Privacy notice

Information we use

We use the contact and delivery details you provide at checkout, order and payment status, account and security records, payout destination details, box settings and usage records, and records of your interactions with the website. We store payout destinations encrypted. Card payment fields are provided by Revolut; our server records the resulting order and payment status rather than your payment card number.

Why we use it

We use this information to take and fulfil orders, manage your account and box, calculate earnings and process payout requests, and answer support requests. We also use necessary records to prevent fraud, protect the service, and meet accounting and legal obligations. Campaign measurement may record visits and completed orders; where advertising integrations are enabled, campaign events may be sent to the configured platform.

If you accept marketing tracking, this campaign's selected advertising platform may receive visit, checkout and verified purchase events through its browser pixel and, where connected, a server conversion API. These events can include an ad click ID, IP address, browser information, purchase value and currency. During checkout or for confirmed purchases, we may also send SHA-256 hashes of your checkout email and phone number to the selected platform for conversion matching. We discard queued matching data after delivery or within seven days. You can change your choice through Cookie settings.

When Google Ads measurement is configured, its tag runs on the public storefront and checkout only after consent, alongside any selected campaign pixel. It measures page visits and checkout starts, and sends verified purchase events with their value, currency and an order reference, including purchases reached through the homepage. Advertising personalisation is disabled. OBELUS does not send checkout email or phone data to Google Ads through this integration.

When LinkedIn tracking is configured, its Insight Tag loads on storefront and checkout pages only after marketing consent. It measures page visits and, when configured, checkout starts and confirmed purchases using conversion IDs and an order reference. This integration does not send checkout email or phone details to LinkedIn. See LinkedIn’s privacy policy.

Our legal bases are performance of your contract, compliance with legal obligations, and our legitimate interests in operating and securing the service. Where consent is required for optional tracking, we must obtain it before enabling that tracking.

When Microsoft Advertising measurement is configured, its Universal Event Tracking (UET) tag loads on storefront and checkout pages only after advertising consent. Microsoft receives page visits, checkout starts and confirmed purchase events, including the purchase value, currency and order reference. This integration does not send checkout email or phone details to Microsoft. Microsoft uses tag data for advertising measurement and its own services. See Microsoft’s privacy statement.

Website analytics

We measure anonymous statistics from the start of landing and checkout pages to improve the website. These include time on pages, active time while the page is visible and focused, scroll depth, device category, button clicks, calculator use, FAQ opens and checkout steps. Click and scroll maps use coarse click/tap positions and section reach counts, grouped by page version, language and screen size. We record which delivery fields were used or need correction, without their values. Analytics never include payment card fields. These records produce daily aggregate reports accessible only to our administrators and are not shared with advertising partners. We do not link these measurements to visitors, accounts, orders or advertising identifiers. Temporary page counters prevent duplicate counting and are deleted after 24 hours of inactivity; aggregate reports are kept for 90 days. You can turn off anonymous website statistics in Cookie settings. We remember only that preference; measurements do not create a persistent visitor cookie.

Unfinished checkout

As you fill in checkout, we save the contact and delivery fields you enter, your selected product options, campaign source, checkout progress and error categories. This lets you resume checkout and helps us investigate problems and contact you about an unfinished checkout where permitted. These drafts are available only to our administrators and are deleted after 30 days of inactivity. Payment card fields are never included. Entering an email does not subscribe you to marketing. Completed order records are kept separately.

Service providers

We use Revolut for payments, Hostinger for account email, hosting and database providers for the service, and a separate device service for box communication. GeoLite2 Country data from MaxMind may suggest a suitable plug based on your approximate country.

If Google address lookup is enabled, the address you type into its search field is sent to Google to return suggestions. You can enter an address manually instead. Google’s Maps terms and privacy policy apply to that feature.

Retention and your choices

We keep records while needed to provide the service and for applicable accounting, legal, dispute and security obligations. The period depends on the type of record and the applicable obligation. To request access, correction or deletion of your information, or to object to an eligible use, email hello@obelus.fi. Some records must be retained where the law requires it.

You can also complain to the UK Information Commissioner’s Office or your local data-protection authority. Essential account cookies keep you signed in; optional advertising measurement is off unless you accept it.