Privacy Policy

1. Data Controller

The data controller responsible for the processing of your personal data is:

Viktor Sjölund, Sweden
contact@dahlialog.com

2. What data do we collect?

We only collect the data necessary to provide the service. This includes:

• Uploaded images of dahlia varieties that you choose to upload yourself
• Variety names and color information that you enter for your own varieties
• Email address when registering an account or making a payment
• Payment information is handled entirely by Stripe and is never stored by us

We do not collect sensitive personal data, location information, behavioral data, or information about third parties.

3. Why do we process your data?

We process your data for the following purposes:

• Providing the service — to display your dahlia varieties, plan your beds, and give you access to your garden planning
• Account management — your email address is used for sign-in and communication regarding your account
• Payment — your payment is handled by Stripe in accordance with their privacy policy

The legal basis for the processing is performance of a contract (Art. 6.1.b GDPR) and your consent (Art. 6.1.a GDPR) for uploading images and variety information.

4. How long do we keep your data?

• Images and variety data are kept as long as your account is active. If you close your account, all data is deleted within 30 days.
• Email address is kept as long as your account exists.
• Payment history is managed and stored by Stripe according to their own terms.

5. Is your data shared with third parties?

We share your data with a minimal number of trusted third-party providers that are necessary to operate the service:

• Stripe — for payment processing. Stripe's privacy policy
• Supabase — for data storage and authentication. Supabase is operated within the EU and complies with GDPR. Supabase privacy policy

We never sell your data to third parties and do not use it for marketing purposes.

6. International transfers

If data is transferred outside the EU/EEA, this is done only to countries or services that meet the requirements of the GDPR, for example through standard contractual clauses (SCCs) or where the recipient country is covered by an adequacy decision from the European Commission.

7. Your rights

Under the GDPR, you have the following rights:

• Right of access — you can request a copy of the data we hold about you
• Right to rectification — you can request that inaccurate data be corrected
• Right to erasure — you can request that your data be deleted ("the right to be forgotten")
• Right to data portability — you can request to receive your data in a machine-readable format
• Right to object — you can object to certain processing of your data
• Right to withdraw consent — if processing is based on consent, you can withdraw it at any time

To exercise your rights, contact us at: contact@dahlialog.com

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY): www.imy.se

8. Cookies

We only use necessary cookies to keep you signed in and to ensure the service works correctly. We do not use any tracking or marketing cookies.

9. Security

We take technical and organizational measures to protect your data against unauthorized access, loss, or misuse. All communication takes place over encrypted HTTPS connections.

10. Changes to this policy

We may update this privacy policy. In the event of material changes, you will be notified by email or through a clear notice within the service. The latest version is always available on the website.

11. Contact

Viktor Sjölund, Sweden
Email: contact@dahlialog.com
Website: dahlialog.com