Privacy Policy

Data Controller

The Between, based in Sweden, is the data controller for the processing of your personal data. Contact: info@thebetween.se.

What data we collect

• Account information: Name, email address and encrypted password when you create an account.
• Payment information: Handled directly by Stripe. We never store card numbers or full payment details.
• Profile information: Company and role if you choose to provide them.
• Form responses: Name, email, city and message when you submit a form (contact, newsletter, interest applications, membership applications).
• Discord account: Discord user ID if you choose to connect your account via OAuth.
• Analytics data: Aggregated and anonymised data on page views and feature usage via Google Analytics 4.
• Technical data: IP address (anonymised by Google Analytics), browser type and device information.

Cookies

• Strictly necessary cookies: Login session (Auth.js) – required to keep you signed in. Stored until logout or maximum 30 days.
• Analytics cookies (require consent): Google Analytics 4 sets _ga and _ga_[ID] to measure anonymous visit statistics. Stored for up to 2 years. Only loaded if you have given consent.
• You can withdraw your consent to analytics cookies at any time via the cookie settings at the bottom of the page.

Legal basis for processing

• Contract (GDPR Art. 6.1.b): Account information, payments, Discord integration and event registrations – necessary to fulfil our service.
• Legitimate interest (GDPR Art. 6.1.f): Form responses for interest applications and contact requests – we have a legitimate interest in responding to and following up on incoming enquiries.
• Consent (GDPR Art. 6.1.a): Google Analytics and analytics cookies – you give consent via the cookie banner. Newsletter subscription – you give consent upon sign-up.

How we use your data

• Provide and improve the website and our services.
• Manage your account, Commerce Commons subscription and payments.
• Give you access to the Discord community for Commerce Commons subscribers.
• Send transactional emails: welcome emails, confirmations and replies to form submissions.
• Send newsletters and updates (if you subscribe – you can unsubscribe at any time).
• Respond to contact and interest enquiries.
• Analyse anonymous visit statistics to improve the website.

Third-party providers and data processors

• Stripe (Stripe Inc., USA/Ireland) – payment processing. Stripe is independently responsible for payment data. See Stripe's privacy policy at stripe.com.
• Discord (Discord Inc., USA) – community platform for Commerce Commons subscribers. See Discord's privacy policy at discord.com.
• Resend (Resend Inc., EU) – transactional emails (confirmations, welcome emails).
• Google Analytics (Google LLC, USA) – anonymised visit statistics. Data may be processed in the USA under the EU–US Data Privacy Framework. Only loaded with your consent.
• Google Search Console (Google LLC, USA) – SEO tool. Does not process personal data about website visitors.
• Vercel (Vercel Inc., USA/EU) – web hosting. Data stored within the EU (Stockholm region).
• Neon (Neon Inc., EU) – database hosting. Data stored in Stockholm, Sweden.
• Anthropic (Anthropic PBC, USA) – AI service powering The Between Dialogue. Your chat messages are sent to Anthropic to generate responses. See Anthropic's privacy policy at anthropic.com.
• OpenAI (OpenAI OpCo LLC, USA) – search embeddings for the AI assistant's contextual retrieval. Used only if the feature is configured. See OpenAI's privacy policy at openai.com.

The Between Dialogue AI assistant

• Your messages in the AI chat are sent to Anthropic to generate responses in real time. Conversations are not stored in our database – they exist only for the duration of the active session.
• Your IP address is used temporarily in memory to limit the number of requests (rate limiting). It is not stored.
• Legal basis: legitimate interest (GDPR Art. 6.1.f) – you actively initiate the conversation to receive information about The Between.
• The Between Dialogue is an AI system. Do not share sensitive personal data – national ID numbers, payment details, passwords or health information – in the chat.

Retention and deletion

• Account data is stored for as long as your account is active. Upon account deletion, personal data is anonymised within 30 days.
• Form responses are stored for up to 24 months.
• Payment history is stored in accordance with Swedish accounting law (7 years).
• Analytics cookies: up to 2 years (Google Analytics default).

International transfers

Some of our providers (Stripe, Discord, Google, Vercel) are based in or transfer data to the USA. These transfers are made under appropriate safeguards, including the EU–US Data Privacy Framework or EU Standard Contractual Clauses.

Your rights (GDPR)

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate data.
• Right to erasure: Request deletion of your data (subject to legal obligations).
• Right to object: Object to processing based on legitimate interest.
• Right to data portability: Receive your data in a machine-readable format.
• Right to withdraw consent: At any time, without affecting the lawfulness of prior processing.
• Right to lodge a complaint: With the Swedish Authority for Privacy Protection (IMY), imy.se.

Contact

Questions about your privacy or to exercise your rights: info@thebetween.se.