Privacy policy

The scope of this notice

This notice covers the MARLIN store at wearmarlin.com. KVAMME KI, Norwegian organisation number 937 858 582, Furnes 23, 5960 Dalsøyra, Norway, is the controller responsible for personal information handled by the MARLIN store. Contact elias@wearmarlin.com for privacy questions or to exercise your rights.

Stripe handles payment at checkout. Our production and fulfilment partner provides production and fulfilment services. Their involvement does not remove the seller’s responsibility for your purchase or for the personal information it controls.

When you browse

The storefront uses your approximate country to suggest a currency, with your browser language as a fallback. You can change that choice at any time. This does not require access to your precise location.

Your browser sends technical information, such as a network address, requested page and browser information, when it connects to the site. OpenAI Sites hosts the store and processes this information to deliver the page and support the security and reliability of the store.

The storefront currently has no advertising pixels, third-party analytics or newsletter sign-up.

Optional website analytics

MARLIN asks before using first-party analytics cookies. Allowing analytics records page and product views, additions to your bag, visits and session activity. Limited information includes device category, approximate country when available, referring website hostname and campaign labels. Raw network addresses, full referring URLs, payment details and account identities are not stored in these analytics records. Signed, random browser identifiers are represented by protected hashes in the store’s Supabase database.

The analytics preference and browser cookie lasts up to 30 days. A session cookie expires after 30 minutes without measured activity. You can decline or withdraw using Analytics preferences in the footer. Declining clears the analytics cookies and stops future browser tracking and new purchase attribution to your previous analytics identifier. Previously collected records remain in reports. A new permission creates a new browser identifier after withdrawal.

Verified payments, refunds, successful sign-ins and newly created checkout sessions are also counted separately to operate and report on the store. These operational counts do not depend on optional browser tracking. Order amounts include the actual currency and discounts. The authorised administrator can view aggregate reports; analytics access is restricted to that verified admin account.

Your bag and shopping preferences

Your guest bag is saved on this browser so it remains available when you return to the collection. It remains until you remove its items or clear this website’s browser storage.

Your currency preference is stored in your browser until you change it or clear the site’s stored data. Your Women or Men shopping preference is also stored on this browser to show your chosen edit. You can change it in the header or clear it with this website’s browser storage. These settings support the shopping features you use; they are not used to build an advertising profile. Blocking browser storage may prevent the store from remembering them.

Customer accounts

You can create an account with an email address and password. Supabase provides the account and database services. Passwords are handled by its authentication service; the storefront does not store your plaintext password. Resend sends account confirmation and password reset messages.

An account lets you save selected products, sizes and quantities across devices, and view paid orders placed while signed in. These features use your account identifier, order details and protected session cookies. The saved bag does not store payment card details, delivery tax identifiers or your delivery address. Payment details remain with Stripe.

Google sign-in

When enabled, Google sign-in is an optional way to create or access your MARLIN account. Google asks for your permission to share your Google account identifier, email address and basic profile information, such as your name and profile picture. Supabase processes this information to authenticate you and stores the associated identity and profile information. MARLIN uses your verified account identifier and email address to provide sign-in, a saved bag and order history.

MARLIN requests only basic sign-in permissions, with no access to your Gmail messages, Google Drive files or contacts. Google account information is not used for advertising or sold. Protected session cookies keep you signed in. Google login credentials stay with Google.

You can remove MARLIN’s access in your Google Account connection settings. Removing that connection does not automatically delete your MARLIN account or order records. Contact elias@wearmarlin.com to request account deletion or ask about account information. Order records may still need to be retained for the obligations described below.

When you request a delivery quote

You provide the recipient’s name, complete address and any contact details needed for delivery. For Brazil, a valid recipient CPF or numeric CNPJ is also required. The delivery details and selected items are sent to our production and fulfilment partner to check availability and calculate a live delivery charge before payment.

A protected, encrypted copy of the delivery instructions is linked to the payment so the recipient used for fulfilment matches the quote. A CPF or CNPJ is kept encrypted in that payment record and is shared with our production and fulfilment partner where required for delivery; it is not included in the plain payment details sent to Stripe. It is not part of your saved bag or currency preference.

When you place an order

Checkout requires the information needed to take payment and arrange delivery: the products and sizes selected, order amount, recipient’s name, contact information, delivery address, any required delivery tax identifier and payment information. Stripe receives the name, delivery address and any supplied phone number as part of the payment details. Without the necessary details, we cannot complete the purchase or deliver the order.

You enter payment details on Stripe’s hosted checkout. The MARLIN storefront does not receive your full payment card number. Payment confirmations and order details are used to identify the purchase and arrange fulfilment.

Information needed to make and deliver your items is shared with our production and fulfilment partner, including the recipient’s name and address, selected products and relevant order details. Delivery providers receive the information needed to deliver the parcel.

When MARLIN sends a purchase confirmation, Resend receives your checkout email address and the order information included in that message: the selected products, sizes, paid amounts and currency, delivery address, agreed delivery information and purchase terms. The store keeps a private confirmation record in Supabase to prevent duplicate sending and review delivery problems. Payment card details and delivery tax identifiers are excluded from this message.

Why information is used

Order and delivery information is used to perform the purchase agreement and to take the steps you request before entering it. Information needed for accounting or other legal duties is handled to meet those obligations.

Limited technical information is used to operate and protect the store, based on the legitimate interest in providing a reliable, secure service. This interest must be balanced against your privacy rights. Information is not automatically available for unrelated marketing simply because you place an order.

How long information is kept

Your guest bag, currency preference and shopping edit remain in your browser until you change or clear them. Account information and saved account bags remain while the account is used; signing out does not delete the account or its database records. You can request account deletion by contacting elias@wearmarlin.com.

Records needed for Norwegian bookkeeping are normally kept for five years after the end of the financial year concerned. Relevant order, payment, delivery, complaint and affiliate payout records may be retained longer where an applicable legal duty, unresolved claim or investigation requires it. Other enquiry and delivery information is kept only while needed to complete delivery, resolve the enquiry or complaint, or establish, exercise or defend a legal claim.

The 30-day analytics and referral cookie periods describe browser storage, not an automatic deletion deadline for previously collected database records. Pseudonymous analytics events and sessions remain in the store database to compare store traffic and purchases and investigate reporting errors. Withdrawal of analytics permission stops future browser tracking; it does not automatically erase earlier records. Retention is assessed against those reporting purposes, and you can ask about access, objection or erasure using the privacy contact above.

Service providers may retain information for their own payment, fraud prevention, security or legal obligations. Their privacy and processing information is linked below. Removing your MARLIN account cannot remove records that must be retained to meet a legal obligation.

Service providers and international processing

MARLIN uses Supabase for accounts and the store database, Stripe for checkout and payments, a production and fulfilment partner, Resend for account and password reset messages and any MARLIN purchase confirmation, and OpenAI Sites for website hosting. Google processes information when you choose Google sign-in. Delivery carriers receive the information needed to deliver your parcel.

The MARLIN Supabase project's primary region is Stockholm, Sweden (eu-north-1). This describes the project's primary database and authentication region; it does not mean that every provider, support operation, backup or delivery facility is located in the European Economic Area.

These services operate internationally, and information can be processed outside the European Economic Area, including in the United States and the countries where production or delivery takes place. The published processing agreements for Supabase, Resend, our fulfilment partner and Stripe provide for safeguards such as European Commission Standard Contractual Clauses where applicable. You can contact elias@wearmarlin.com for information about the safeguards relevant to your data.

You can read the providers' information directly: Supabase processing agreement (Supabase Pte. Ltd), Stripe Privacy Center, Resend processing agreement (Plus Five Five, Inc.), OpenAI privacy information, and Google privacy information.

Your choices and rights

Depending on the circumstances, you may ask to access or correct your information, have it deleted, restrict its use, or receive a portable copy. You may also object to processing based on legitimate interests. Some records must still be retained to meet legal obligations or establish, exercise or defend a legal claim.

For privacy requests, contact elias@wearmarlin.com. Reasonable identity verification may be necessary before personal information can be released or changed.

You can raise a concern with the Norwegian Data Protection Authority, Datatilsynet. You may also contact the supervisory authority where you live or work, where applicable.

Changes to this notice

This notice will be updated when the store’s services or data handling change. The date at the top identifies the current version. A material change will be brought to your attention where required.

Affiliate program

Affiliate applications use a verified MARLIN account. We store the account identity, name, country, channel URL, application text, accepted program terms, approval status, referral code, commissions and payout history in the store’s Supabase database. The authorised MARLIN administrator reviews these records. Affiliates see their own records without customer contact details or addresses.

When you follow an approved referral link, we ask before setting a referral cookie. If allowed, it lasts up to 30 days in that browser and credits the first eligible affiliate link. Declining clears any MARLIN referral cookie. Account and payment cookies operate separately. Details are in the affiliate terms. For questions about affiliate records, contact elias@wearmarlin.com.