Data controller
The data controller for OutdoorPrice is Dom som AB, a company registered in Sweden (org. nr 559576-9984). You can contact us at [email protected].
What we collect
OutdoorPrice is designed to minimise data collection. We collect:
- Analytics data (consent required): page views, click events (e.g. retailer clicks, category clicks), referrer information, and search queries. This data is only collected if you accept analytics via the cookie consent banner. IP addresses are cryptographically hashed before use and are never stored in raw form.
- Newsletter subscriptions: if you sign up for our newsletter, we store your email address. We use double opt-in — you must confirm your email before we consider you subscribed. You can unsubscribe at any time via the link in every email.
- Feedback submissions: if you use our feedback form or inline data quality reports, we store the message you send and your email address only if you choose to provide it.
- Account data (optional): if you create an account, we store your email address (from Google OAuth or email magic-link) and the lists of products you save. If you sign in with Google, we receive your basic Google profile (name, email, profile picture URL) — only the email is persisted. We never store passwords; sign-in uses one-time email links or Google OAuth, both managed by Supabase Auth.
User accounts are optional. The price comparison features work without an account; an account is only required to save products to lists.
Legal basis for processing
We process data under the following legal bases (GDPR Art. 6(1)):
- Consent (Art. 6(1)(a)): for analytics (page views, clicks, search queries) stored in our database and for PostHog analytics cookies. Analytics are only activated if you accept via the consent banner. You can withdraw consent at any time via the cookie settings link in the footer.
- Legitimate interest (Art. 6(1)(f)): for anonymous retailer click-through tracking (no personal data stored), for functional cookies (country detection) to show relevant prices, and for rate limiting (using IP addresses temporarily in memory, never persisted).
- Consent (Art. 6(1)(a)): for processing newsletter subscriptions. You provide consent via our double opt-in process and can withdraw it at any time by clicking the unsubscribe link in any email.
- Contract (Art. 6(1)(b)): for processing account data (email, saved lists) so we can provide the account service you signed up for. Account data is retained until you delete your account; you can export or delete your data at any time from your account page.
Cookies and local storage
For a complete list of all cookies and local storage keys we use, including their purposes and durations, please see our Cookie Policy.
In summary: we set two functional cookies (country detection and bot detection), and PostHog analytics cookies are only set if you consent. We also store preferences (country, currency, language, search history) in your browser's local storage, which never leaves your device.
Analytics
Most analytics data collection requires your consent. When you accept the cookie banner, we collect:
- Page URLs visited, referrer information, and click events
- Search queries you enter (aggregated anonymously for popular search features)
Retailer click-through tracking (no consent required): when you click a "Buy" link to visit a retailer, we record which retailer was clicked, the price, and whether it was the cheapest option. This data does not include your IP address, browser fingerprint, or any personal identifiers. We process this under legitimate interest (Art. 6(1)(f)) to operate our price comparison service and verify affiliate commissions.
We also use PostHog for more detailed usage analytics (consent required). PostHog data is processed and stored on EU-based servers. No personally identifiable information is stored.
Third-party links and affiliate tracking
Our site contains links to external retailer websites. Some links go through the Awin affiliate network, which may set its own tracking cookies. When you click a link to a retailer, you leave OutdoorPrice and are subject to that retailer's and Awin's privacy policies. We are not responsible for the privacy practices of external sites. For more details, see our Affiliate Disclosure.
Service providers (sub-processors)
We use the following third-party service providers to operate OutdoorPrice. All process data within the European Union or under adequate safeguards:
- Supabase (database + authentication): stores product data, feedback submissions, newsletter subscriptions, analytics events, and (if you create an account) your account, sign-in tokens, profile, and lists. Sign-in uses Supabase Auth, which manages OAuth handshakes and email magic-links. EU-hosted.
- PostHog (analytics): processes anonymous usage data when you have consented to analytics cookies. EU-hosted.
- Cloudflare (content delivery and security): routes web traffic and provides DDoS protection. Cloudflare processes IP addresses to determine your approximate country for regional pricing.
- Google Cloud (hosting): our application servers run on Google Cloud Run in the EU (europe-west1).
- Slack (internal notifications): feedback submissions are forwarded to our internal Slack workspace for review. Only the feedback message, category, and email (if you provided one) are shared.
- Awin (affiliate network): when you click certain retailer links, Awin processes the click to attribute affiliate commissions. We also load Awin's publisher script (
dwin1.com) on our pages when you have accepted cookies — it supports first-party click attribution and does not load before consent. See Awin's privacy policy. - Resend (email delivery): sends verification and unsubscribe emails for newsletter subscriptions. Processes only your email address.
We will update this list if we add or remove service providers. Changes will be reflected in the "Last updated" date at the top of this page.
Data storage
All data is stored and processed on servers within the European Union. Product data, feedback submissions, and analytics events are stored by Supabase (EU). PostHog analytics data is stored by PostHog (EU). We do not sell, trade, or transfer your data to third parties beyond the service providers listed above.
Data retention
- Analytics data: retained for up to 26 months, then automatically deleted by our retention cleanup process.
- Feedback submissions: retained until the feedback has been addressed (resolved or dismissed), then deleted after 26 months.
- Newsletter subscriptions: retained until you unsubscribe. Unverified signups are automatically deleted after 7 days.
- Account data: retained until you delete your account. Deletion is available at any time from /account and removes your profile, lists, and saved items immediately.
Data breach notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours. If the breach is likely to result in a high risk to you, we will also notify affected individuals directly via email (if available) or a prominent notice on our website.
Your rights
Under the General Data Protection Regulation (GDPR), you have the right to:
- Access the personal data we hold about you (Art. 15)
- Rectification of inaccurate data (Art. 16)
- Erasure of your data ("right to be forgotten") (Art. 17)
- Restriction of processing (Art. 18)
- Data portability — receive your data in a structured, machine-readable format (Art. 20)
- Object to processing based on legitimate interest (Art. 21)
- Withdraw consent at any time for consent-based processing, without affecting the lawfulness of processing before withdrawal (Art. 7(3))
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. If you subscribed to our newsletter, you can unsubscribe at any time via the link included in every email. If you have an account, you can self-serve data export and account deletion from your account page.
Supervisory authority
If you believe that our processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority. The Swedish supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se. You may also contact the supervisory authority in your own EU/EEA member state.
Contact
If you have questions about this privacy policy, contact us at [email protected] or write to Dom som AB, Sweden.
