Privacy Policy

1. Information We Collect

Depending on how you use the Site, we collect:

• Identity & contact data: name and email address (for example, when you sign up for our newsletter, create an account, contact us, or leave a review).
• Order & transaction data: the products you buy, order value, shipping and billing address, phone number, and delivery details. Card payments are processed by Shopify at checkout - we do not receive or store full card numbers.
• Account data: if you create a customer account, your profile details and order history, managed through Shopify's Customer Account service.
• Reviews & user content: the rating, text, and any photos or videos you upload with a review, plus any support message you send us through the review flow.
• Subscription data: if you subscribe, the details needed to manage your recurring order, handled through our subscription provider (Seal).
• Location data: if you use the store locator's "find near you" feature, your device's approximate location - only after you grant your browser's location permission, and used to show nearby stockists. We do not store it on our servers.
• Technical & usage data: IP address, device and browser type, pages viewed, and similar analytics data, collected via cookies and similar technologies (see Section 4).

2. How We Use Your Information & Legal Bases

• To fulfil your orders - process payment, ship products, and provide customer support.Legal basis: performance of a contract
• To manage your account and subscriptions.Legal basis: performance of a contract
• To send our newsletter and marketing you have asked for.Legal basis: consent (you can withdraw any time)
• To invite and publish reviews after a purchase, and to display approved reviews on the Site.Legal basis: consent and/or legitimate interest
• To measure and improve the Site using analytics.Legal basis: consent (via the cookie banner)
• To show relevant advertising, where enabled.Legal basis: consent
• To keep the Site secure and meet legal obligations (for example, tax and accounting records).Legal basis: legitimate interest and legal obligation

3. Who We Share Your Data With

We do not sell your personal data. We share it only with service providers who process it on our behalf, under contract, to run the Site and our shop:

• Shopify - e-commerce platform, checkout, payments, and customer accounts.
• Supabase - database and secure storage for our review system, including any media you upload with a review.
• MailerLite - delivery of our newsletter and review-request emails.
• Seal - management of subscriptions.
• Google - Google Analytics and Google Tag Manager, for analytics, subject to your cookie consent.
• Meta - the Meta (Facebook) Pixel, to measure and personalise our advertising, set only with your consent.
• Vercel - website hosting and infrastructure (processes technical data such as IP addresses and server logs).
• Mapping & geocoding providers - used to render the store locator map.

4. Cookies & Similar Technologies

We use cookies and similar technologies. Non-essential cookies (analytics and marketing) are set only after you agree via our cookie banner; you can change your choice any time using the "Cookie Settings" link in the footer. We use Google Consent Mode, so tracking stays off until you opt in.

• Strictly necessary: remembering your cookie choice, keeping your shopping cart, signing you in to your account, and securing checkout. These are always on.
• Analytics: Google Analytics, to understand how the Site is used. Set only with your consent.
• Marketing: the Meta (Facebook) Pixel, to measure and personalise advertising. Set only with your consent.

5. International Transfers

Some of our providers (for example, Shopify, Google, Meta, and Vercel) may process data outside the European Economic Area, such as in the United States. Where they do, the transfer is protected by appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an adequacy decision.

6. How Long We Keep Your Data

We keep personal data only as long as necessary for the purposes above:

• Newsletter data - until you unsubscribe.
• Account and subscription data - while your account is active.
• Order, payment, and accounting records - for the retention period required by Latvian tax and accounting law.
• Reviews and uploaded media - until you or we remove them.

When data is no longer needed, we delete or anonymise it.

7. Your GDPR Rights

Subject to conditions in the GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten").
• Restrict or object to certain processing, including direct marketing.
• Data portability - receive your data in a portable format.
• Withdraw consent at any time, including unsubscribing from emails and changing your cookie choices.
• Lodge a complaint with a supervisory authority. In Latvia this is the Data State Inspectorate (Datu valsts inspekcija, dvi.gov.lv).

To exercise any of these, contact us at meow@sodysodas.com.

8. Children

The Site is not directed to children, and we do not knowingly collect personal data from anyone under the age required by our Terms. If you believe a child has provided us data, contact us and we will delete it.

9. Security

We use appropriate technical and organisational measures to protect your data, and work with reputable providers who do the same. No method of transmission or storage is completely secure, but we take reasonable steps to safeguard your information.

10. Changes to This Policy

We may update this Policy from time to time. We will post the updated version here and change the "Last Updated" date above.

11. Contact Us

If you have questions about this Privacy Policy or your data, contact us at: