Privacy Notice

1. Who we are

This Privacy Notice explains how Noret Design AB ("we", "us", "our") collects and uses your personal data in connection with The Stylized Forest course and website. Noret Design AB acts as the data controller for the personal data described here.

2. Data we collect and why

• Account data (name, email, password hash) — to create your account and give you access to the course. Legal basis: performance of contract.
• Order & billing data (name, email, billing address, country, VAT status where relevant) — to fulfil your purchase, issue invoices, and meet tax obligations. Payment card details are handled by Paddle and never stored by us. Legal basis: performance of contract and legal obligation.
• Support messages (email content, attachments) — to respond to your questions. Legal basis: legitimate interests (providing customer support).
• Usage & device data (IP address, browser type, pages viewed, referrer, approximate location derived from IP) — to secure the Service, prevent fraud, and improve the product. Legal basis: legitimate interests.
• Marketing data (email subscription status) — only if you opt in. Legal basis: consent, which you can withdraw at any time.

3. Who we share data with

We share personal data only with:

• Paddle — our Merchant of Record, which handles checkout, payments, subscription management, tax compliance, invoicing, and refunds.
• Service providers / sub-processors — hosting, database, email delivery, analytics, and customer support tooling acting on our instructions under a data processing agreement.
• Professional advisers — legal, tax, and accounting advisers, when necessary.
• Authorities — when required by law or to protect our rights.

We do not sell your personal data.

4. International transfers

Some of our providers process data outside the EEA/UK. Where they do, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses (SCCs) as safeguards.

5. How long we keep data

We keep personal data for as long as needed to provide the Service, comply with legal obligations (for example, tax records for 7 years under Swedish accounting law), resolve disputes, and enforce our agreements. After that, we delete or anonymise it.

6. Your rights

Subject to applicable law (including the EU/UK GDPR), you have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate data;
• ask us to delete your data;
• restrict or object to certain processing;
• port your data to another provider;
• withdraw consent at any time (where processing is based on consent);
• lodge a complaint with your local data protection authority — in Sweden, this is the Integritetsskyddsmyndigheten (IMY).

We aim to respond to rights requests within one month.

7. Security

We use appropriate technical and organisational measures — including encryption in transit, access controls, and least-privilege access — to protect your personal data. No system is perfectly secure, but we take these responsibilities seriously.

8. Cookies & analytics

We use essential cookies to keep you signed in and to keep the site secure. For analytics, we use a privacy-friendly, aggregated analytics tool that measures page views and conversions without setting tracking cookies, without collecting personal identifiers, and without cross-site tracking. Because of this, we do not need to show a cookie consent banner. If we ever add cookie-based analytics or advertising, we will ask for your consent first.

9. Changes to this notice

We may update this Privacy Notice from time to time. The date at the top shows when it was last changed.

10. Contact

Questions or requests? Contact us. See also our Terms & Conditions.