Legal
Última actualización: 2026-10-16 · Versión 2.2
Este documento está disponible en inglés y sueco. Svenska
Inority AB, company registration number 559142-6720, Stockholm, Sweden, provides Komisio. This notice explains how we process personal data when we decide the purposes and means ourselves, as controller. When a store uses Komisio to handle its consignors, staff and customers, the store is the controller and we process that data on its instructions under the data processing agreement.
Account data: the e-mail address, name and password hash of people who register, their multi-factor settings, and the stores they belong to. Billing data: the store’s name, invoice address and the identifiers Stripe gives us; card numbers never reach us. Support and contact: the messages you send us and our replies. Security records: an access log of sign-ins and sensitive actions, with time, account and IP address, kept to detect misuse.
E-mail communication: the e-mail address, name, store name and language of store owners, used to send onboarding and service information and, if you have consented, newsletters and product information. We record whether you have consented to newsletters and when you unsubscribe. For e-mail sent through MailerLite, MailerLite records delivery and, unless tracking is switched off, opens and link clicks.
The website komisio.com uses GoatCounter for aggregated visitor statistics: visits per day, the page viewed, country, referring site and browser type. No cookies are set and no IP address is stored; we cannot identify individual visitors. The contact form opens your own e-mail client; nothing is stored on the website.
To provide the service you signed up for (contract). To invoice and keep accounts (legal obligation). To keep the service secure and investigate misuse (legitimate interest). To answer when you contact us (legitimate interest). To send onboarding and service information about the account you created (contract, and our legitimate interest in helping you get started). To send newsletters and product information (consent, which you can withdraw at any time without affecting service e-mail). We do not sell personal data.
The service runs on Supabase (database, authentication, file storage) in Stockholm and on Vercel (application hosting) in the European Union. Transactional e-mail is sent through Resend. Onboarding e-mail and newsletters are sent through MailerLite (MailerLite UAB, Lithuania, EU), which receives the store owner’s e-mail address, name, store name and language. Payments are handled by Stripe. When a store connects PayPal POS or Fortnox, data flows to those providers under the store’s own agreements with them. When a store switches on the AI assistant, the photos and text the store chooses to send go to OpenAI; this is off by default. We use standard contractual clauses where a provider processes data outside the EU or EEA.
Account data is kept while the account exists and anonymised on request or 24 months after the last activity. Billing records are kept for seven years under the Swedish Bookkeeping Act. The access log is kept for 12 months. Support correspondence is kept for 24 months. The e-mail data shared with MailerLite is kept while the account exists, and newsletter data until you unsubscribe or withdraw consent; after that we keep only your e-mail address on a suppression list so that you are not e-mailed again.
You may ask for access, rectification, erasure, restriction and portability, and object to processing based on legitimate interest. You may withdraw consent to newsletters at any time through the unsubscribe link in every newsletter. Write to support@komisio.com. If you are a consignor or customer of a store, turn to the store first; it is the controller of your data and we will help it respond. You may complain to the Swedish Authority for Privacy Protection (IMY).
We update this notice when our processing changes. The current version is always published on komisio.com; material changes are announced to store owners by e-mail.
