Privacy Policy

Last updated: 17 June 2026

This policy explains what personal data we collect when you use the Salt & Smoke store, why we use it, and the rights you have over it.

Who we are

This website (saltandsmoke.club) and the Salt & Smoke store are operated by "Nakrai sveta" Ltd (trading as AWE Studio), a company registered in Bulgaria (Company No. 206029092, VAT BG206029092), with its registered seat at Sofia, Mladost 1A 553A 5. We are the controller of your personal data.

For any privacy question or request, email us at [email protected].

What data we collect

  • Your email address, used to deliver your purchase and send confirmations.
  • Your name, if you choose to provide it.
  • Order and payment details — your payment is handled by Stripe; we store the payment reference, amount and items purchased, not your full card number.
  • Gift recipient details (name, email and your personal message) when you send a card as a gift.
  • Account details (email, name, preferred language) if you create an account.
  • Your IP address and browser/device information, which we use for security, abuse prevention, rate limiting, session management and, only with your consent, analytics.
  • Any message you send us through our contact form.

Why we use it and our legal basis

We process order, account and support data to perform our contract with you and to provide the service — for example to take payment, deliver your digital cards, send order confirmations, provide support, and keep the service secure (Art. 6(1)(b) GDPR and, where applicable, Art. 6(1)(f) GDPR).

We use analytics only with your consent (Art. 6(1)(a) GDPR), which you give or decline through our cookie banner.

Cookies and analytics

We use PostHog (hosted in the EU) to understand how the site is used. These analytics cookies load only after you accept them in the cookie banner; you can decline and the site works normally. We do not use advertising cookies.

Who we share it with

We use a small number of trusted providers who act on our behalf under data-processing agreements and only receive the data they need:

  • Stripe — payment processing.
  • Resend — sending transactional emails such as confirmations and gift deliveries.
  • Cloudflare R2 — hosting digital files and download links.
  • PostHog (EU) — privacy-friendly analytics, only with your consent.

How long we keep it

We keep order and contact records for as long as needed to provide the service and to meet our legal and accounting obligations, then delete or anonymise them.

Your rights

Under the GDPR you can access, correct, delete or export your data, object to processing, or withdraw consent at any time. To exercise any of these, email [email protected].

You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP).