Privacy policy

This policy explains what personal data ISBAD processes, why it is needed, who receives it and your rights under the GDPR.

Last updated: 21 August 2026

Controller

ebutiq Global AB, Swedish company no. 559251-0910

Address

Hangarvägen 2, 423 37 Torslanda, Sweden

Privacy contact

info@isbad.com

Questions or a request concerning your rights?

info@isbad.com Cookie policy

1. When this policy applies

This policy applies when you visit ISBAD websites, shop directly in our checkout, contact us, use the withdrawal function or apply to and use the creator platform. ebutiq Global AB is the controller for the processing described here.

Payment providers may be independent controllers for parts of their statutory payment and fraud checks.

2. Purchase, payment and delivery

To receive, charge, deliver and follow up an order, we process your name, email, telephone number, shipping and billing address, order lines, prices, currency, payment status, payment reference and order communications. We do not store full card details.

Processing is necessary to perform the purchase contract. Accounting and transaction records are also processed to comply with legal obligations. Fraud prevention and documentation of legal claims may rely on our legitimate interest in operating securely.

3. Returns, withdrawal, complaints and support

When you contact us or use the withdrawal function, we process the contact and order details and message you provide. We use them to identify the contract, issue an acknowledgement, provide support and handle a return, refund, complaint or dispute.

The legal grounds are the contract, our consumer-law obligations and our legitimate interest in answering other enquiries and establishing or defending legal claims.

4. Creator and partner platform

For creators, we may process name, email, account details, Instagram identity and profile information you choose to connect, creator code, referrals, clicks, linked orders, commission, payout records and communications. Sensitive login and access tokens are protected and used only for the connected function.

Processing is necessary to administer the application and agreement, calculate and document compensation, prevent misuse and comply with accounting and tax rules. Meta processes data under its own terms when you choose Instagram login.

5. Website, security and logs

When the website is used, our infrastructure providers may process IP address, timestamp, requested address, device and browser details and technical errors. These data are needed to deliver the service, protect against misuse, troubleshoot and maintain security.

The ground is our legitimate interest in a functional and secure service. Necessary local storage is used for features such as the shopping cart. See the cookie policy for details.

6. Analytics and consent

Google Analytics and PostHog load only after you choose Accept all. We or the providers may then process online identifiers, IP address, device information, page views, clicks, referrer and recordings of interface use.

The legal basis is consent. Choosing Necessary only means these services do not load. You can withdraw consent through Manage cookies in the footer; withdrawal does not affect processing already carried out lawfully.

Creator attribution through the isbad_ref cookie also occurs only with consent. Server-side security or order events needed for the service are not marketing analytics.

7. Sources of data

You provide most data in checkout, forms, email or the creator flow. Order and payment status comes from payment providers. Delivery status may come from the carrier. If you connect Instagram, we receive the profile details you approve from Meta.

Technical data is generated by your browser, our systems and, after consent, analytics providers.

8. Recipients and providers

We disclose data only where needed for the purposes above, required by law or covered by your consent. Processors may not use it for their own purposes beyond what their role and the law permit.

Supabase for databases, authentication and technical infrastructure.
Stripe and Swish for payment and payment confirmation.
Resend for order, support and acknowledgement emails.
PostNord or another carrier shown or used for delivery.
Google for analytics, only after consent.
PostHog for product analytics and session recording, only after consent.
Meta/Instagram when a creator chooses to connect an account.
Accounting, IT and legal advisers and public authorities where necessary or legally required.

9. Transfers outside the EU/EEA

We prefer processing within the EU/EEA, but some global providers may process data elsewhere. Such a transfer occurs only through a GDPR-permitted mechanism, such as an adequacy decision, the EU–US Data Privacy Framework for a certified recipient or EU standard contractual clauses with supplementary safeguards where needed.

10. Retention

We do not retain personal data longer than the purpose, a legal requirement or a legal claim requires. It is then erased or anonymised.

Order, payment and accounting records: normally seven years under applicable accounting law.
Withdrawal, return and complaint matters: during the case and then while claims may be brought, normally no more than three years unless law or an ongoing dispute requires longer.
General customer support: normally six months after closure, unless it must be linked to an order or legal claim.
Creator and commission records: during the agreement and afterwards under accounting, tax and limitation rules.
Consent-based analytics: as set out in the cookie policy and provider settings, or until you withdraw consent.
Technical security logs: for the shortest reasonable period needed for troubleshooting, security and incident response.

11. Your rights

You may request access, rectification, erasure, restriction and, in some cases, data portability. You may object to processing based on legitimate interests and always object to direct marketing. You may withdraw consent at any time.

Rights are not absolute; for example, we may retain data required by law or needed for legal claims. We may verify your identity before disclosing or changing data. Contact info@isbad.com. We normally respond within one month.

12. Automated decisions, children and security

We do not make decisions with legal or similarly significant effects solely through automated processing. A payment provider may carry out automated fraud or credit checks for which it is responsible.

The shop is not directed to children and we do not knowingly collect children's details for purchases. We use access controls, encrypted transmission, limited permissions and other appropriate technical and organisational safeguards.

13. Complaints and amendments

Please contact us first with any question. You may also complain to the Swedish Authority for Privacy Protection, IMY, Box 8114, SE-104 20 Stockholm, imy.se, or the supervisory authority where you live or work.

We update this policy when processing or the rules change. We will provide appropriate notice of a material change. The date above identifies the current version.