Legal
Privacy Policy
Last updated: 19 July 2026
Folke ("we", "us") is an SMS campaign platform operated from Sweden. This policy explains how we handle personal data under the EU General Data Protection Regulation (GDPR) and Swedish law. Questions? Contact us at [email protected].
1. Our two roles
- Controller. For data about you as a Folke user — your account, login, and billing details — we decide how and why the data is processed.
- Processor. For the customer data our business customers ("tenants") upload to Folke — recipient lists, phone numbers, consent records, message history — the tenant is the controller and we process the data only on their instructions, under a data processing agreement. If you are a message recipient and want your data corrected or deleted, contact the business that sent you the message; we will assist them.
2. What we process
| Category | Examples | Role |
|---|---|---|
| Account data | Name, email address, login credentials | Controller |
| Tenant customer data | Recipient name, phone number, country, consent status, opt-outs (STOP), message and delivery history | Processor |
| Campaign engagement data | Short-link click time, country, device category, referring website domain, and the link, campaign, message, and delivery associated with a click | Processor |
| Order and conversion data | Shopify customer and order identifiers, order date, financial status, value, line-item count, and the attribution record that connects an eligible order to a sent campaign delivery | Processor |
| Usage and log data | IP address, timestamps, actions taken in the service | Controller |
Campaign engagement data is collected when a person follows a Folke-owned short link. We record the time of the click and limited technical/context data: country (when supplied by the network), device category (mobile, tablet, or desktop), and the referring website's domain. We do not store the full referring URL, IP address, precise location, browser fingerprint, or user-agent string in the short-link click record. When a click contains a valid recipient-specific link token, we connect it to the relevant sent delivery so the tenant can measure campaign engagement; otherwise it remains an unattributed link click.
Where a tenant connects Shopify, we maintain its customer and order data and use eligible paid-order activity within the tenant-configured attribution window to measure campaign conversions and revenue. An attribution record connects an order to at most one previously sent delivery. Cancellation and refund activity may update the associated conversion and revenue measurement.
We do not sell personal data, and we do not use tenant customer data for our own purposes.
3. Why, and on what legal basis
- To provide the service (accounts, sending campaigns, support) — performance of a contract (Art. 6(1)(b) GDPR).
- To keep the service secure and reliable (logs, abuse prevention) — legitimate interest (Art. 6(1)(f)).
- To meet legal obligations (accounting, lawful requests) — legal obligation (Art. 6(1)(c)).
- Tenant customer data — processed solely on the tenant's documented instructions.
4. Sharing and transfers
We share data only with the subprocessors needed to run the service, each bound by data processing terms:
| Subprocessor | Purpose |
|---|---|
| 46elks AB (Sweden) | SMS delivery |
| Hetzner Online GmbH (Germany) | Server hosting |
| Exe.dev | Application infrastructure |
Data is stored within the EU/EEA. If a transfer outside the EU/EEA is ever required, we rely on an adequacy decision or the EU Standard Contractual Clauses. We will update this list before adding or replacing a subprocessor.
5. Retention
- Account data: kept while your account is active, then deleted or anonymised within 90 days of closure, unless law requires longer (e.g. the Swedish Bookkeeping Act).
- Tenant customer data: retained as instructed by the tenant and deleted when the tenant deletes it or the agreement ends.
- Logs: kept for up to 12 months.
6. Your rights
Under the GDPR you may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. Contact [email protected] to exercise these rights. You may also lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) — imy.se — or your local supervisory authority.
7. Security
We protect personal data with per-tenant data isolation, encryption in transit, access controls, and logging. Access to personal data is limited to those who need it to operate the service.
8. Changes
We may update this policy and will post the new version here with a revised date. Material changes will be announced to account holders by email or in the service.