Privacy Policy

Published 28 October 2026

This policy explains what personal data GetSize AB collects when you use getsize.shoes, our API and our other services, why we collect it, and what your rights are. GetSize AB, organisation number 559533-7279, Hantverkargatan 10, 112 21 Stockholm, Sweden, is the controller of that data. Write to hello@getsize.shoes with any question or request about it.

1. What you give us

• Your account. Your email address, your password (stored hashed), and the date you accepted our Terms.
• Shoe racks. The shoes you tell us fit you, with brand, model and size, and any foot measurement you enter in millimetres. You can keep more than one shoe rack, and you name each one however you like, for example "My hiking shoes". If you use a person's name, that name is personal data you have chosen to give us.
• Racks for children. If you keep a shoe rack for a child, you can give it a birth month and year, which we use to size that rack against the right charts and to project foot growth.
• Community requests and comments. What you write there is published on the site and visible to everyone, along with the display name on your account.
• Developer API. If you use our API, we keep your plan, your API keys (stored hashed), how many requests each key makes per day, and a history of the changes to your plan and keys, which you can see in your account.
• Payments. Paid plans are sold by Stripe, trading as Link. Link collects your card details, billing address and any VAT or tax number, and we never see your card details. Link tells us your customer and subscription references, whether each payment went through, and each invoice's number and amount, with a link to it. When you buy a plan, we also record that you confirmed you were buying for a business.
• Messages to us. If you email us, report content or send feedback, we keep what you send us and what we reply.

2. What we collect automatically

• Page views. We record the page, the referring page, any campaign parameters in the link, your device type, your browser's user agent string, and a country derived from your IP address. We do not store your IP address.
• Necessary cookies. A login session cookie, a sign-in cookie that keeps you signed in for 90 days or until you sign out, a cookie that remembers your language, and one that remembers your cookie choice. A visitor_id cookie, which is a random identifier that lets us remember a shoe rack for someone who is not signed in. It is set when you first use a feature that has something to remember, lasts 180 days, and cannot be read by scripts.
• Analytics cookies. Google Analytics is loaded only if you accept analytics cookies, and you can change your choice at any time on the site. If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as a refusal of analytics cookies and do not ask.
• Bot protection. On the sign-up page and on the page that takes you to a shop, Google reCAPTCHA checks that you are a person and not a bot. Google receives your IP address, details of your browser and how you use the page, and sets its own cookies. Google handles this data under its own privacy policy.
• Shops and affiliate networks. We do not set affiliate cookies ourselves. When you follow a link to a shop, the affiliate network (Awin or Prisjakt) and the shop may set their own cookies to record that you came from us, under their own privacy policies.

3. Why we use your data, and on what legal basis

• To provide the Service you signed up for: your account, your shoe racks and size recommendations, sharing, the API and its plans, and emails about your account such as password resets and plan changes. Legal basis: our agreement with you.
• To take payments and keep our books. Legal basis: our agreement with you, and the Swedish Bookkeeping Act for the records we must keep.
• To improve recommendations for everyone. The sizes people report are what our recommendations are built from. Two people who take the same size in the same shoes probably take the same size in a third, and that comparison is the service. Your reported sizes are used for this only in aggregate, without your name or email. Legal basis: our legitimate interest in giving accurate recommendations, which you can object to.
• To notify you about what you follow, such as replies to your comments and updates on your shoe requests, on the site and by email. Legal basis: our legitimate interest in keeping you informed. You can turn notifications off at any time in your account.
• To understand how the site is used, keep it secure and working, and stop abuse, including page view statistics, bot protection and rate limits. Legal basis: our legitimate interest in running a secure and reliable service.
• To measure the site with Google Analytics. Legal basis: your consent, given through the cookie choice.
• To answer your messages, handle reports of content, and comply with the law, including requests from authorities and enforcing our terms. Legal basis: our legitimate interest in helping you and running the Service, and our legal obligations.
• Size recommendations are calculated automatically, but they are only suggestions. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

4. Who we share it with

We do not sell your personal data, and we do not share it for targeted advertising. We share it only in these cases:

• People you share a shoe rack with. If you share a rack, whoever accepts the link can see the shoes in it, its foot measurement and the sizes we recommend for it, and they can see the email address of the account that shared it. You can see the email address of anyone holding access. They cannot change what is in the rack and they cannot pass it on. You can remove their access at any time.
• Developers using our API on your behalf. Our public API lets a developer create a sizing session and add shoes and measurements to it. If you use a product built on our API, that developer sees the data in the session they created for you, and their own privacy policy governs what they do with it.
• Providers that process data for us, under an agreement that lets them use it only to provide their service to us: Heroku (Salesforce) and JawsDB for hosting and our database, Resend for sending email, Google for Google Analytics, and the provider of our email inbox.
• Companies that decide for themselves how they use data, under their own privacy policies: Stripe, trading as Link, which sells paid plans and takes payments (we send it your email address and an account reference when you start a purchase); Google for reCAPTCHA; and Awin and Prisjakt when you follow an affiliate link.
• Authorities and legal claims. When the law requires it, or to establish, exercise or defend a legal claim.
• A buyer of our business. If GetSize is merged or sold, your data passes to the new owner, who must respect this policy.

5. Transfers outside the EU and the UK

• Some of these companies are based in the United States or process data there, including Salesforce (Heroku), Google, Stripe and Resend. When personal data leaves the EU, the EEA or the UK, we rely on the company's certification under the EU-US Data Privacy Framework and its UK Extension, or on the European Commission's standard contractual clauses, with the UK addendum for UK data. You can ask us for a copy of these safeguards.

6. How long we keep it

• Your account, your shoe racks and your API history are kept until you delete the account.
• Sizes reported by people who are not signed in are linked to a browser identifier that expires after 180 days. A sizing session created through our API stops working seven days after it is made. Page views are deleted after 90 days.
• When you delete your account, we delete it together with your shoe racks, measurements, shares, preferences, notifications, votes, API keys, usage, plan and billing details. Comments you wrote are replaced with "[deleted]" so that replies from others still read, and shoe requests you filed are kept without your name. Size recommendations and clicks to shops stay in our statistics, anonymised.
• Reported sizes and measurements remain part of the anonymised aggregate our recommendations are built from. Once the link to you is removed, that aggregate is no longer personal data and cannot be reversed.
• Records of payments are kept for seven years, as the Swedish Bookkeeping Act requires. Messages you send us, and reports of content, are kept as long as we need them to deal with the matter and any follow-up.

7. Your rights

Depending on where you live, the GDPR, the UK GDPR or other privacy laws give you the right to:

• see the personal data we hold about you and get a copy of it;
• have it corrected if it is wrong. You can change your shoe racks, shoes and measurements yourself at any time;
• have it deleted. You can delete your account yourself at any time, or ask us by email;
• receive the data you gave us in a machine-readable format, to take it elsewhere;
• ask us to restrict how we use it while a dispute about it is resolved;
• object to how we use it on the basis of our legitimate interest, including in the aggregate recommendations;
• withdraw your consent to analytics cookies at any time on the site. Withdrawing does not affect what was done before.

8. How to exercise your rights

• To exercise any of these rights, email hello@getsize.shoes. We answer within one month, and we may ask you to confirm that the account is yours.
• If you are unhappy with how we handle your data, you can complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (imy.se), or to the data protection authority where you live. In the UK, that is the Information Commissioner's Office (ico.org.uk).
• If you live in a US state with a privacy law, you can ask us to tell you what we hold, correct it or delete it, as above, and we will not treat you differently for doing so. We honour Global Privacy Control signals.

9. Security

• Passwords and API keys are stored hashed, and an invite link to a shared rack is stored as a hash, so a copy of our database would not give anyone working links or keys. Only GetSize staff with an administrator account can see account details, and the changes they make are logged. No online service can guarantee complete security, and if a breach puts your data at risk, we tell you and the authorities as the law requires.

10. Children

• You must be 16 or older to have an account. We do not knowingly collect personal data directly from children under 16.
• Our Service is built partly for parents buying shoes for their children, so you can keep a shoe rack for a child and give it a birth month and year. When you do, you are giving us data about your child, and you are telling us that you are their parent or guardian. We never ask for a child's full date of birth, address or contact details.
• If you believe a child has given us personal data directly, write to us and we will delete it.

11. Changes to this policy

• We may update this policy. The date at the top shows when this version was published, and earlier versions are listed below it. If a change matters to you, we email you before it applies.

12. Contact us

If you have a question about this policy, or want to exercise your rights, contact us at:

GetSize AB
Organisation number 559533-7279
Hantverkargatan 10
112 21 Stockholm
Sweden
hello@getsize.shoes

Version history

• 7 November 2026 (current)
  What we receive when you use GetSize through an AI assistant, with or without an account, how long it is kept, and our current hosting and network providers.
• 28 October 2026
  The legal basis for each use of your data, the companies we share it with, all your rights, and how we treat privacy signals from your browser.
• 27 October 2026
  Adds the developer API, payments through Link, and what deleting an account removes.