My Atelier – Privacy Policy
Last updated: 17 October 2026 Effective from: 17 October 2026
Summary
- Who is responsible: Alma Josephine Martinez Sjölen, sole trader trading as My Atelier, Solna, Sweden. Contact: info@myatelier.app.
- What we collect: the information you give us (such as your account, profile, listings, Custom Designs, measurements, messages and orders), information created when you use My Atelier (such as orders, likes and follows), and limited technical information (such as device type and pages visited).
- Why: to run the marketplace, process orders and payments, keep the Platform safe, meet legal obligations and, with your consent, understand how the Platform is used.
- Who sees it: other users see your public profile and content. Designers you buy from or hire receive the details they need, such as your name, address and, for made-to-measure work, your measurements. Service providers process data for us under contract.
- We do not sell your personal data, and we do not use it for third-party advertising.
- Your rights: you can access, correct, download and delete your data, and object to certain processing. You can delete your account at any time in Settings.
- Complaints: contact us first. You can also complain to the Swedish Authority for Privacy Protection (IMY).
1. Who is responsible for your data
The controller responsible for processing your personal data on the website myatelier.app, the My Atelier apps and related services (the "Platform") is:
Alma Josephine Martinez Sjölen, sole trader (enskild näringsidkare), trading as My Atelier Lundagatan 6b, 171 63 Solna, Sweden Email: info@myatelier.app
We have not appointed a data protection officer, as this is not required for our business. For all privacy questions, contact info@myatelier.app.
Words with capital letters, such as Client, Designer, Piece, Custom Design and Commission, have the meaning given in our Terms of Use.
2. What data we collect and how
2.1 Information you give us
- Account information: name, email address, password (stored only in encrypted form), username, account type (Client or Designer), language and preferences. If you sign in with Apple or Google, we receive your name and email address from that provider. Apple allows you to hide your email address, in which case we receive a relay address.
- Profile information: profile photo, bio, city or country, and for Designers also branding, specialties, starting prices, languages, materials, delivery destinations, response time, intro video and portfolio.
- Designer application: CV, photos of your own work, information about your experience and optional links.
- Content: posts, stories, photos, videos, sketches from the Creative Studio, Listings, Custom Designs (including inspiration images, budget, deadline and location), Proposals, reviews and ratings.
- Measurements and fit information: body measurements you enter, for example in your Custom Designs, Commissions or Fit Passport.
- Messages and attachments: messages, photos, videos and sketches you send to other users.
- Bookings: appointment date and time, purpose, time zone and status.
- Orders and shipping: items bought or sold, prices, shipping address, phone number if required by the carrier, and shipping and tracking details.
- Cases, reports and support: information you provide when you report a problem with an order, report content or a user, block someone, or contact us.
- Designer payout and tax information: bank account details for payouts and, where required by law, tax identification number, date of birth and address.
2.2 Information created when you use the Platform
- Activity: follows, likes, saved posts and Pieces, cart, orders, Commission milestones, notifications and read status.
- Profile and Listing views: when a signed-in user views a Designer's profile or Listing, we record this so the Designer can see aggregated statistics.
- Video calls: who took part, and when a call started and ended. Calls are transmitted directly between the participants' devices, or through a relay server when a direct connection is not possible. We do not record or store the audio or video of calls.
- Payment information: payment status and a customer reference from our payment provider. We never see or store your full card details.
2.3 Technical information
- Device and usage information: device type, browser, operating system, language, screen width, pages visited, the website you came from and campaign information (such as "utm_source").
- Approximate location: country, region and city derived from your IP address by our hosting provider. We do not store your IP address for this purpose.
- Logs and error reports: IP address, time and technical details when errors occur, to keep the Platform secure and working.
2.4 Your precise location
If you tap "use my location" when searching for designers or Custom Designs nearby, your device shares its location with the Platform. We use it on your device to sort and filter results and do not store it. If you choose a city or location for your profile, we store that location.
2.5 App permissions
The iOS app may ask for access to your camera and microphone (for video calls, stories and photographing sketches or garments), your photo library (to upload photos and videos, or to save exported sketches) and your location (see 2.4). You decide whether to allow access and can change this at any time in your device settings.
3. Why we use your data and our legal basis
Under the GDPR, we need a legal basis for each purpose. We use the following:
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and running your account, and signing you in | Account information | Performance of our contract with you (Terms of Use) |
| Showing your profile and content to other users | Profile information, content | Performance of contract |
| Reviewing Designer applications | Application documents | Performance of contract (steps at your request before becoming a Designer) |
| Enabling purchases, Custom Designs, Proposals and Commissions | Orders, Custom Designs, Proposals, measurements, messages | Performance of contract |
| Sharing your measurements with the Designer you hire | Measurements and fit information | Performance of contract |
| Processing payments and payouts | Orders, payment information, payout details | Performance of contract |
| Shipping | Name, shipping address, phone number, order details | Performance of contract |
| Messages, video calls and bookings | Messages, call metadata, bookings | Performance of contract |
| Notifications by email, in the app and as push notifications | Account information, activity, push subscription | Performance of contract. For optional push notifications: your consent |
| Handling cases, returns and disputes | Order details, messages, photos, measurements, evidence | Performance of contract, and our legitimate interest in resolving disputes fairly |
| Moderation, safety and preventing fraud and misuse | Content, reports, blocks, activity, logs | Legitimate interest in a safe Platform, and legal obligations under the EU Digital Services Act |
| Showing Designers aggregated statistics about views and followers | Profile and Listing views, follows | Legitimate interest of Designers and My Atelier in understanding reach |
| Usage statistics to improve the Platform | Device and usage information, approximate location, visitor ID | Your consent (see section 7) |
| Error reports and security logs | Logs and error reports | Legitimate interest in a secure and working Platform |
| Bookkeeping and accounting | Orders, payments, payouts | Legal obligation (Swedish Bookkeeping Act) |
| Reporting Designer income to the Swedish Tax Agency (DAC7) | Designer identity, tax and income information | Legal obligation |
| Responding to authorities and legal claims | Relevant data in the individual case | Legal obligation, or legitimate interest in establishing, exercising or defending legal claims |
| Sending you news about My Atelier (if offered) | Email address | Your consent, which you can withdraw at any time |
Where we rely on legitimate interest, we have balanced our interests against your rights. You can object to this processing (see section 9).
Where we rely on consent, you can withdraw it at any time, without affecting processing that took place before you withdrew it.
If you do not provide the information needed for the contract, such as a shipping address, we cannot carry out the relevant service.
4. Measurements and fit information
We know that body measurements are personal. That is why:
- your measurements are visible only to you and, for a specific Commission, to the Designer you hire (and to collaborating Designers on that Commission where needed to make the Piece);
- Designers may only use your measurements for that Commission;
- a copy of the measurements confirmed for a Commission is kept with that Commission so that the agreement can be checked if there is a complaint;
- you can change or delete the measurements in your profile at any time.
We do not use measurements for advertising, profiling or any purpose other than the Commission and resolving complaints about it.
5. Who we share your data with
5.1 Other users
- Public information: your profile, posts, stories, Listings, public Custom Designs (without measurements), reviews and ratings can be seen by anyone, including visitors without an account.
- When you buy or commission: the Designer receives your name, shipping address, order details, messages and, for Commissions, your measurements and inspiration images.
- When you sell or make a Proposal: the Client sees your Designer profile, Proposal and messages, and whether you sell as a Trader or a private person.
Designers who receive Client data process it as independent controllers and are responsible for complying with data protection law.
5.2 Service providers (processors)
These providers process personal data on our behalf, under data processing agreements, and only according to our instructions:
| Provider | What they do | Where |
|---|---|---|
| Lovable Labs Incorporated AB | Platform development, hosting and backend (Lovable Cloud), sign-in service, error reports | EU; subprocessors may process data elsewhere as described in section 6 |
| Supabase Inc. | Database, user authentication, file storage and real-time messaging (as part of Lovable Cloud) | EU (Frankfurt, Germany), AWS region eu-central-1 |
| Cloudflare Inc. | Website delivery, security and the relay servers for video calls | Global network, including the USA |
| Goshippo Inc. (Shippo) | Creating shipping labels and tracking | USA |
| Google LLC | Delivery of the Poppins font (Google Fonts) and browser push notifications in Chrome | USA |
| OpenStreetMap Foundation | Map tiles on the designer map (receives your IP address when the map loads) | United Kingdom |
| Unsplash Inc. | Delivery of sample images (receives your IP address when images load) | USA |
5.3 Other independent controllers
These organisations receive data from us and decide themselves how they process it, under their own privacy policies:
- Stripe Payments Europe Ltd. (Ireland) processes payments and card details, including for fraud prevention and its own legal obligations.
- Apple and Google, if you choose "Sign in with Apple" or "Sign in with Google", and for delivering push notifications to your device.
- Shipping carriers that deliver Pieces, which receive the name, address and, where required, phone number of the recipient.
- Authorities, such as the Swedish Tax Agency (Skatteverket) for DAC7 reporting, the police or courts, where we are required by law to share data.
- A buyer or successor, if My Atelier is converted into a company or transferred. We will inform you in advance.
We do not sell your personal data and do not share it with advertisers.
6. Transfers outside the EU/EEA
Some providers process data outside the EU/EEA, mainly in the USA. We only allow this when the data is protected by:
- an adequacy decision by the European Commission, such as the EU–US Data Privacy Framework for certified US companies, or the decision for the United Kingdom; or
- the European Commission's Standard Contractual Clauses, together with additional safeguards where needed.
You can ask us for more information about these safeguards at info@myatelier.app.
7. Device storage and cookies
The Platform stores small pieces of information on your device using local storage and session storage. We do not use advertising cookies.
Strictly necessary (no consent needed):
| Name | Purpose | Duration |
|---|---|---|
| Sign-in session (sb-…-auth-token) | Keeps you signed in | Until you sign out |
| my-atelier-language | Remembers your language | Until deleted |
| my-atelier-welcome-seen, atelier-story-camera-seen | Remembers that you have seen a welcome message or a tip | Until deleted |
| atelier-remember-email | Remembers your email address on the sign-in page, if you choose this | Until deleted or unticked |
| ma_sid | Session identifier that counts visits within one session | Until you close the browser or app |
Statistics (only with your consent):
| Name | Purpose | Duration |
|---|---|---|
| ma_vid | Random visitor ID that lets us count returning visitors and understand how the Platform is used | Until deleted |
You can give or withdraw consent at any time in [the privacy settings / the cookie banner]. You can also delete stored data in your browser settings.
8. How long we keep your data
| Data | How long |
|---|---|
| Account and profile | As long as your account exists. Deleted within 30 days after you delete your account, except as stated below |
| Content (posts, Listings, Custom Designs) | Until you delete it or your account |
| Stories | Visible for 24 hours, then deleted within 30 days |
| Measurements in your profile | Until you delete them or your account |
| Measurements confirmed for a Commission | 12 months after delivery, so that complaints can be checked, or longer if a case or legal claim is ongoing |
| Messages | As long as the conversation exists. When you delete your account, your name is removed from messages. Messages relevant to an open case are kept until the case is closed |
| Orders, payments and payouts | 7 years after the end of the calendar year in which they took place (Swedish Bookkeeping Act) |
| Designer tax information (DAC7) | For the period required by tax law |
| Designer applications | As long as the Designer account exists. Rejected applications: 6 months after the decision |
| Cases, reports and moderation decisions | 12 months after the decision, or longer if needed for a legal claim |
| Usage statistics | 13 months |
| Error reports and security logs | 90 days |
| Push subscriptions | Until you turn off notifications or delete your account |
9. Your rights
Under the GDPR, you have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate or incomplete data;
- erasure ("right to be forgotten"), for example by deleting your account in Settings;
- restrict processing in certain situations;
- data portability, meaning to receive the data you have given us in a structured, machine-readable format;
- object to processing based on our legitimate interest;
- withdraw consent at any time, where processing is based on consent.
How to exercise your rights: many changes can be made directly in your profile and Settings. You can delete your account in Settings. For everything else, email info@myatelier.app. We will respond within one month. We may ask you to confirm your identity.
Some data must be kept even after you delete your account, for example orders for bookkeeping, or data needed for an ongoing case or legal claim (see section 8).
10. Automated decisions and recommendations
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you. Designer applications, cases and moderation decisions are made by people.
The order in which designers, Pieces and Custom Designs are shown is determined by factors such as your search and filters, distance, recency, whom you follow, engagement and ratings. Section 16.6 of our Terms of Use explains this in more detail.
11. Security
We protect your data with technical and organisational measures, including encrypted connections (HTTPS), encrypted password storage, access rules that limit who can see which data (for example, measurements only for the hired Designer), private storage for application documents, and access to administration tools only for authorised persons. No system is completely secure. If a personal data breach occurs that is likely to put you at risk, we will inform you and the supervisory authority as required by law.
12. Age limit
You must be at least 18 years old to create an account. We do not knowingly collect personal data from children through accounts. If you believe a child has created an account, contact us and we will delete it.
13. Changes to this Privacy Policy
We may update this Privacy Policy, for example when we add new features or change service providers. We will inform you of significant changes by email or in the Platform before they take effect. The date at the top shows when it was last updated.
14. Complaints
If you have concerns about how we process your data, please contact us first at info@myatelier.app.
You also have the right to lodge a complaint with the Swedish supervisory authority:
Integritetsskyddsmyndigheten (IMY) Box 8114, 104 20 Stockholm, Sweden www.imy.se
If you live in another EU/EEA country, you can also complain to the supervisory authority there.
15. Contact
My Atelier Alma Josephine Martinez Sjölen, sole trader Lundagatan 6b, 171 63 Solna, Sweden info@myatelier.app