Privacy policy
Last updated: August 2, 2026
1. OVERVIEW
This Privacy Policy describes how Nordvyn ("Company," "we," "us," or "our") collects, uses, discloses and protects personal information when you visit, use or make a purchase from our website or otherwise interact with our services (the "Services").
Our online store is hosted by Shopify Inc., which provides the ecommerce platform enabling us to sell our products and services. Shopify acts as a data processor on our behalf.
This Policy also serves as our Notice at Collection for California residents.
2. DATA CONTROLLER
Data Controller:
Jakob Leuchtweis (trading as Nordvyn)
Neuhauser Straße 7a
78576 Emmingen-Liptingen
Germany
Email: support@trynordvyn.com
We have not appointed a Data Protection Officer, as we are not required to do so.
3. PERSONAL INFORMATION WE COLLECT
Information you provide directly
Name
Billing and shipping address
Email address and phone number
Order and payment details (payment card details are collected and processed by our payment providers, not by us)
Customer support communications
Content you submit, such as reviews, photos or videos
Information collected automatically
IP address
Browser, device, operating system and screen information
Website usage and interaction data, including pages viewed, products viewed, items added to cart, clicks, scrolling, cursor movement and time on page
Session recordings and heatmaps (see section 7)
Referring URL and advertising click identifiers
Cookies and similar tracking technologies
Information from third parties
Advertising and analytics partners, including measurement and attribution data
Fraud prevention signals from Shopify and our payment providers
Carriers, for delivery status
We do not knowingly collect sensitive personal information, and we do not use or disclose sensitive personal information for purposes other than those permitted without a right to limit under applicable law. We do not collect government identifiers, financial account numbers, biometric data, precise geolocation, or information about health, race, religion, sexual orientation or union membership.
4. LEGAL BASES FOR PROCESSING (GDPR)
Our operator is established in Germany, so the EU General Data Protection Regulation applies to our processing regardless of where you are located. We process personal data on the following legal grounds:
Performance of a contract (order processing and fulfillment, customer support)
Compliance with legal obligations (tax, accounting, consumer protection)
Legitimate interests (fraud prevention, site security, analytics, service improvement, direct marketing, defending legal claims)
Consent (email and SMS marketing, and certain tracking technologies where consent is required)
Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
5. HOW WE USE PERSONAL INFORMATION
We use personal information to:
Process and fulfill orders, and handle refunds
Provide customer support
Send transactional communications
Improve and optimize our Services, including through analytics and session review
Prevent, detect and investigate fraud and abuse
Comply with legal and regulatory obligations
Conduct marketing and advertising activities, including measuring and targeting advertising
Establish, exercise or defend legal claims
We do not use personal information to train third-party artificial intelligence models, and we do not sell personal information for money.
6. CATEGORIES OF PERSONAL INFORMATION (CCPA / CPRA)
Within the past 12 months, we have collected the following categories:
Identifiers (name, email address, postal address, phone number, IP address, device and cookie identifiers)
Customer records (billing and shipping details, order history)
Commercial information (products purchased, considered, or added to cart, refund history)
Internet or other electronic network activity (browsing and interaction data, session recordings)
Approximate location data derived from IP address
Inferences drawn to create a profile reflecting preferences and behaviour, used for analytics and advertising
Sources are: you directly, your device automatically, and our service providers and advertising partners.
We disclose these categories to: our ecommerce platform, payment processors, fulfillment and shipping partners, advertising and analytics providers, and legal or regulatory authorities where required.
Sale and sharing of personal information
We do not sell personal information for monetary consideration.
We do share personal information with advertising and analytics partners for cross-context behavioral advertising, including measuring advertising performance and delivering relevant ads. Under California, Colorado, Connecticut, Texas and other state privacy laws, this may be considered a "sale" or "sharing" or "targeted advertising."
You have the right to opt out. See section 12.
7. TRACKING, COOKIES, SESSION RECORDING AND ADVERTISING
PLEASE READ THIS SECTION. IT DESCRIBES TECHNOLOGY THAT RECORDS HOW YOU USE THIS WEBSITE.
We use cookies, pixels, tags, SDKs and similar technologies provided by third parties, including:
Meta Pixel (Meta Platforms, Inc.)
Google Ads and Google Analytics (Google LLC)
TikTok Pixel (TikTok Inc.)
Microsoft Clarity (Microsoft Corporation)
Shopify Analytics (Shopify Inc.)
Triple Whale (Triple Whale, Inc.)
Session recording and heatmaps. Microsoft Clarity is a behavioral analytics tool that records your interaction with our website, including cursor movement, clicks, taps, scrolling, page navigation and the content displayed on the pages you view, and reconstructs it as a session replay that we can watch to understand how visitors use the site. Text you type into form fields is masked by the tool's default settings, but you should not enter information into any field on this site that you would not want recorded. This data is processed by Microsoft and is subject to Microsoft's privacy practices.
Advertising and measurement. The Meta, Google and TikTok technologies transmit information about your visit, including pages and products viewed and actions taken such as adding to cart or purchasing, to those companies. Those companies use that information for our advertising measurement and targeting and also for their own purposes in accordance with their own privacy policies. Triple Whale receives order and site interaction data to attribute sales to advertising.
When these technologies operate. These technologies currently load and begin operating when you open a page on our website, before you take any action. We do not currently present a pre-consent blocking cookie banner to visitors in the United States. If you do not wish this to happen, you can opt out as described in section 12, use your browser's cookie and tracking controls, use a Global Privacy Control signal, or use industry opt-out tools including optout.aboutads.info and youradchoices.com. You can also opt out of Microsoft Clarity by using your browser's controls or by visiting Microsoft's opt-out page.
Where required by applicable law, including the GDPR and the ePrivacy Directive, tracking technologies are deployed only after consent via our cookie consent mechanism.
We honor Global Privacy Control (GPC) signals as a valid request to opt out of sale and sharing for the browser transmitting the signal.
8. PAYMENT PROCESSORS
Payments are processed by secure third-party payment providers.
We do not store full payment card numbers or sensitive payment credentials on our servers.
9. DISCLOSURE OF PERSONAL INFORMATION
We may share personal information with:
Shopify and ecommerce service providers
Payment processors
Fulfillment, dropshipping and shipping partners, including partners located in China, who receive the name, address, phone number and order contents needed to ship your order
Advertising and analytics providers
Professional advisers, including lawyers and accountants
Legal or regulatory authorities when required by law, and in connection with the establishment or defence of legal claims
A successor entity in connection with a merger, acquisition or sale of assets
All service providers process personal data under contractual obligations consistent with applicable privacy and data protection laws.
10. DATA RETENTION
We retain personal information only for as long as necessary for the purposes described in this Policy or as required by law:
Order and transaction data: up to 10 years, reflecting German commercial and tax retention obligations
Customer support communications: up to 3 years
Marketing data: until consent is withdrawn or an opt-out occurs, then a suppression record is kept so that we continue to honor it
Analytics data: up to 26 months
Session recordings: up to 30 days, in line with the tool's default retention
Legal or regulatory obligations, or the defence of legal claims, may require longer retention in certain cases.
11. YOUR RIGHTS UNDER GDPR
If you are located in the European Economic Area or the United Kingdom, you have the right to:
Access your personal data and receive a copy
Correct inaccurate or incomplete data
Request deletion of your data
Request data portability
Restrict or object to certain processing, including direct marketing, which you may object to at any time
Withdraw consent at any time where processing is based on consent
To exercise these rights, contact support@trynordvyn.com. We respond within one month, extendable by two further months for complex requests.
You also have the right to lodge a complaint with a supervisory authority. Our competent authority is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20, 70173 Stuttgart, Germany
You may also complain to the authority in your own country of residence or place of work.
12. U.S. PRIVACY RIGHTS
Residents of U.S. states with comprehensive privacy laws, including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island, have rights that may include:
The right to know what personal information we collect, use and disclose
The right to access a copy of your personal information
The right to correct inaccurate personal information
The right to delete personal information
The right to data portability
The right to opt out of the sale or sharing of personal information and of targeted advertising
The right to limit the use of sensitive personal information
The right not to receive discriminatory treatment for exercising these rights
Do Not Sell or Share My Personal Information. To opt out of the sale or sharing of your personal information and of targeted advertising, email support@trynordvyn.com with the subject line "Do Not Sell or Share," or transmit a Global Privacy Control signal from your browser, which we honor automatically for that browser.
How to submit a request. Email support@trynordvyn.com. We may verify your identity before processing a request and may require additional information for security purposes. Authorized agents may submit requests on your behalf where permitted by law, with proof of authorization.
Timing and appeals. We respond within 45 days, extendable by a further 45 days where reasonably necessary, with notice to you. If we decline a request, you may appeal by replying to our response with the word "Appeal." We will respond to an appeal within the period required by your state's law and will tell you how to contact your state Attorney General if you disagree with the outcome.
California Shine the Light. California residents may request information about disclosures of personal information to third parties for their direct marketing purposes under California Civil Code section 1798.83 by emailing support@trynordvyn.com.
Financial incentives. If we offer a discount or other benefit in exchange for signing up for marketing, participation is voluntary, you may withdraw at any time by unsubscribing, and the value of the incentive is reasonably related to the value of the data you provide, estimated by reference to the cost of the discount offered.
13. INTERNATIONAL DATA TRANSFERS
Personal data is transferred internationally as an inherent part of how we operate. Our operator is in Germany, our platform and several service providers are in the United States, and our fulfillment partners are primarily in China.
Where required, such transfers are safeguarded through the European Commission's Standard Contractual Clauses, adequacy decisions, or other lawful transfer mechanisms, together with supplementary measures where appropriate.
14. SECURITY
We implement reasonable administrative, technical and organizational safeguards designed to protect personal information.
However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.
If a data breach affecting your personal information occurs, we will notify you and the relevant authorities where required by applicable law.
15. CHILDREN'S PRIVACY
The Services, including this website, are directed exclusively at adults. You must be at least 18 years old to purchase. The Services are not directed at children under the age of 13.
We do not knowingly collect personal information from children under 13. If such data is identified, it will be deleted promptly.
This Policy does not create any obligation under the Children's Online Privacy Protection Act (COPPA) with respect to online collection of data from child visitors, as the Services are not directed at children and we do not have actual knowledge that we are collecting data from users under 13.
We do not knowingly sell or share the personal information of consumers under 16 years of age.
16. AUTOMATED DECISION-MAKING
We do not engage in profiling that produces legal or similarly significant effects concerning you, with one exception: orders are subject to automated fraud screening by our ecommerce platform and payment providers, which may result in an order being flagged, held or cancelled.
If an order of yours is cancelled on that basis, you may contact support@trynordvyn.com to ask for a human review of the decision and to contest it. You are always refunded in full for an order cancelled this way.
17. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time.
Any changes will be posted on this page with an updated "Last updated" date. Material changes will be brought to your attention where required by law.
18. CONTACT
For privacy-related inquiries or to exercise your rights, contact:
Email: support@trynordvyn.com