Legal
Privacy Policy
Last updated: 2026-05-01
Who we are
The data controller is [T'chi]wow:a, reachable at hello@tchiwowa.com. If you have a question about your data, that is the right address.
What we collect and why
Email address
When you join The Pack or sign up to hear about drops, we store your email. We use it to send you what you signed up for. Nothing else. We use Resend to deliver those emails. Legal basis: consent (GDPR Art. 6(1)(a)).
Order data
When you buy something, we collect your name, shipping address, email, and payment reference. Payment is processed by Stripe -- we never see your full card number. Orders are fulfilled by Printful, who receive your name and shipping address to print and ship your item. Legal basis: contract performance (GDPR Art. 6(1)(b)) and legal obligation (GDPR Art. 6(1)(c)).
Analytics
We use PostHog and Google Analytics 4 to understand how people use the site. Both are loaded only after you give consent via the cookie banner. If you decline, no analytics data is collected. Legal basis: consent (GDPR Art. 6(1)(a)).
Cookies
We use two categories of cookies.
Essential cookies -- kept the site running: session state, cart, Stripe checkout flow. These are set regardless of your preference because the store does not function without them.
Analytics cookies -- only with your consent. You can change your choice at any time by clearing cookies or using the banner.
Where data is stored
The site runs on Hetzner servers in the EU. Order and subscriber data is stored in a PostgreSQL database on the same server. Stripe and Printful store the data they need on their own infrastructure -- check their privacy policies for details.
How long we keep it
Subscriber emails -- until you unsubscribe. Every email we send includes an unsubscribe link.
Order data-- 7 years from the order date. This is required by Swedish bookkeeping law (Bokföringslagen 7 kap. 2 §).
Analytics data -- subject to PostHog and Google Analytics retention settings, currently set to 14 months.
Your rights
Under GDPR you have the right to:
- --Access -- get a copy of the data we hold on you.
- --Rectification -- correct inaccurate data.
- --Erasure -- ask us to delete your data (subject to legal retention requirements).
- --Portability -- receive your data in a machine-readable format.
- --Objection -- object to processing based on legitimate interest.
- --Withdraw consent -- at any time, without affecting the lawfulness of prior processing.
Send requests to hello@tchiwowa.com. We respond within 30 days. If you think we have handled your data incorrectly, you have the right to lodge a complaint with the Swedish Data Protection Authority (Integritetsskyddsmyndigheten, imy.se).
14-day return right
EU Distance Selling rules give you 14 days from delivery to return most items. Full details are on the returns page.