Privacy policy
This policy explains what personal data Metilde collects when you visit metilde.com, place an order or manage a subscription, why we process it, how long we keep it and what rights you have under the GDPR.
Last updated: 2 November 2026
Contact and company details
- Legal entity: Nordic Wave LLC
- EIN: 41-4990099
- Address: 1209 Mountain Road Pl NE Ste R, Albuquerque, NM 87110, USA
- Email: support@metilde.com
- Phone: +1 505 523 0600 (Mon–Fri 09:00–17:00 (CET))
Nordic Wave LLC is the data controller for the processing described here. Contact us at support@metilde.com if you have questions or want to exercise your rights.
Data we collect
- Order data: name, delivery and billing address, email address, phone number, order contents, order history and returns.
- Account data: email address and subscription settings. You log in with a one-time code sent to your email, so we do not store a password.
- Payment data: payment method, transaction ID and payment status. Full card numbers are never stored by us; they are handled by our payment provider.
- Support data: messages, enquiries and attachments you send to customer service.
- Marketing data: email address and consent status if you subscribe to the newsletter.
- Basket data: email address and the contents of your basket once you have started checkout, so that we can save the basket and remind you by email (no more than four times over ten days). Every reminder includes a link to opt out of further reminders.
- Technical data: IP address, device and browser type, pages visited and interactions, collected through cookies and similar technologies.
Purposes and legal basis
| Purpose | Legal basis | Retention period |
|---|---|---|
| Processing and delivering your order, handling returns and refunds | Performance of a contract | While the order is in progress and for the complaint period |
| Managing your account and subscriptions | Performance of a contract | Until you delete your account |
| Accounting and tax obligations | Legal obligation (applicable bookkeeping rules) | 7 years |
| Customer service and complaints | Legitimate interest | 36 months after the case is closed |
| Newsletter and marketing | Consent | Until you withdraw your consent |
| Analysing and improving the website | Consent (non-essential cookies) | Up to 24 months |
| Fraud prevention and IT security | Legitimate interest | 12 months |
Who we share data with
We never sell your personal data. We only share it with processors who help us run the shop, and only to the extent necessary:
- Payment providers, for payments and fraud checks.
- Logistics partners and carriers, for delivery and returns.
- Providers of hosting, database and email, to run the website and send order-related emails.
- Payment via Stripe (card, Klarna, Apple Pay, Google Pay), warehousing and shipping via MittLogistik and PostNord, email via Resend, hosting and database via Vercel and Supabase.
- Meta (Facebook, Instagram), Google Ads and Microsoft Advertising, to measure our advertising. With your consent to marketing cookies, they receive data about your visit and purchase, and your email address in hashed form to link the purchase to an ad. Without consent, Google's tag only sends anonymous signals without cookies.
- AddRevenue, if you came to us through an affiliate link: order number and order value, so that commission can be paid to whoever placed the link.
- Public authorities, where we are required by law to disclose information.
Data processing agreements are in place with all processors. Where a transfer outside the EU/EEA is necessary, it is protected by the European Commission's standard contractual clauses together with supplementary safeguards.
Your rights
- Access – request a copy of the data we hold about you.
- Rectification – have inaccurate data corrected.
- Erasure – have your data deleted when we no longer need it.
- Restriction and objection – restrict or object to certain processing, including direct marketing.
- Data portability – receive your data in a machine-readable format.
- Withdrawing consent – at any time, without affecting processing that has already taken place.
Email support@metilde.com to exercise a right. We reply within 30 days. If you are unhappy with how we handle your data, you can lodge a complaint with the Data Protection Commission, dataprotection.ie.
Security
The website is served over TLS, login uses one-time codes, access to personal data is limited to staff who need it, and our systems are protected by logging and role-based access rights.
Children
The shop is not aimed at children. You must be 18 or over to place an order or create an account.
Changes to this policy
We may update this policy when our services or legal requirements change. The date above always shows the current version, and we notify registered customers of significant changes by email.