Your personal information is part of the trust you place in Malisse. This policy explains what we collect at malisse.online, how we use it, who receives it, and how to contact us about your privacy.

1. Who is responsible for your information

Malisse is operated by Rakivi OÜ, the data controller responsible for the personal information described in this policy. For privacy questions or requests, email [email protected].

Our business address is Harju maakond, Tallinn, Nõmme linnaosa, Seene tn 4/1-1, 11621, Estonia.

2. Information we collect

  • Orders and delivery. Your name, email address, billing and delivery addresses, telephone number, purchased items, order value, payment status, and information needed for delivery, returns, or refunds.
  • Payments. Stripe collects payment details through its hosted checkout. Our storefront does not collect or store your full card number or card security code. We receive order and payment information needed to manage your purchase.
  • Accounts and wishlists. Your email address, account identifier, sign-in information, and saved products. Guest wishlists stay in your browser; when you sign in, saved items can be linked to your account so you can access them across devices.
  • Reviews. Your chosen display name, rating, review title and text, and email address if you provide it. Your display name and review are public; the email field is not published with the review. Please avoid including private information in review text.
  • Messages. Information you share when you email us, including attachments, order references, and support correspondence.
  • Website activity. Technical and usage information such as IP addresses in connection logs, browser and device information, pages visited, referral sources, interactions, and purchase conversion events. Our analytics also include heatmaps and session replay, as described below.

3. Why we use your information

We use your information to accept payment, fulfil orders, arrange delivery, handle returns, send order updates and sign-in links, maintain your account and wishlist, publish reviews, answer questions, prevent fraud, and protect the store. We also use website activity to understand how the store is used and measure advertising performance.

Where the GDPR or UK GDPR applies, our legal bases depend on the activity: performing a contract or taking steps you request before a purchase; complying with legal duties such as accounting obligations; and legitimate interests in customer support, security, fraud prevention, and operating the store, balanced against your rights. Where consent is required for optional tracking or other processing, that activity requires your consent. This policy does not itself give us that consent.

You can browse without creating an account. If you do not provide information needed for payment or delivery, we may be unable to complete your order. Review submissions are optional.

4. Cookies, browser storage, and measurement

We use cookies and browser storage for sign-in, your shopping bag, guest wishlist, currency choice, and remembering dismissed prompts. Themalisse_currency cookie lasts up to one year. A temporary wishlist transfer cookie lasts up to one hour. Shopping bag and guest wishlist data in local storage remain until removed or your browser clears them. Signing out ends your current account session; clearing browser storage can also remove saved preferences and guest items.

We use self-hosted Umami analytics to understand visits and interactions. Its heatmaps show where visitors click and how far they scroll. Session replay reconstructs on-site page activity, including navigation, pointer movements, and scrolling. The current recorder masks text and form inputs and is configured for a maximum of ten minutes per recording. It does not record the separate Stripe-hosted checkout page.

Optional analytics, heatmaps, and replay start only after you allow the analytics category. Advertising tracking starts only after you allow the advertising category. Rejecting optional tracking does not prevent you from shopping. You can review or withdraw your choices at any time: . Saving a choice reloads the page so previously loaded trackers stop when you withdraw permission.

We store a record of your choice, its date, and the notice version in your browser under malisse.privacy-consent.v1for up to 180 days. Once that choice expires, optional tracking stays off until you renew it through Cookie settings. Clearing site storage or using another browser or device also leaves optional tracking off until you choose to enable it. Browser settings also let you block or delete cookies; doing so can affect sign-in and saved items. Cookies set on advertising partners' own domains are controlled through their sites and your browser.

5. Advertising: Google, Meta, X, and Pinterest

We may promote Malisse through Google, Meta (Facebook and Instagram), X, and Pinterest. Advertising services can use cookies, pixels, tags, and similar technologies to understand which ads lead to visits or purchases, limit repeated ads, and show advertising based on interests, including ads to previous visitors (remarketing). Where these tools are enabled and you consent, information may be shared with the relevant platform for online behavioural advertising and campaign measurement.

This information can include cookie and advertising identifiers, IP address, browser and device information, pages and products viewed, referral and ad-click identifiers, and actions such as adding items to a bag or purchasing. Purchase events may include order value, currency, and transaction identifier. Platforms may link activity to an account you hold with them and process it under their own privacy policies.

  • Google Ads. Our website uses Google Ads tags for advertising measurement after advertising consent. The current purchase event includes value, currency, and a transaction identifier. Read how Google uses information from partner sites and manage advertising preferences in Google My Ad Center.
  • Meta / Facebook and Instagram. Meta advertising may use the Meta Pixel or other business tools for conversion measurement and remarketing. No Meta website tracking tag is currently enabled on this store. See the Meta privacy policy, cookie policy, and Ad preferences.
  • X. X advertising tools may measure conversions and build audiences for interest-based advertising. No X website tracking tag is currently enabled on this store. See the X privacy policy and X personalised-ad controls.
  • Pinterest. The Pinterest tag may share website activity with Pinterest for conversion measurement and online behavioural advertising. No Pinterest website tracking tag is currently enabled on this store. See the Pinterest privacy policy and Pinterest personalisation settings to manage personalised advertising.

You can also use industry opt-out tools such as Digital Advertising Alliance AdChoices and Your Online Choices. These controls depend on participating providers and your browser or device; opting out of personalised ads does not remove all advertising. Your Malisse advertising choice controls optional on-site tracking here and is separate from the choices you make directly with a platform.

We do not currently upload customer email or telephone lists to these platforms or include those fields in our website advertising events. If we introduce additional advertising tags, enhanced matching, customer-list audiences, or server-side advertising events, we will update this notice and the relevant controls before using those tools. Advertising consent is optional and separate from transactional emails needed for orders or sign-in.

6. Who receives information

We share relevant information with service providers that help run the store: Stripe for payments; Resend for transactional and sign-in emails; our hosting and infrastructure providers, including Cloudflare; and delivery or fulfilment providers where needed to complete your order. Accounts, wishlists, and reviews use our self-hosted Supabase services; website measurement uses our self-hosted Umami service and Google Ads. Public reviews are visible to other visitors.

Information may also be disclosed to professional advisers, authorities, or other parties where necessary to meet legal obligations, investigate fraud, or establish, exercise, or defend legal claims. Service providers may also act as independent controllers for some activities. See the Stripe privacy policy, Resend privacy policy, and Cloudflare privacy policy for their practices.

7. International processing

We operate from Estonia. Some providers, including payment, email, advertising, and infrastructure providers, operate internationally, so information may be processed outside Estonia or the European Economic Area. Transfers subject to the GDPR require an applicable legal transfer mechanism, such as an adequacy decision or standard contractual clauses. Email [email protected] to ask about processing locations and the transfer arrangements applicable to your information, including how to obtain information about relevant safeguards.

8. How long we keep information

We keep information for as long as needed for the purposes described in this policy, taking account of applicable law and the following criteria:

  • Order and payment records: completion of your purchase, returns and disputes, and applicable tax and accounting obligations.
  • Account and wishlist data: providing your account and saved items, until no longer needed or a valid deletion request is fulfilled.
  • Reviews: the period the review remains relevant and published, and any need to investigate abuse or resolve disputes.
  • Support correspondence: resolving your enquiry and related follow-up or legal claims.
  • Analytics, heatmaps, replay recordings, and technical logs: the period needed to analyse website performance, investigate problems, and protect the service. A replay recording length limit is separate from how long the recording is stored.

Deletion can be subject to legal retention duties, ongoing disputes, and backup cycles. You can ask us about the retention applicable to your information or request deletion at [email protected].

9. Your choices and rights

Depending on where you live and the law that applies, you may have rights to access your personal information, correct it, request deletion, restrict processing, receive a portable copy, and object to certain processing, including processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting the lawfulness of processing before withdrawal.

To make a request, email [email protected]. Tell us what you need and, where relevant, the email address associated with your account or order. We may ask for information reasonably needed to verify your identity. We respond within the time required by applicable law; GDPR requests are generally answered within one month, subject to permitted extensions. You may also complain to your local data protection authority. In Estonia, this is the Estonian Data Protection Inspectorate.

10. Keeping your information safe

We use technical and organisational measures to protect personal information. No online service or transmission is completely secure. Keep access to your email account secure because Malisse uses emailed sign-in links. Contact us if you believe your account or information has been compromised.

11. Children and updates

Our store is not directed at children under 16. If you believe a child has provided personal information, contact us so we can investigate. We may update this policy as the store or our practices change. The date above identifies the latest revision; where required, we will provide additional notice of material changes.

For any privacy question, contact [email protected].