish Authority for Privacy Protection (IMY).
To exercise any of these rights, contact us at privacy@namesprout.co.