Zeeder AB — Privacy Policy

GDPR protects natural persons. That means two groups on Zeeder have full GDPR rights:

• Creators — the individual people who sign up to receive products.
• Brand users — the individual people (founders, marketers, assistants) who log in and run a brand account on Zeeder.

Brand company data (company name, organisation number, product catalogue, billing records) is not personal data under GDPR. It is still protected by our Terms and by confidentiality obligations in our contracts.

• Zeeder is the controller for data it collects to run, secure, and improve the service: accounts, sign-in, platform analytics, support, marketing.
• Zeeder acts as a processor for a brand when that brand instructs us to create orders and shipments on its e-commerce system, or to message a creator on its behalf. The brand is the controller for that data. If you are a creator and want to exercise rights over data a specific brand controls, contact the brand first; we support their response as processor.

• We collect identity, contact, shipping, social-profile, and usage data to run Zeeder.
• We use that data to provide the service, prevent fraud, enable shipments, measure results, and — with your consent where required — send product updates.
• We share data with a small list of sub-processors (hosting, billing, email, analytics) and with the e-commerce platforms and carriers a brand chooses. The current named list is available on request to privacy@zeeder.co.
• We do not sell your personal data. We do not send marketing SMS.
• You have GDPR rights (access, rectify, erase, restrict, portability, object, withdraw consent) — exercise them by emailing privacy@zeeder.co.
• Creators must be at least 13. Creators aged 13–17 must provide a signed parental or guardian consent document before their account is approved.

• We do not intentionally collect special-category data (health, religion, political views, etc.) or criminal-offence data. Please do not submit such data.
• The service is open to creators aged 13 and over. Creators aged 13–17 must upload a signed parental or guardian consent document before their account is approved for product shipments. We do not knowingly collect personal data from children under 13; if we learn we have, we delete it promptly.

When a creator applies to a brand's zeed, the brand can see identity and contact details the creator has shared publicly (name, profile photo, country, connected social handles), engagement and activity signals derived from their connected social accounts, and their history on the Zeeder platform. Brands can filter applications by age range; we derive age from date of birth and do not display the date of birth itself.

Once a brand accepts a creator for a zeed, the brand additionally sees the shipping details needed to fulfil the order: full shipping address, email, and phone number for delivery. After delivery, the brand can see public posts we detect about their product and the associated engagement metrics.

Brands are contractually restricted from using this data for any purpose other than running the zeed on Zeeder.

We use a small number of cookies and similar technologies:

• Strictly necessary — sign-in session, CSRF protection, cookie-consent choice. These are always set because the product cannot function without them.
• Analytics — we use Google Analytics 4 with IP anonymisation to understand which pages and features are used. Analytics cookies load only if you click “Accept” on our cookie banner.

We do not run advertising cookies, retargeting pixels, or third-party trackers beyond Google Analytics.

Our cookie banner presents a binary Accept/Decline choice. We store your answer under the key zeeder_cookie_consent in both a cookie and your browser’s local storage for zeeder.co. You can change your answer by clearing cookies and site data for zeeder.co in your browser settings; the banner reappears on your next visit.

• Directly from you (forms, profile, messages, support requests).
• Automatically from your device when you use the service (logs, telemetry).
• From brands (about creators who apply to their zeeds) and from creators (about brand representatives they interact with).
• From third-party platforms you connect (social and e-commerce), within the scopes you approve during the OAuth flow.

We share personal data with a limited set of sub-processors that help us run Zeeder, across the following categories:

• Database and backend hosting
• Web hosting and edge delivery
• Billing and subscription management (brands)
• Transactional and marketing email delivery
• Usage analytics (consent-gated, IP-anonymised)
• Social sign-in providers (OAuth)
• Connected social platforms for creator profile and post metrics
• E-commerce platforms a brand connects for order and fulfilment creation

A current list of the named vendors in each category, together with their processing regions, is available on request to privacy@zeeder.co. Each sub-processor is bound by a written contract (a data processing agreement or equivalent enterprise terms) that obliges them to protect personal data and process it only on our instructions.

We may also share personal data with:

• Carriers and fulfilment partners a brand chooses to ship a product to a creator.
• Professional advisers (legal, accounting) and public authorities where required by law.
• Corporate transactions: if Zeeder restructures, merges, or sells assets, personal data may transfer to the successor entity under equivalent protections.

We do not sell personal data. We do not share personal data with advertisers.

We keep personal data only as long as necessary for the purposes in Section 6. Our guidelines:

• Account data — while your account is active, plus a limited period after deletion to handle disputes and legal claims (typically up to 24 months).
• Activity logs and telemetry — typically up to 24 months.
• Billing records and invoices (brands) — at least 7 years as required by Swedish bookkeeping law (bokföringslagen).
• Backups — deleted records remain in backups for a short period before being overwritten in the normal backup rotation.
• Support conversations — kept while relevant to help us assist you, then archived or deleted.

We may keep limited data longer to establish, exercise, or defend legal claims. We are actively building automated enforcement of these guidelines; today, retention is reviewed periodically rather than on a fixed schedule.

We apply technical and organisational measures appropriate to the risks, including:

• Encryption in transit (HTTPS) and at rest with our sub-processors.
• Role-based access controls and the principle of least privilege for Zeeder staff.
• Secrets stored in managed secret stores, not in source code.
• Automatic session expiry and protection against cross-site request forgery.
• Logging and monitoring of production systems.
• Regular backups held by our database provider.

12.1 Admin support access

Authorised Zeeder staff may access a brand account to provide support or investigate issues. Access is limited to what is needed for the task, audited, and never used for creator accounts.

If you are an individual (creator or brand user) based in the EEA/UK/CH you have the right to:

• access the personal data we hold about you;
• correct it if it is inaccurate;
• ask us to erase it;
• restrict or object to processing;
• receive your data in a portable format;
• withdraw any consent you gave us (without affecting prior processing);
• lodge a complaint with a supervisory authority.

How to exercise: email privacy@zeeder.co and tell us what you want. We aim to respond within 30 days. For data a brand controls (for example, an order placed on the brand's store), we will redirect you to the brand and support their response as processor.

Supervisory authority (Sweden): Integritetsskyddsmyndigheten (IMY), imy.se.

We send two kinds of email:

• Operational — sign-in codes, shipping updates, billing receipts, important product notices. These are required to run the service.
• Marketing — product updates, onboarding tips, occasional announcements. We send these only where we have consent or where permitted by e-privacy rules, and every message includes an unsubscribe link.

We do not send marketing SMS or text messages.

When a brand connects its store platform and asks Zeeder to create orders and shipments for creators:

• The brand is the controller of the customer, order, and shipping data sent to its store.
• Zeeder acts as the brand's processor for that flow.
• The store platform and carriers act under their own terms as independent controllers or processors.

Creators who want to exercise rights over data held on a brand's store (for example, asking the brand to delete an order record) should contact the brand first. We support the brand's response.