Privacy policy

Clear, careful and only what we need.

Last updated: 7 October 2026

Who we are

Tiny Finger Foods AB (“we”), organisation number 559505-5699, Renstiernas Gata 16, 116 28 Stockholm, Sweden, is the data controller for the personal data you share with us. You can reach us at hello@tinyfingerfoods.com.

What we collect

We collect your email address and, if you provide it, your name. We also record your language, where you signed up, when you signed up and gave consent, and your subscription or unsubscribe status. A newsletter subscription does not require your postal address or payment details.

Outside-Stockholm waitlist

We collect your email address, mobile phone number and postal address: street, house number, postal code, city and country. Your baby’s name is optional. We record your language, signup source, signup and consent dates, and moderation status. To prevent spam, we may also record review reasons and limited information about blocked attempts, such as the email domain, time and reason for blocking. Joining the waitlist does not require payment details.

Orders

When you buy a kit, Shopify handles checkout and stores the contact, delivery and billing details you provide, such as your name, email address, phone number and addresses. Your order record includes the products, quantities, prices, tax, shipping, payment status and any refunds. We access the information needed to fulfil your order and help with customer service. Card and other payment credentials are handled by Shopify and its payment providers, not stored in our website’s newsletter or waitlist records. We do not receive your full card number or security code.

Why we use it and our legal basis

Newsletter and waitlist updates: to send the updates you requested, including news about delivery availability outside Stockholm. Our legal basis is your consent (GDPR Article 6(1)(a)), given when you subscribe. Buying a kit does not automatically subscribe you to marketing.
Orders and customer service: to take payment, deliver your purchase, answer order questions and handle returns or refunds. Our legal basis is performance of a contract (Article 6(1)(b)).
Accounting and legal requirements: to keep records required by tax and accounting law. Our legal basis is a legal obligation (Article 6(1)(c)).
Security and spam prevention: to protect our forms and services from misuse. Our legal basis is our legitimate interest in keeping the website secure (Article 6(1)(f)).

We never sell your personal data.

Who we share it with

Newsletter and waitlist records are stored in our website database, provided through Lovable Cloud. Newsletter information may also be shared with Klaviyo, our email marketing provider, when the email integration is enabled. Order and customer information is processed by Shopify, its payment providers and delivery partners as needed to process payment and deliver your kit. Accounting or professional advisers may receive information where necessary to meet our legal obligations.

We use data processing agreements where required. Some service providers may process personal data outside the EU/EEA. Where applicable, transfers must be covered by an adequacy decision or appropriate safeguards, such as the European Commission’s standard contractual clauses. Contact us for information about the safeguards relevant to your data.

How long we keep it

Newsletter: we keep your active subscription while you remain subscribed. When you unsubscribe, we stop newsletter marketing and may retain a limited unsubscribe and consent record so that we can respect your choice and demonstrate compliance.

Waitlist: we keep your information while the relevant waitlist is active, for no longer than 12 months after delivery becomes available in your area, and no longer than 24 months from registration. You can ask to leave the waitlist or have your information deleted at any time.

Orders: we retain information needed to fulfil your purchase and handle customer service, returns and legal claims. Accounting records are generally retained for seven years in accordance with Swedish accounting requirements; this does not mean we retain full payment credentials.

We delete or anonymise information when it is no longer needed, unless a legal obligation requires us to keep it. Requests are normally answered within one month. Where information must be retained, we will explain why.

Your rights

You can withdraw your marketing consent at any time using the unsubscribe link in an email or by contacting us. To leave the waitlist, email us. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

You may request access to, correction or deletion of your personal data, restriction of processing, and data portability where applicable. You may also object to processing based on legitimate interests and to direct marketing. Some rights are subject to legal exceptions, including required accounting records. Contact hello@tinyfingerfoods.com to make a request.

You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or your local data protection authority.

Cookies and browser storage

The website uses browser storage to remember your cart and cookie preferences. Shopify checkout may use cookies needed to process your purchase, keep checkout secure and prevent fraud. Any optional analytics or marketing cookies require your consent where required by law; choosing necessary-only cookies should not prevent you from placing an order.