Privacy notice

Information used to run the store

Shopping and account functions use contact details, delivery details, order information and account information you provide. Payment and delivery services need information relevant to their tasks. Technical security and consent records also involve personal information. The confirmed purposes and legal bases for each activity are listed below.

Brands and service providers

A brand fulfilling your parcel receives the information needed for that fulfilment. The details below identify recipients, service providers and their roles, and explain international processing and the applicable safeguards.

Country suggestions on the website

On a first visit, a local IP geolocation database can suggest a country. Your IP address is not sent to an external lookup API for this suggestion. Your explicit saved market choices take precedence.

Website marketing and optional analytics

A purchase does not itself subscribe you to optional marketing. Optional analytics, including Google Analytics if enabled, require the relevant consent before loading. You can change cookie choices through Cookie settings. Withdrawing consent does not affect processing that was lawful before withdrawal.

Shopping in the Cultco app

You can browse and order in the Cultco app as a guest. To display products and calculate prices and delivery, the app sends Cultco your selected language, delivery country and currency, requested products or search terms, and basket product identifiers and quantities. Network requests also involve technical connection information such as your IP address. Your saved-product and followed-brand choices are kept on your device rather than synchronised with a Cultco account; product identifiers are sent when the app requests those products.

When you place an order, Cultco processes your name, email address, delivery address and order information to arrange payment, separate brand parcels, service messages, returns and complaints. The purposes, legal bases, recipients, international-transfer information, retention criteria and rights described elsewhere in this notice also apply to app orders. The app also supports the customer sign-in and Circle functions described below.

Device storage and interrupted payments

The app stores your language and delivery choices, saved product identifiers, followed brand identifiers and basket identifiers and quantities on your device. It also keeps a random checkout recovery identifier, the relevant product quantities and market, and a temporary record for updating the basket in the device's protected storage. These allow an interrupted purchase to be checked without creating a duplicate order. Cultco's app does not persist your contact details, full card data or Stripe payment secrets in this storage.

Preferences and basket data have no fixed automatic expiry in the app. You can change preferences, unsave products, unfollow brands and remove basket items. The app removes recovery data after it receives and safely handles a confirmed payment, cancellation or refund result; unresolved payments may retain recovery data until they can be checked. Device storage and backups also depend on the operating system. Removing local app data does not cancel an order or delete Cultco's server records. Contact hej@cultco.com for requests concerning those records; the retention criteria and rights elsewhere in this notice still apply.

Your Circle account in the app

You may continue shopping as a guest or sign in with a code sent to your email. Verifying a new email creates a customer account; an existing customer email uses the same Cultco account as the website. Staff accounts cannot sign in through this customer flow. Joining Circle separately requires accepting the current membership terms. Membership is not marketing consent.

Cultco processes your account identifier, name and email, membership acceptance, points ledger, orders and redemption choices to provide membership, calculate rewards and protect balances. The same server ledger is used on the website and app. The app shows your balance and recent activity after authentication. Guest orders do not automatically become member orders merely because their email matches.

The app keeps a random member session token and account identifier in protected device storage under cultco.member.v1. Server sessions normally expire after 30 days; email verification codes expire after 10 minutes, have limited attempts and are stored as hashes. Expired code records are removed by the daily cleanup after a further day. Member and guest baskets and recovery identifiers have separate account-specific storage keys. Balances, email codes, contact details and Stripe payment secrets are not persisted by Cultco in app storage.

You can request account deletion inside Circle after recently verifying your email. Account access is disabled immediately and the membership is frozen while Cultco completes the request. An owner reviews legal retention, external-provider records and unresolved payments, then removes the account profile and review text. We normally complete requests within 30 days, subject to applicable legal deadlines and permitted extensions. Order and financial ledger records required for legal retention remain protected under the retention criteria in this notice. A keyed, non-public email marker is retained to prevent repeat welcome bonuses. Local saved products and guest baskets remain device data that you can clear separately. Contact hej@cultco.com about a request or retained records.

Stripe in-app payments and technical data

Stripe receives card and billing details for in-app payment, including the name, email and address supplied to its payment form. Its native payment software also processes device characteristics and interactions with payment components for service improvement, payment security and fraud prevention. Authentication may involve an app-specific identifier, device information and IP address, including information sent to your card network or issuing bank. Stripe's mobile SDK guidance says its SDK analytics and fraud signals are not used for advertising. Stripe's privacy information explains its processing and roles: https://stripe.com/privacy. Technical processing can include error diagnostics and approximate location inferred from the IP address.

If Stripe offers Link and you choose to use it, Stripe may process additional contact details, such as your phone number, and Link account and saved-payment information under its terms and privacy notice. A Link account is separate from a Cultco customer account. Read more at https://link.com/privacy.

Cultco has not added Google Analytics or an advertising SDK to the native app. This does not mean the Stripe SDK performs no analytics. If you open Cultco's website, the website's privacy information and cookie choices apply there. Those website choices do not control Stripe's native payment software.

Retention and your rights

How long we keep information depends on its purpose and applicable obligations. The details below explain the retention periods or criteria we use. Closing an account does not remove records we are legally required to retain.

Subject to the applicable conditions, you may request access, correction, deletion, restriction or portability, and object to processing. You can complain to a data protection supervisory authority, including Sweden’s IMY. Contact the company using the details below; reasonable identity verification may be needed.

Newsletter and welcome offer

With your explicit consent, we send your email address, chosen language, source and consent timestamps to Omnisend for email marketing. Newsletter links expire after 24 hours and pending confirmation details are temporarily encrypted. You can unsubscribe using the link in each marketing email. Purchases and Circle membership alone do not subscribe you. We store a keyed email identifier and offer/payment records to enforce the one-use welcome offer and prevent repeat claims. Necessary consent, suppression and financial records may be retained after unsubscribe; other data is reviewed for deletion when no longer needed. This connection does not add Omnisend browser tracking. Privacy requests: hej@cultco.com.

Company and policy details

Legal company name

6FIVE AB

Company postal address

Fersens väg 6, 211 42 Malmö, Sweden

Customer service email

hej@cultco.com

Retention periods and deletion criteria

We keep information while it is needed for the purpose for which it was collected or an applicable legal obligation. Orders, payment and refund references, and withdrawal records are needed to complete purchases, handle returns and complaints, and meet applicable accounting or tax recordkeeping requirements. When those requirements and any necessary legal-claim hold have ended, the records are reviewed for deletion or anonymisation. Account details are needed while the account is used; account closure or a deletion request is assessed separately from transaction records that must be kept. Support correspondence is reviewed when the enquiry and any related complaint or claim are resolved. Brand application and staff-access information is reviewed after an application is rejected or the business relationship or access ends; only information still needed for a dispute, legal obligation or abuse prevention is retained. Security and email-delivery records are kept for investigating incidents, protecting access and resolving delivery outcomes; backups are kept for operational recovery. Their continued need is reviewed when those purposes end. These criteria do not promise a fixed automatic deletion schedule. Customer sign-in codes expire after 10 minutes; the daily application task removes code records more than one day after expiry at its next successful run. Google Analytics user/event retention is configured to 2 months without restarting that period on new activity; this setting does not limit standard aggregated reports. Browser-cookie lifetimes are listed separately in the Cookie policy. Contact hej@cultco.com to ask about retention or request deletion.

Recipients, service providers and their roles

6FIVE AB operates Cultco and remains the seller to the customer. Authorised Cultco staff, hosting and technical-support providers have access appropriate to their tasks. Approved brands and parcel carriers receive the customer contact, delivery and order details needed to fulfil the relevant brand's parcels or deal with associated returns or complaints; a brand's Cultco dashboard does not expose another brand's order details. Stripe provides website card checkout, in-app card payment and payment/refund services, acting as processor or controller depending on its activity. Cultco supplies Stripe with the order reference, total and currency, and the customer email for website checkout; Stripe collects card and other payment/security information directly, and Cultco does not store the full card number or security code. Resend delivers website service emails such as sign-in codes, order notices and staff invitations, using recipient addresses, message content and delivery records. Cultco uses Resend's Ireland sending region, but Resend stores message content, delivery logs and account records in the United States. Google Workspace supports the hej@cultco.com correspondence mailbox and processes email addresses, message content and information voluntarily included in correspondence. Google Analytics is the optional analytics provider when enabled and consented to; it receives public page paths, browser identifiers and technical visit data, including an IP address during transmission. Cultco's tag excludes private shopping/account/administration pages, strips URL query parameters and fragments, uses descriptive titles for public store pages and sends only the referring site's origin. It does not send customer names, emails, order contents or payment details to Analytics. Google Signals and advertising personalisation are disabled in the tag, advertising consent is denied and Enhanced Measurement is off for the stream. Public authorities and professional advisers may receive relevant information where a legal obligation or necessary claim-handling purpose requires it. When authorised staff request catalogue rewrites, OpenAI receives the saved English product descriptions or information sections and product/brand names. This feature does not send customer, order or payment records. Requests disable stored API responses; this is not a zero-retention guarantee, and provider security retention can still apply. Optional marketing is currently inactive. No email open or click tracking is configured for Cultco’s Resend domain. The IP-based first-visit country suggestion and optional Google Analytics described in this notice concern the Cultco website. The native app uses the delivery country you select; its separate local storage and Stripe payment processing are described in the app sections above.

International transfers and safeguards

Stripe, Resend and Google process information internationally, including in the United States. Resend stores email content and delivery records in the US even when emails are sent through its Ireland region. For transfers outside the EEA, the relevant protection depends on the recipient, destination and service. An applicable European Commission adequacy decision, including the EU–US Data Privacy Framework where the recipient and transfer are covered, may provide the transfer basis. Otherwise, safeguards can include the European Commission’s Standard Contractual Clauses and any necessary supplementary measures. The providers’ published data protection and transfer terms describe these arrangements as applicable under the relevant service agreement; they do not mean that every service or transfer is covered by the same mechanism or that all information stays in Europe. Contact hej@cultco.com for information about the safeguards relevant to your information and how to obtain a copy, subject to necessary protection of confidential information.

Purposes, lawful bases and legitimate interests

We use the name, email address, delivery details, product choices and related order information you provide to process a requested purchase, arrange payment and delivery, provide an optional account and send related service messages. The basis is performance of the purchase/account contract or steps you request before entering it. We handle returns, refunds and complaints under the relevant contract and legal obligations, and retain required accounting and tax records to comply with applicable law. Our legitimate interests support protecting the store, accounts and forms from misuse, investigating security incidents, answering general enquiries and establishing or defending legal claims, after weighing those interests against individuals' rights. We process brand-representative contact and access details to assess applications and administer business relationships on the basis of those legitimate interests; contract applies where the individual is personally a contracting party. Optional Google Analytics relies on consent and loads only after a valid analytics choice; you may refuse or withdraw it in Cookie settings without losing ordinary shopping functionality. Optional marketing requires your separate consent when a marketing service is operational; buying a product does not subscribe you. Required checkout fields are necessary to process the order and delivery, and an email is necessary for account sign-in codes and service receipts; without the relevant required information we cannot provide that function. Creating a customer account is optional. First-visit country suggestions use the request IP address against a local database, without sending it to an external geolocation lookup service; your explicit market selection takes precedence. You may request access, correction, deletion, restriction or portability where the legal conditions apply, object to legitimate-interest processing and withdraw consent without affecting earlier lawful processing. Contact hej@cultco.com; proportionate identity verification may be needed. You may complain to a supervisory authority, including Sweden's IMY. The IP-based first-visit country suggestion and optional Google Analytics described in this notice concern the Cultco website. The native app uses the delivery country you select; its separate local storage and Stripe payment processing are described in the app sections above.