Privacy policy

Last updated: October 23, 2026.

Who we are

This site is run by Calebesa Group AB ("Calm by Astrid", "we"), company registration number 559519-7137, Bokvägen 1, 169 33 Solna, Sweden. We decide how your personal data is used and are responsible for it. Questions or requests: hello@calmbyastrid.com.

What we collect

• When you order: your name, email address, delivery and billing address, phone number if you give it, and what you bought. Your card details go straight to the payment provider; we never see or store your card number.
• When you sign up for emails or texts: your email address or phone number, and the choices you made.
• When you write to us: your message and contact details.
• When you browse: your device and browser type, IP address, the pages and products you look at, what is in your cart, and how you came to the site. This is collected with cookies and similar technologies, and only the necessary ones run until you have made a choice in the cookie banner where one is shown.

Why we use it, and on what legal ground

• To take payment, deliver your order, and handle returns, warranty and customer service: our contract with you.
• For bookkeeping and tax records: a legal obligation.
• For marketing emails and texts in the EU, and cookies for statistics and advertising: your consent, which you can withdraw at any time.
• For reminders about a cart or checkout you left: in the EU, your consent. In the United States, our legitimate interest in completing a sale you started; every message has an unsubscribe link.
• To prevent fraud, keep the site secure and improve the shop: our legitimate interest.

How we see how the site is used (Microsoft Clarity)

We use Microsoft Clarity to see how visitors use our site, so we can make it easier to use. Clarity captures how you move through our pages, such as clicks, taps, scrolling and mouse movements, and shows it to us as heatmaps and as replays of visits (session replays). It never captures what you type into forms. Clarity uses first-party cookies (_clck, _clsk) to link the pages of one visit, and Microsoft's own cookies (such as MUID, which Microsoft also uses for advertising and site analytics).

If you are in the EU, EEA or UK, Clarity sets no cookies until you accept performance cookies in our cookie banner. Until then it only sees page views and basic interactions, each page on its own: it does not link the pages of your visit together or replay your whole visit.

For more about how Microsoft collects and uses your data, see the Microsoft Privacy Statement.

Text message marketing

By providing your phone number and opting in (for example through a pop-up on the Site), you consent to receive recurring automated marketing text messages from Calm by Astrid, sent through our SMS provider, to the number you provided. Opting in is not a condition of purchase — you can complete a purchase without doing so. You are responsible for any charges from your wireless carrier; message frequency varies, and message and data rates may apply. Reply STOP at any time to cancel, or HELP for support. You can also withdraw your consent by contacting us using the details below.

We use your phone number only to send the marketing text messages you have consented to, to personalise those messages (for example with the items in your cart), and to manage your consent — including honouring opt-outs. We share it with our email and SMS service provider, Klaviyo, which sends the messages on our behalf, and with the telecom carriers needed to deliver them. We do not sell or rent phone numbers, and we do not use them for any purpose unrelated to the messaging programme you signed up for.

The full terms of our text message programme — message types, frequency, costs, eligibility, and how to opt out — are set out under Mobile terms of service in our Terms of Service.

Who we share it with

We do not sell your personal data. We share it only with companies that help us run the shop, and only what they need:

• Shopify (the store, checkout and payments)
• The payment provider you choose at checkout
• Our delivery carriers and Track123 (order tracking)
• Klaviyo (emails and text messages)
• Meta and Google (advertising and statistics, only with your consent in the EU), through WeTracked
• Microsoft (Clarity: how visitors use the site)
• Judge.me (product reviews)
• Pandectes (remembering your cookie choice)

We also share data when the law requires it.

Text messaging opt-in data and consent are never shared with third parties for their own marketing.

Transfers outside the EU

Some of these companies are in the United States or Canada. When your data is sent outside the EU/EEA, it is protected by the EU-US Data Privacy Framework, an adequacy decision of the European Commission, or the Commission's standard contractual clauses.

How long we keep it

• Order and payment records: for as long as accounting and tax law requires, normally seven years.
• Marketing contact details: until you unsubscribe, and then only what we need to remember that you did.
• Customer service messages: for as long as we need them to handle your matter and any warranty or legal claim that may follow, normally up to three years after your last message.
• Browsing data: as long as the cookie lasts.
• Recordings of visits in Microsoft Clarity: 30 days. Heatmaps and click statistics: 9 months.

Cookies and your choices

In the EU we ask before using cookies for statistics and advertising. To change your choice later, clear this site's cookies in your browser and you will be asked again, or write to us and we will help. Elsewhere, you can opt out of targeted advertising on our Your privacy choices page. We honour the Global Privacy Control signal from your browser.

Your rights

If you are in the EU, EEA or UK you can ask us for a copy of your data, to correct or delete it, to limit or object to how we use it, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. Write to hello@calmbyastrid.com and we answer within one month. You can also complain to the data protection authority in the country where you live.

If you live in a US state with a privacy law, such as California, you can ask what personal information we hold, ask us to delete or correct it, and opt out of the "sale" or "sharing" of personal information and of targeted advertising on our Your privacy choices page. We will not treat you differently for using these rights.

Children

We do not knowingly collect personal data from children under 13. If you believe a child has given us their data, write to us and we will delete it.

Security

We use reasonable technical and organisational measures to protect your data. No method of storage or transmission is completely secure.

Changes

We update this policy when our practices or the law change. The date at the top shows the latest version.