Privacy policy

Who is responsible

KnitLab is run by Oellingrath Business (org. no. 935 353 262), which is the data controller for the personal data described here. Our address is Vreimsida 96, 3803 Bø i Telemark, Norway. You can reach us at kontakt@knitlab.no or by phone on +47 922 96 182.

What we collect, and why

• Without an account: Your designs, projects and yarn stash are stored only in your browser. We can't see them.
• With an account: Your email address is used to sign in with a one-time code. Your designs, projects, colourwork charts and yarn stash are stored in your account, so you have them on all your devices. The legal basis is our contract with you (Article 6(1)(b) of the General Data Protection Regulation, GDPR).
• Payment: If you buy Pro, Stripe handles the payment. We don't receive your card number, only information about the subscription (status, period, when you bought it, and that you asked for Pro to start straight away). The legal basis is the contract and our accounting obligations.
• Emails about your subscription: If you have Pro, we send you confirmation of your purchase and cancellation, a reminder at least every six months that your subscription is running, and a notice before an annual subscription renews. The law requires these emails, and the legal basis is the contract and our legal obligations (Article 6(1)(b) and (c)).
• Tips by email: When you create an account, we send you a welcome email and two emails with tips during the first days, one after three days and one after seven days. The last one depends on whether you have made a design. The emails are only about how to use KnitLab, not about buying anything. The legal basis is the contract and our legitimate interest in helping you get started (Article 6(1)(b) and (f)). You can unsubscribe with the link at the bottom of the email.
• Gift cards: If you buy a gift card, we store your email address (to send you the gift card and receipt), the recipient's name and the message if you wrote them, and when the gift card was bought and redeemed. When the gift card is redeemed, it is linked to the recipient's account. The legal basis is the contract and our accounting obligations.
• Pattern as a PDF by email: If you ask for the pattern for one of your own designs as a PDF, the PDF is made in your browser and sent to the email address your account is registered with, via Resend. We don't store the PDF, only the time and the file size, for 90 days, so we can limit how many PDFs are sent (to prevent misuse). The legal basis is our contract with you and our legitimate interest in preventing misuse (Article 6(1)(b) and (f)).
• Importing your own patterns (Pro): If you upload a pattern you have bought (a PDF or photos), the file is sent to Anthropic, which reads it with the AI service Claude. Purchased PDFs often have your name, email address or order number printed on the pages, and that comes along in the file, but it is not included in the pattern that is read from it. We delete the file as soon as the reading is finished. If the reading is interrupted, the file is deleted automatically within two hours. The pattern that is read from the file is stored in your account, like your designs. For each import we also keep a log with the time, the title, the designer and source you entered, when you confirmed that you own the pattern, the number of files and pages, the file size, how much of the AI service was used, and whether the reading succeeded. The log never contains the pattern itself. We use it to count your imports (10 per month) and as documentation that you confirmed you have the right to use the pattern. The legal basis is our contract with you and our legitimate interest in preventing misuse of other people's patterns (Article 6(1)(b) and (f)).
• News and offers: If you sign up for news on the website, or tick the box for news, tips and offers in the app, we store your email address, when you gave your consent, the text you agreed to and where you agreed to it. Your email address is added to our mailing list at Resend, which we send newsletters from. The legal basis is your consent (Article 6(1)(a) and section 15 of the Norwegian Marketing Control Act), which you can withdraw at any time with the link at the bottom of every email. If you delete your account, you are also removed from the mailing list.

We only use cookies to measure ads if you have said yes to it (see below), and we never sell data on.

Who we share data with (data processors)

• Supabase – database and sign-in, stored in the EU (Stockholm).
• Vercel – website hosting and visitor statistics without cookies.
• Stripe – payments.
• Resend – sending sign-in codes, emails about your subscription, tips, patterns as PDFs and news, and storing the mailing list for news.
• Anthropic – reading the patterns you import. The files are processed in the USA and deleted by Anthropic after a short time, under Anthropic's terms for commercial API customers. Anthropic does not use them to train its AI models.

Some of these are US companies. Transfers are based on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

Visitor statistics, cookies and ads

• Visitor statistics: We count visits with Vercel Web Analytics. It doesn't use cookies and stores nothing on your device. We can see which pages are visited, where visitors came from and how many sign up or buy, but not who you are. The legal basis is our legitimate interest in improving the website (Article 6(1)(f)).
• Which campaign you came from: If you come to us via a link with a campaign name (for example ‘instagram / autumn campaign’), we store the campaign name with the purchase at Stripe if you buy Pro. This shows us which ads pay off. The legal basis is legitimate interest.
• Meta (Facebook and Instagram), only if you say yes: The Meta pixel is then loaded. It stores the cookies _fbp and _fbc (for up to 90 days) and tells Meta about visits, newsletter sign-ups, new accounts, started checkouts and purchases. If you buy Pro after saying yes, we also send the purchase directly from our server to Meta with the amount, your email address in hashed form (converted into a code), your IP address and your browser type, so that Meta can see which ad led to the purchase. We then also store the click ID from the ad with the purchase at Stripe. Meta Platforms Ireland and we are joint controllers for this collection, and Meta processes the data further under its own privacy policy. The legal basis is your consent (Article 6(1)(a) and section 3-15 of the Norwegian Electronic Communications Act, ekomloven).

If you say no, KnitLab works exactly the same. You can change your mind at any time. If you withdraw your consent, Meta's cookies are deleted on this device, and we send no further data.

How long we keep data

• Your account and data are kept until you delete your account. You delete it yourself from the menu in the app (‘Delete account’), and everything is then deleted immediately.
• Files you upload to import a pattern are deleted straight after the reading, and after two hours at the latest if the reading is interrupted.
• The import log is kept for 12 months, or until you delete your account.
• Newsletter sign-ups and your consent are kept until you unsubscribe or delete your account.
• The log of PDFs sent by email (only the time and file size) is deleted after 90 days.
• Gift cards are kept for five years after the end of the year in which the gift card expired or was used up, because they document a sale (section 13 of the Norwegian Bookkeeping Act). The name and message are deleted earlier if you ask us to.
• Your cookie choice is stored in your browser until you change it or clear your browser data.
• Receipts and other documentation of payments are kept by Stripe for five years after the end of the financial year, as required by section 13 of the Norwegian Bookkeeping Act (bokføringsloven). This also applies after your account has been deleted.

Your rights

You can ask for access to, correction of or deletion of your personal data, and you can withdraw your consent. In the app you can download your data yourself (‘Download data’ in the menu) and delete your account. Otherwise, send an email to kontakt@knitlab.no. If you believe we are processing data in breach of the rules, you can complain to Datatilsynet, the Norwegian Data Protection Authority.