This Privacy Policy explains how we collect, use, and protect personal data when you use MakeGangSheet (the “Service”). We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Swedish data protection law.
1. Who is responsible for your data
The data controller for the personal data described here is:
- Controller
- Zanore Invest AB, a limited company (aktiebolag) registered in Sweden.
- Company registration number (organisationsnummer)
- 559093-4492
- Registered address
- Tummelsta Gård Huvudbyggnaden, 635 20 Eskilstuna, Sweden
- Privacy contact
- info@makegangsheet.com
2. Scope of this policy
This policy covers personal data we handle as a controller: the data of merchants who buy and use a MakeGangSheet subscription, visitors to this website, and people who contact us. When your end customers use the Builder on your store, we process their uploaded content on your behalf as a processor — you remain the controller for that data and are responsible for your own privacy notice to your customers.
3. Data we collect
Account & license data
To deliver the Service we process:
- your email address and name (to create your account and email your license key);
- your license keys, stored in hashed form (we do not keep them in plain text);
- activation instance identifiers — the store URL or instance id of each site where your license is activated — so we can enforce the two-seat limit and let you move a seat;
- your subscription status, plan, and billing interval.
Billing data
Billing name, address, country, and VAT number where provided (needed to calculate VAT and issue a compliant invoice). Card and payment-instrument details are handled directly by our payment providers — we do not store full card numbers.
Technical data
Standard server log data such as IP address, browser type, and timestamps, generated when you use the Service, kept for security, diagnostics, and fraud prevention.
Communications
The content of support requests and other messages you send us.
4. Why we use your data & our legal bases
- To provide the Service (GDPR Art. 6(1)(b) — contract)
- Creating your account, emailing your license key, activating and enforcing seats, rendering output, and providing support.
- To take payment and meet tax duties (Art. 6(1)(b) and 6(1)(c) — contract and legal obligation)
- Processing payments and retaining accounting records as required by Swedish law (including the Bookkeeping Act, bokföringslagen).
- To keep the Service secure (Art. 6(1)(f) — legitimate interests)
- Preventing fraud and abuse, diagnosing problems, and protecting the Service and its users.
- To communicate with you (Art. 6(1)(b) and 6(1)(f))
- Service messages such as receipts and renewal notices, and responding to your enquiries.
- Where you have given consent (Art. 6(1)(a))
- For any optional processing that requires it — such as analytics cookies on this website (see section 10); you can withdraw consent at any time.
5. Payments
Payments are processed by Stripe and PayPal, who act as independent controllers of the payment-card data you enter with them. We receive confirmation of payment and limited billing details but not your full card number. Their handling of your data is governed by their own privacy policies.
6. Sharing & sub-processors
We do not sell your personal data. We share it only with the providers listed below, who help us run the Service under contracts that require them to protect it, and with authorities or advisers where required by law or to protect our legal rights.
- Hetzner Online GmbH — hosting, infrastructure, and backups. All Service data, including uploaded artwork and rendered print files, is stored in EU data centers in Finland; backups are stored on a Hetzner Storage Box, also in Finland.
- Amazon Web Services (Amazon SES), EU region — transactional email, such as delivering your license key, receipts, and service notices.
- Stripe Payments Europe, Ltd. — payment processing when you pay by card (see section 5).
- PayPal (Europe) S.à r.l. et Cie, S.C.A. — payment processing when you pay with PayPal (see section 5).
- Google LLC (Google Analytics) — website statistics on this marketing site, loaded only if you accept analytics cookies in our consent banner (see section 10). Advertising features are disabled.
We use no other sub-processors. If this list changes, we will update this policy before the change takes effect.
7. International transfers
Some of our providers (for example, payment providers and Google) may process data outside the European Economic Area, including in the United States. Where they do, we rely on appropriate safeguards such as an adequacy decision — including the EU–US Data Privacy Framework, under which Google LLC is certified — or the European Commission’s Standard Contractual Clauses to protect your data.
8. How long we keep data
We keep account and license data for as long as your subscription is active and for a reasonable period afterwards. Accounting and invoice records are retained for the period required by Swedish law (currently seven years under the Bookkeeping Act). Server logs are kept for a shorter period for security purposes. When data is no longer needed, we delete or anonymize it.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased where the law allows;
- restrict or object to certain processing;
- receive your data in a portable format;
- withdraw any consent you have given, without affecting prior processing.
To exercise any of these rights, contact us using the details in section 14. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or your local supervisory authority.
10. Cookies
This marketing website (makegangsheet.com) sets no cookies unless you allow it. On your first visit we show a consent banner. If you accept analytics, we load Google Analytics, which sets first-party statistics cookies (_ga and _ga_*, lifetime up to two years) that help us understand how the site is used; Google Analytics 4 does not store full IP addresses, and advertising features are disabled. If you decline — or simply ignore the banner — nothing is loaded and no cookies are set. The legal basis is your consent (GDPR Art. 6(1)(a)).
You can change your mind at any time via the “Cookie settings” link in the footer. If you withdraw consent, the analytics stop and its cookies are removed.
The app (app.makegangsheet.com) sets only strictly necessary first-party cookies — a session cookie and a CSRF (security) cookie — that it needs to function. These are exempt from consent, so no banner is shown there.
11. Security
We apply appropriate technical and organizational measures to protect personal data, including encryption of data in transit, storing license keys in hashed form, and restricting access to data on a need-to-know basis. No method of transmission or storage is completely secure, but we work to protect your data and to respond appropriately to any incident.
12. Children
The Service is intended for businesses and is not directed to children. We do not knowingly collect personal data from children.
13. Changes to this policy
We may update this Privacy Policy from time to time. When we make a material change, we will update the “last updated” date above and, where appropriate, notify you directly.
14. Contact us
For any privacy question or to exercise your rights, contact:
Zanore Invest AB, Tummelsta Gård Huvudbyggnaden, 635 20 Eskilstuna, Sweden