Privacy

What we collect

Order details (name, email, shipping address), and your purchase history. We do not store full payment card details — those go directly to our payment provider.

Why & who processes it

To fulfil your order and provide support. We share what's necessary with our processors: our payment provider (Stripe, to take payment) and our fulfilment partner (Printful, to make and ship your order). They act on our instructions under data-processing agreements.

Transfers outside the EEA

Some processing happens outside the EEA: payment via Stripe (USA), for some orders fulfilment via Printful (USA/EU) and — only if you said yes to advertising measurement — Meta (USA). Where personal data goes to the USA it is safeguarded by the EU Commission's adequacy decision under the EU–US Data Privacy Framework and/or the Commission's Standard Contractual Clauses. Ask us for a copy of the safeguards at halla@midhats.no.

How long we keep it

As long as needed to run the shop and meet accounting/tax obligations under Norwegian law (typically 5 years for sales records), then we delete it.

Our own analytics (no cookies)

We measure how the site is used on our own servers — no Google Analytics, no cross-site tracking, and nothing stored on your device unless you said yes in the cookie box (then a random visitor id lives in your browser, so your visits count as one visitor over time; it says nothing about who you are and is deleted if you say no). For each page view we log the page path, the referring site's domain, your device type, your country (a 2-letter code our own server derives from your IP using GeoLite data from MaxMind, maxmind.com), and any campaign tags. To count visitors without storing anything on your device, our server makes a short-lived fingerprint by hashing your IP and browser with a key we rotate every 24 hours; we never store your IP and the fingerprint can't be traced back to you. Legal basis: our legitimate interest in privacy-friendly analytics (GDPR Art. 6(1)(f)) — you can object any time at halla@midhats.no.

Advertising measurement (Meta) — only if you say yes

We run ads on Facebook and Instagram and would like to know which of them actually bring buyers here, so we can stop paying for the ones that don't. That's what the cookie banner is about. Nothing here happens until you press Yes — and if you press No thanks, none of it happens: no pixel, no cookies, nothing sent to Meta. Our own analytics above run either way; they need no consent.

If you say yes, the Meta Pixel loads and sets two cookies on your device, _fbp and _fbc, kept for about 90 days, so Meta can recognise your browser between the ad and the shop. The pixel reports page views, products viewed, adds to cart, checkout steps and purchases to Meta. Our server sends Meta the same events, with your IP address and browser (its user-agent string). From the moment you submit your details at checkout — before any purchase, and even if you abandon the checkout — the pixel also sends Meta your e-mail, phone number, name, postcode, city and country in hashed form, and after a purchase our server sends the same; hashed means Meta gets a scrambled fingerprint rather than the readable text, and it lets Meta match the sale to the ad that led to it. This is the one place we hold on to your IP address: with your consent we keep it, the user-agent string and Meta's cookie ids (_fbp/_fbc) with your cart and order until the purchase has been reported to Meta — shortly after the order — and then remove them.

Legal basis: your consent (GDPR Art. 6(1)(a) and the Norwegian Electronic Communications Act, ekomloven § 3-15). We remember your answer in your browser for twelve months, then ask again. You can withdraw consent any time via the Cookies link in the footer — the pixel stops and the cookies are cleared — or by emailing halla@midhats.no.

The data goes to Meta Platforms Ireland Ltd. We and Meta are jointly responsible for the collection itself; what Meta does with the data afterwards is Meta's own responsibility, described in Meta's privacy policy at https://www.facebook.com/privacy/policy/. Meta may move the data to the USA under the EU–US Data Privacy Framework, which it is certified under.

E-mails from us

The e-mails we send you — order confirmations, shipping updates, support replies and newsletters — contain a tiny invisible image, and the links in them pass through our server on the way to where they point. That lets us see whether and when a mail was opened and which links were clicked, and from that request we also see your mail app or browser (its user-agent string) and your country; we don't store your IP address. Why: so we know that order mail actually arrives and gets read, can answer "did you get it?" without guessing, and can make the newsletters better. Legal basis: our legitimate interest in knowing that our mail reaches you (GDPR Art. 6(1)(f)) for order and service mail, and your newsletter consent for newsletters. Newsletters are additionally measured by our e-mail provider, Resend, which counts opens and clicks on its side. Don't want it? Turn off automatic image loading in your mail app — the mail works exactly the same without it — or object any time at halla@midhats.no.

Marketing emails

If you buy from us and don't tick the opt-out box at checkout, we'll occasionally email you news and offers about our own products (Norwegian Marketing Control Act § 15(3) — the existing customer relationship). The voluntary newsletter signup on the site is double opt-in and joins the same mailing list. Every marketing email has an unsubscribe link that stops all of it, and you can opt out any time at halla@midhats.no — unsubscribing never affects order emails like confirmations and tracking.

Your rights (GDPR)

You can ask for a copy of your data (access), ask us to correct or delete it, restrict or object to processing, or receive the data you gave us in a portable format. Email halla@midhats.no. You can also complain to the Norwegian Data Protection Authority (Datatilsynet).

Controller

Kveitejakten AS (org.nr. 838 104 932 MVA), Oslo, Norway, is the data controller.