Privacy policy

When you use sanneandersen.dk — book a treatment, buy a punch card, or sign in to your account — we process some personal data about you. This page explains what, why, and how to get rid of it again.

Data controller

Sanne Andersen Klinik & Skole
Frederikstadvej 16, 1. sal
9200 Aalborg SV, Denmark
CVR: 38214490
Contact: mail@sanneandersen.dk

What we process

• Account info: email, name, phone (if provided), shipping address (only for physical product orders).
• Booking data: date/time, treatment type, optional notes.
• Purchases and payments: orders, punch card balances, gift cards, subscriptions. Card data is handled by Stripe — we only see confirmations and last-4 digits.
• Eir conversations: if you've talked with Eir (our AI assistant), we store the conversation so you can find it again. You can delete them anytime from My account.
• Newsletter subscription: email + preferences if you've opted in.
• Sign-in methods: if you've connected a Google account, we store Google's user ID and email so we can recognise you next time.
• Technical data: IP and browser info on sign-in attempts (security only).

Why we process it

• Contract (GDPR art. 6.1.b) — to deliver the treatments and courses you've booked or purchased.
• Legal obligation (art. 6.1.c) — bookkeeping under Danish law (5 years).
• Consent (art. 6.1.a) — newsletter and optional Eir features. Withdrawable anytime.
• Legitimate interest (art. 6.1.f) — protecting against sign-in abuse and spam.

How long we keep it

• Account data: as long as your account exists + 5 years after last purchase (bookkeeping).
• Booking history: 5 years (bookkeeping).
• Eir conversations: until you delete them, or until the account is deleted.
• Newsletter data: until you unsubscribe + 30 days to process the unsubscribe.
• Sign-in attempt log: 90 days (security).

Who we share with

We never sell data. We use these processors:

• Stripe (USA, EU-approved) — payment processing.
• Resend (USA, EU-approved) — email delivery (sign-in links, confirmations, newsletter).
• Fly.io (Sweden, EU) — server hosting.
• Google (USA, EU-approved) — only if you use "Sign in with Google".

Your rights

You have the right to:

• Access — download a copy of all your data from My account → "My data".
• Rectification — update your contact details on My account.
• Erasure — delete your entire account from My account → "Delete account". Bookkeeping data is retained anonymised.
• Restriction and objection — contact mail@sanneandersen.dk.
• Data portability — the GDPR export is JSON and can be imported elsewhere.
• Complaint — you may complain to the Danish Data Protection Agency if you believe we mishandle your data.

Cookies

We only use technical cookies necessary for the site to work (sign-in session, language choice, shopping cart). No tracking cookies, no third-party advertising.

Changes

If this policy changes, the date at the top is updated. Material changes are communicated by email to account holders.