Template — have checked before launch. Replace everything in [BRACKETS]. This is not legal advice.
Privacy & cookies
Last updated: 13 October 2026
1. Who is responsible
The data controller is Midžis, MB (Napiko), registration code 306452645, V. Nagevičiaus g. 3, LT-08237 Vilnius, Lithuania. Email: hello@napiko.com.
2. What we collect
- Order data (via Stripe checkout): name, shipping and billing address, email, phone number, what you bought and the amount. Card details go straight to Stripe — we never see them.
- Messages you send us by email.
- Technical data: IP address and browser information, processed by our hosting provider and font provider when you visit.
- Marketing data, only if you accept marketing cookies: page views and shop events (viewed product, chose a pillow, started checkout, purchase) sent to Meta and TikTok.
3. Why we use it (and the legal basis)
| Purpose | Legal basis (GDPR) |
|---|---|
| Process and deliver your order, send tracking, handle returns | Contract (Art. 6(1)(b)) |
| Keep accounting records | Legal obligation (Art. 6(1)(c)) |
| Answer your messages, prevent fraud, keep the site secure | Legitimate interest (Art. 6(1)(f)) |
| Measure and improve our ads (Meta Pixel, TikTok Pixel) | Consent (Art. 6(1)(a)) — you can withdraw it any time |
4. Who we share it with
- Stripe (Stripe Payments Europe Ltd., Ireland) — payments and checkout. Klarna, if you choose to pay with Klarna.
- Cloudflare (Cloudflare, Inc.) — website hosting, security and email forwarding.
- Google — Google Fonts (font files) and Gmail (our email inbox).
- Our production partner and shipping carriers — your name, address and phone number, only to deliver your parcel. [SUPPLIER NAME, COUNTRY; CARRIER NAMES]
- Meta Platforms Ireland Ltd. and TikTok Technology Ltd. (Ireland) — only if you accept marketing cookies.
Some of these companies process data outside the EU (for example in the USA or China). Where that happens, transfers rely on an EU adequacy decision (such as the EU–US Data Privacy Framework), the EU Standard Contractual Clauses, or — for delivering your order from China — because the transfer is necessary to perform our contract with you (Art. 49(1)(b) GDPR).
5. How long we keep it
- Order and accounting records: 10 years, as required by Lithuanian accounting law.
- Emails with you: up to 3 years after our last contact.
- Marketing cookies: see the cookie list below.
6. Your rights
You can ask to access, correct or delete your data, restrict or object to its use, and receive a copy (data portability). You can withdraw consent at any time via . Email hello@napiko.com; we reply within one month. You can also complain to the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt) or the authority in your country.
7. Cookies and similar storage
Necessary storage is always on. Marketing cookies are only set if you click "Accept all" or switch them on in Settings. You can change your choice any time: .
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| napiko_consent | Napiko (local storage) | Necessary — remembers your cookie choice | Until you clear it |
| napiko_utm_campaign | Napiko (session storage) | Marketing — remembers which ad campaign brought you, passed to checkout | Until the tab is closed |
| napiko_purchase_* | Napiko (local storage) | Marketing — stops a purchase being counted twice | Until you clear it |
| _fbp, _fbc | Meta | Marketing — measure ads on Facebook and Instagram | 3 months |
| _ttp, _tt_enable_cookie | TikTok | Marketing — measure ads on TikTok | 13 months |
Stripe sets its own cookies on its checkout page (checkout.stripe.com / buy.stripe.com) for fraud prevention; see Stripe's privacy policy.