Privacy Policy
Last updated: 15 October 2026
Bootle AB ("Bootle," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and protect your personal information when you visit our website at bootle.io, place an order, subscribe to our communications, or otherwise interact with us.
Please read this policy carefully. By using our website or services, you acknowledge that you have read and understood this Privacy Policy.
Contents
- 1. Data Controller
- 2. Information We Collect
- 3. How and Why We Use Your Information
- 4. Who We Share Your Information With
- 5. Cookies and Tracking Technologies
- 6. International Data Transfers
- 7. Data Retention
- 8. Data Security
- 9. Children's Privacy
- 10. Your Privacy Rights
- 11. Automated Decision-Making
- 12. Updates to This Policy
- 13. Contact Us
- 14. How to Exercise Your Rights
1. Data Controller
The data controller responsible for your personal information is:
Bootle AB
Org. nr. 559333-3379
Nybrogatan 6, 114 34 Stockholm, Sweden
Email: privacy@bootle.io
Our lead supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, "IMY"), Box 8114, 104 20 Stockholm, Sweden. Website: imy.se
UK Representative: George Barker (Co-Founder)
Email: privacy@bootle.io
Address: 124 City Road, London, EC1V 2NX
2. Information We Collect
2.1 Information You Provide to Us
- Order information: name, email address, phone number, shipping address, billing address, and order details when you make a purchase. We operate guest checkout only — no user accounts are created.
- Payment information: payment card details are collected and processed exclusively by our payment processor, Stripe. We never receive, store, or have access to your full card number.
- Marketing communications: email address and name when you subscribe to our newsletter or marketing emails.
- Prize game: your email address when you claim a prize in our Spin to Win game.
- Product reviews: name, star rating, review text, and optional photos or videos when you submit a review via Klaviyo Reviews.
- Customer support: any information you provide when you contact us with a question, complaint, or request.
- AI chat assistant: the messages you send to our website chat assistant and its replies, and, if you choose to leave it so our team can follow up, your email address.
- B2B enquiries: company name, contact name, email, phone, role, and engraving specifications when you enquire about corporate gifting.
2.2 Information Collected Automatically
When you visit our website, we automatically collect certain information, including:
- IP address
- Browser type and version
- Device type and operating system
- Language preferences
- Referring URLs and pages visited
- Country and approximate location (derived from IP address)
- Usage data such as pages viewed, time on site, clicks, and interactions
- Prize game: when the Spin to Win game opens, we record what prompted it to open, the type of page, whether you are using a touch device or a computer, your language, your approximate country and the time. These records contain no name, email address, IP address or other identifier, and we do not record them if your browser sends a Do Not Track or Global Privacy Control signal. If you spin the wheel, we record the prize drawn, a random play ID and the same details as above, for every spin, including when your browser sends one of those signals. That ID is stored in a cookie in your browser for 24 hours and, if you claim the prize, on your claim record.
2.3 Cookies and Similar Technologies
We use cookies and similar technologies to collect some of the information described above. For full details on the cookies we use, their purposes, and how to manage your preferences, please refer to our Cookie Policy.
2.4 Information We Do Not Collect
We do not process sensitive personal information (such as racial or ethnic origin, political opinions, religious beliefs, health data, sexual orientation, or biometric data). We do not offer social login or require user account creation.
3. How and Why We Use Your Information
We process your personal information only where we have a valid legal basis to do so. The table below sets out our processing purposes and the corresponding legal basis under the GDPR.
| Purpose | Legal Basis |
|---|---|
| Order fulfilment and delivery | Performance of contract (Art. 6(1)(b) GDPR) |
| Payment processing via Stripe | Performance of contract (Art. 6(1)(b) GDPR) |
| Customer support and enquiries | Legitimate interest (Art. 6(1)(f) GDPR) |
| AI support chat assistant (Anthropic Claude API) | Legitimate interest (Art. 6(1)(f) GDPR) |
| Email marketing and newsletters (Klaviyo) | Consent (Art. 6(1)(a) GDPR) |
| Targeted advertising and advertising measurement (Meta, TikTok, Pinterest, Google, Trybe) | Consent (Art. 6(1)(a) GDPR) |
| Website analytics (GA4, Microsoft Clarity) | Consent (Art. 6(1)(a) GDPR) in the EU/UK; Legitimate interest elsewhere |
| Cookieless website analytics (Umami, self-hosted) | Legitimate interest (Art. 6(1)(f) GDPR) |
| Fraud prevention and security | Legitimate interest (Art. 6(1)(f) GDPR) |
| Product reviews (Klaviyo Reviews) | Consent (Art. 6(1)(a) GDPR) |
| B2B corporate gifting enquiries | Legitimate interest / pre-contractual steps (Art. 6(1)(b)/(f) GDPR) |
| Legal compliance (tax, accounting records) | Legal obligation (Art. 6(1)(c) GDPR) |
| Website functionality (country detection, sessions) | Legitimate interest (Art. 6(1)(f) GDPR) |
| Running the Spin to Win prize game: drawing the prize and issuing your prize code under the prize terms | Performance of contract (Art. 6(1)(b) GDPR) |
| Preventing abuse of the prize game: one spin per browser and one prize per email address | Legitimate interest (Art. 6(1)(f) GDPR) |
| Counting how often the prize game is shown and played, to decide when to offer it | Legitimate interest (Art. 6(1)(f) GDPR) |
Where we rely on legitimate interest, we have carried out a balancing assessment to ensure that your rights and freedoms are not overridden. You may contact us at privacy@bootle.io to request details of these assessments.
AI support chat assistant. Our website offers an AI chat assistant that answers general questions about our products, orders, shipping, returns, and warranty. When you use it, the messages you send and the assistant's replies are processed on our behalf by our AI provider, Anthropic Ireland, Limited (the Anthropic entity that contracts with customers in the EEA, the UK, and Switzerland; the underlying infrastructure is operated by its affiliate Anthropic PBC in the United States), which provides the Claude AI model and acts as our data processor under Anthropic's Data Processing Addendum, incorporating the EU Standard Contractual Clauses, solely to generate a response to your question. If you ask to reach a person and choose to leave your email address, that email address and the chat transcript are stored in our support database and sent to our support inbox so our team can follow up. We do not use your chat messages to train AI models, and under Anthropic's commercial terms Anthropic does not use data submitted through its business API to train its models. This processing is based on our legitimate interest in providing responsive customer support (Art. 6(1)(f) GDPR). The assistant answers general questions only: it cannot access your account or orders and does not make any automated decision about you. Please do not enter payment card details or special categories of personal data into the chat. For more information, see Anthropic's privacy policy at anthropic.com/legal/privacy.
We also operate a privacy-friendly, cookieless website analytics tool (Umami), which we self-host on our own servers in Germany. It sets no cookies and stores nothing on your device, so it runs without a consent banner on the basis of our legitimate interest in understanding aggregate website usage. It does not track you across websites, does not build advertising or marketing profiles, and never shares data with advertising platforms. It uses your IP address only transiently to generate an anonymised visitor count and derive approximate country, and then discards it. You can opt out at any time by enabling the "Do Not Track" setting in your browser, which we honour, or by contacting us at privacy@bootle.io.
Spin to Win prize game. To claim a prize, you give us your email address; without it we cannot issue a prize code. We use it to stop the same address claiming more than one prize. As stated next to the claim button, claiming a prize also signs you up for Bootle marketing emails: we pass your email address to our email provider, Klaviyo, which sends you a confirmation email. You are only subscribed if you confirm, and you keep your prize either way. The legal basis for these emails is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time using the link in every email, without losing your prize. How long we keep play and claim records is set out in section 7.
4. Who We Share Your Information With
We share your personal information with the following categories of third parties, solely for the purposes described below.
| Third Party | Data Shared | Purpose | Location |
|---|---|---|---|
| Shopify Inc. | Order data, customer information, browsing activity | E-commerce platform | US, Canada |
| Stripe Inc. | Payment card data | Payment processing | US |
| Google LLC (GA4) | IP address, device information, browsing behaviour | Website analytics | US |
| Google Ireland Ltd / Google LLC (Google Ads) | Purchase data (order value, currency, order number, time of purchase), Google Ads click ID, hashed email address and phone number (where provided) | Advertising and performance measurement (attribution) | US |
| Meta Platforms Inc. (Pixel + Conversions API) | IP address, device information, browsing events, purchase events, hashed email address (where provided) | Advertising and performance measurement (attribution) | US |
| TikTok (ByteDance Ltd) | IP address, device information, browsing events | Advertising and performance measurement (attribution) | US, Singapore |
| Pinterest Inc. (Tag + Conversions API) | IP address, device information, browsing events, purchase events, hashed email address (where provided) | Advertising and performance measurement (attribution) | US |
| Trybe Tech, Inc. (attribution pixel) | IP address, device information (browser, screen size), the address of the page you arrive on including link parameters, referring page, a random visitor identifier | Attributing visits to creator videos and creator-led ads | US |
| Microsoft Corporation (Clarity) | IP address, device information, session recordings | UX analytics (session replay, heatmaps) | US |
| Anthropic Ireland, Limited (infrastructure operated by Anthropic PBC, US) | Chat messages and assistant replies; on request, your email address and chat transcript | AI support chat assistant (Claude API) | EU, US |
| Supabase Inc. (database hosting) | Support ticket email address and chat transcript; checkout and order event records; internal service logs, including a one-way hashed reference derived from your IP address; prize game records (email address given when claiming a prize, prize, code and a random play ID; play statistics) | Database hosting for support tickets, for internal service and security logs, and for prize game records | Ireland (EU) |
| Netcup GmbH (analytics hosting) | IP address (transient), device and page information | Hosting our self-hosted, cookieless analytics | Germany (EU) |
| Klaviyo Inc. | Email, name, browsing activity, order data, reviews | Email marketing and reviews | US |
| Our UK fulfilment partner | Name, address, order and shipping details | Order fulfilment | UK |
| Parcel carriers | Name, address | Delivery of your order | UK |
We do not sell your personal information. However, we share certain information with advertising partners (Meta, Google, TikTok, Pinterest, Trybe) for cross-context behavioural advertising. Under California law (CCPA/CPRA), this may constitute "sharing." You may opt out of this sharing via our Cookie Preference Centre.
Where you have given us your email address or phone number (for example when you subscribe or place an order) and consented to marketing cookies, the identifiers we share with Meta, Google, TikTok and Pinterest may include a hashed version of your email address and/or phone number. The hash is created with the one-way SHA-256 method and is used to match purchases to the ads that led to them, so we can measure how our advertising performs. Hashed data is still personal data. We never share your email address or phone number in plain text.
Business transfers: If Bootle AB is involved in a merger, acquisition, reorganisation, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.
5. Cookies and Tracking Technologies
We use cookies and similar technologies on our website. These include strictly necessary cookies (required for the website to function), analytics cookies, and marketing cookies.
You can manage your cookie preferences at any time through our Cookie Preference Centre, accessible via the cookie banner or in the footer of our website.
For a full list of cookies we use, their purposes, durations, and providers, please see our Cookie Policy.
6. International Data Transfers
Bootle AB is based in Sweden (EU/EEA). Some of the third parties we work with are located outside the EEA. We protect international data transfers with appropriate safeguards as required by the GDPR, with one exception: transfers to Trybe rely on your consent instead, as described in the table below.
| Destination | Recipients | Safeguard |
|---|---|---|
| United States | Shopify, Stripe, Google, Meta, TikTok, Pinterest, Microsoft, Klaviyo, Anthropic | EU-US Data Privacy Framework (where certified) and/or Standard Contractual Clauses (SCCs) |
| United States | Trybe | Your explicit consent to the transfer (Art. 49(1)(a) GDPR), given by accepting marketing cookies in our cookie banner after it named Trybe, this transfer and its risk. Trybe receives data only from visitors who gave this consent; where we do not show you the banner, Trybe does not load. Trybe is not certified under the EU-US Data Privacy Framework and we have not concluded Standard Contractual Clauses with Trybe, so your data may not receive a level of protection equivalent to the EU or UK. You can withdraw this consent at any time in the Cookie Preference Centre. |
| Canada | Shopify | EU adequacy decision |
| Singapore | TikTok | Standard Contractual Clauses (SCCs) |
| United Kingdom | Our UK fulfilment partner and its parcel carriers | EU adequacy decision |
No personal data is transferred to China. All manufacturing-related data (such as B2B engraving specifications) is handled at our UK fulfilment facility only.
You may request a copy of the safeguards we use for international transfers by contacting us at privacy@bootle.io.
7. Data Retention
We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. The specific retention periods are set out below.
| Data Category | Retention Period | Reason |
|---|---|---|
| Order and transaction data | 7 years from date of transaction | Swedish Bokföringslag (Accounting Act) |
| Marketing and newsletter data | Until consent is withdrawn, plus 30 days | GDPR consent requirements |
| Analytics data (GA4) | 14 months | GA4 default retention setting |
| Session recordings (Microsoft Clarity) | Up to 30 days | Microsoft Clarity default retention |
| Customer support correspondence | 3 years from last contact | Legitimate interest |
| AI chat assistant messages and support tickets | Up to 12 months | Support follow-up; automatically deleted |
| Internal service and security logs | Up to 90 days | Keeping the service secure and preventing abuse; automatically deleted |
| Prize game claims | Email address removed from our prize records after 90 days; the whole claim record (a one-way hashed reference to your email address, the play ID, the prize, the code, the time of the claim and the wording shown when you claimed) deleted 12 months after the claim. Newsletter data held by Klaviyo follows the "Marketing and newsletter data" row. | Preventing more than one prize per email address; record of the sign-up request; automatically deleted |
| Prize game play records | 400 days | Deciding when and how to offer the game; automatically deleted |
| Cookie consent records | Duration of consent, plus 1 year | Accountability and compliance |
| Product reviews | Indefinitely while published; deleted upon request | Consent and legitimate interest |
| B2B enquiry data | 3 years from last contact | Pre-contractual steps and legitimate interest |
When personal information is no longer required, we securely delete or anonymise it.
8. Data Security
We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include encryption in transit (TLS/SSL), secure payment processing via Stripe (PCI DSS compliant), access controls, and regular review of our security practices.
While we take reasonable steps to protect your information, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security of your personal information.
9. Children's Privacy
Our website and services are not directed at children under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have inadvertently collected personal information from a child under 16, we will take steps to delete that information promptly. If you believe a child has provided us with personal information, please contact us at privacy@bootle.io.
10. Your Privacy Rights
10.1 EEA and UK Residents (GDPR / UK GDPR)
If you are located in the European Economic Area or the United Kingdom, you have the following rights under the GDPR:
- Right of access (Art. 15) — You may request a copy of the personal information we hold about you.
- Right to rectification (Art. 16) — You may request that we correct inaccurate or incomplete personal information.
- Right to erasure (Art. 17) — You may request that we delete your personal information, subject to certain legal exceptions.
- Right to restrict processing (Art. 18) — You may request that we limit how we use your personal information.
- Right to data portability (Art. 20) — You may request to receive your personal information in a structured, commonly used, machine-readable format.
- Right to object (Art. 21) — You may object to processing based on legitimate interest, including direct marketing.
- Right to withdraw consent (Art. 7) — Where we process your data based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
- Right to lodge a complaint — You have the right to lodge a complaint with a supervisory authority.
Lead supervisory authority: IMY (Integritetsskyddsmyndigheten), Box 8114, 104 20 Stockholm, Sweden. Website: imy.se
UK supervisory authority: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom. Website: ico.org.uk
10.2 US Residents (CCPA/CPRA and State Privacy Laws)
If you are a resident of California or another US state with applicable privacy legislation, you may have the following rights:
- Right to know — You may request information about the categories and specific pieces of personal information we have collected about you.
- Right to delete — You may request that we delete personal information we have collected from you, subject to certain exceptions.
- Right to correct — You may request that we correct inaccurate personal information.
- Right to opt out of sale or sharing — You may opt out of the "sale" or "sharing" of your personal information for cross-context behavioural advertising.
- Right to non-discrimination — We will not discriminate against you for exercising any of your privacy rights.
- Right to limit use of sensitive personal information — We do not collect sensitive personal information as defined by California law.
Categories of Personal Information Collected in the Last 12 Months
| Category (per Cal. Civ. Code 1798.140) | Collected |
|---|---|
| A. Identifiers (name, email, phone, address) | Yes |
| B. California Customer Records (name, address, phone) | Yes |
| C. Protected classifications | No |
| D. Commercial information (purchase history, order data) | Yes |
| E. Biometric information | No |
| F. Internet or network activity (browsing, interactions) | Yes |
| G. Geolocation data (IP-based approximate location) | Yes |
| H. Sensory data (audio, visual) | No |
| I. Professional or employment-related information | No |
| J. Non-public education information | No |
| K. Inferences drawn from other PI | No |
| L. Sensitive personal information | No |
We share personal information with advertising networks (Meta, Google, TikTok, Pinterest, Trybe) for cross-context behavioural advertising. The categories shared include identifiers, internet or network activity, and geolocation data. You may opt out of this sharing via our Cookie Preference Centre.
Global Privacy Control (GPC)
We honour Global Privacy Control (GPC) signals as a valid opt-out request where required by applicable law.
Do Not Track (DNT)
Except where stated above (our cookieless website analytics, Umami, and the counting of Spin to Win openings), we do not currently respond to Do Not Track browser signals, as no uniform standard for interpreting these signals has been adopted.
11. Automated Decision-Making
We do not make automated decisions that produce legal or similarly significant effects about you. We use audience segmentation tools (such as Klaviyo and Meta) to deliver relevant marketing communications and advertisements, but these activities do not produce legal or similarly significant effects on you.
Our AI chat assistant provides general information in response to your questions and does not make automated decisions that produce legal or similarly significant effects about you.
12. Updates to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes, we will update the "Last updated" date at the top of this page.
We encourage you to review this page periodically. For material changes, we will make reasonable efforts to notify you, such as by displaying a notice on our website or sending you an email.
13. Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us:
Bootle AB
Org. nr. 559333-3379
Nybrogatan 6, 114 34 Stockholm, Sweden
Email: privacy@bootle.io
UK Representative:
George Barker
Email: privacy@bootle.io
Address: 124 City Road, London, EC1V 2NX
14. How to Exercise Your Rights
To exercise any of the rights described in this Privacy Policy, please submit a request by emailing privacy@bootle.io. Include your full name and the email address associated with your interaction with us so that we can locate your information.
We will respond to your request within:
- 30 days for requests under the GDPR / UK GDPR
- 45 days for requests under the CCPA / CPRA
These timeframes may be extended where permitted by law, in which case we will inform you of the extension and the reasons for it.
We may need to verify your identity before processing your request to protect your privacy and security. If we cannot verify your identity, we may be unable to fulfil your request.
If you have previously consented to receiving marketing emails, you can withdraw your consent at any time by clicking the "unsubscribe" link in any marketing email or by contacting us at privacy@bootle.io.