Privacy Policy
Last updated · 22 August 2026
Kartique is an edited directory of second-hand, vintage and antique sourcing spots in the Nordics. This notice explains how we handle personal data in line with Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") and, for cookies and similar technologies, Directive 2002/58/EC (the ePrivacy Directive) as implemented in Sweden by the Electronic Communications Act (lag om elektronisk kommunikation, 2022:482).
1. Who is the controller
Kartique, Sweden, is the data controller for the personal data described here. You can reach us for any privacy matter at lana@kartique.co. We are not required to appoint a Data Protection Officer, so privacy requests are handled directly by the editor.
2. What data we process
Account data: email address, password hash (held by our authentication provider, never by us in readable form), display name, username, optional bio and whether you made your profile public.
Activity data: spots you save, sourcing trips and stops you create, submissions and feedback you send us, and places you import from a Google Takeout file you upload yourself.
Newsletter data: your email address, subscription status and unsubscribe token, plus delivery logs (sent, failed, retried) for the emails we send you.
Technical data: limited server and error logs needed to keep the site working and secure. We do not run advertising or cross-site tracking, and we do not sell personal data.
3. Why we process it, and on what legal basis
To provide your account, saves and trips · performance of a contract with you (Article 6(1)(b) GDPR).
To send the Scouted newsletter and email notifications you opted into · your consent (Article 6(1)(a) GDPR). You can withdraw consent at any time from your notification settings or the unsubscribe link in any email; withdrawal does not affect mailings already sent.
To review spot submissions and feedback, keep the directory accurate, prevent abuse and secure the service · our legitimate interests (Article 6(1)(f) GDPR), balanced against your rights.
To meet legal obligations such as responding to data subject requests · Article 6(1)(c) GDPR.
4. Cookies and local storage
We use strictly necessary cookies and browser storage to keep you signed in and remember interface state. These are exempt from consent under the ePrivacy rules because the service cannot function without them. We do not set advertising or analytics profiling cookies. You can clear them in your browser at any time, which will sign you out. Our Cookie Policy lists each cookie, what it does and how long it lasts.
5. Processors and recipients
We use a small number of service providers that process data on our instructions under Article 28 GDPR data processing agreements: our hosting and database provider, our transactional email provider, and the AI provider used to generate hotel suggestions for trip cities (which receives city and trip context, not your identity). Editorial content is drafted in Notion. We do not disclose your data to anyone else except where legally required.
6. International transfers
Data is hosted in the EU/EEA where our providers offer it. Where a provider processes data outside the EEA, the transfer relies on the European Commission's Standard Contractual Clauses or an adequacy decision under Chapter V GDPR, together with additional technical safeguards such as encryption in transit and at rest. You can ask us for details of the mechanism used.
7. How long we keep it
Account, saves and trip data are kept while your account exists and deleted when you delete it. Newsletter records are kept until you unsubscribe, after which we retain a minimal suppression record so we do not email you again. Email delivery logs are kept for up to 12 months. Spot submissions may be retained in the directory in non-personal form as editorial content.
8. Your rights
Under Articles 15 to 22 GDPR you have the right to access your data, to rectification, to erasure ("right to be forgotten"), to restriction of processing, to data portability, to object to processing based on legitimate interests, and to withdraw consent. You are not subject to decisions based solely on automated processing that produce legal effects for you.
You can exercise most rights yourself: edit your profile and notification preferences in Settings, or delete your account there to erase your data. For anything else, email lana@kartique.co and we will respond within one month, as required by Article 12(3) GDPR.
9. Complaints
If you believe we have handled your data unlawfully you may lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, or with the supervisory authority in your EU country of residence, under Article 77 GDPR.
10. Children
Kartique is not intended for children. We do not knowingly create accounts for anyone under 16, the age threshold applied for consent in Sweden under Article 8 GDPR.
11. Changes
If we change how we handle personal data we will update this page and, for material changes, notify subscribers by email. See also our Terms of Service.