Last updated: 10 November 2026

This policy explains what personal data we collect when you visit lukenobel.com, download or buy our products, or book us for photography, and what we do with it. We collect only what we need to run the shop and the studio, and we never sell your data.

Who we are

The data controller is Nobre Studio AB (Nobl Studios), org. no. 559601-3515, Helleforsgatan 16B, 416 75 Göteborg, Sweden.

For anything about your data, email contact@lukenobel.com. We reply within 30 days, usually much sooner.

What we collect and why

To process your order and deliver your download Name, email, billing address and country, what you bought, and payment status. Legal basis: contract (GDPR Art. 6(1)(b)).

To deliver a free download Name and email. Legal basis: contract (Art. 6(1)(b)).

For photography bookings and invoices Name, company details, email and what was agreed. Legal basis: contract (Art. 6(1)(b)).

For bookkeeping and tax Order, invoice and payment records. Legal basis: legal obligation (Art. 6(1)(c)) under Swedish bookkeeping and VAT law.

To answer your questions and support requests What you send us. Legal basis: our legitimate interest in helping you (Art. 6(1)(f)).

For our newsletter and offers Email and name. Legal basis: your consent (Art. 6(1)(a)), given with the newsletter box at checkout or a sign-up form. Every email has an unsubscribe link.

To keep the site secure and see how it is used IP address, browser and device, and pages visited, through Squarespace Analytics and PostHog. Legal basis: legitimate interest for security (Art. 6(1)(f)); your consent for analytics cookies (Art. 6(1)(a)).

To measure our ads on Instagram and Facebook Cookie identifiers, pages visited, purchases, and a hashed email and phone number (see Cookies below). Legal basis: your consent (Art. 6(1)(a)).

We also email you about products you got from us, such as download links, updates and fixes, as part of delivering them. These emails are not marketing and need no newsletter sign-up.

We never see or store your card details: payments are handled by Stripe.

Cookies and the Meta Pixel

When you first visit, a banner asks which cookies you accept. You can change your choice any time through the cookie settings link at the bottom of the page.

  • Necessary cookies keep the site and checkout working, such as your cart. They are always on.
  • Analytics cookies let Squarespace Analytics and PostHog count visits and see which pages are used. They load only if you accept them.
  • Marketing cookies load the Meta Pixel. Nothing is sent to Meta until you accept them.

If you accept marketing cookies, the Meta Pixel tells Meta which pages you viewed and whether you bought something, so we can see whether our Instagram and Facebook ads work and show them to people likely to be interested. It sets a cookie (_fbp) that lasts up to 90 days.

With your consent we also use Meta's advanced matching. When you place an order, your email address and phone number are scrambled on your device into a one-way code (a SHA-256 hash) before being sent to Meta. Meta uses the code only to match the visit to a Meta account, and deletes it after matching.

For collecting this data and passing it to Meta, we and Meta Platforms Ireland Ltd are joint controllers. What Meta then does with it is covered by Meta's Privacy Policy.

Who we share it with

We share data only with the services we need to run the shop, and only what each one needs.

  • Squarespace (processor): hosts the website, store and checkout, stores orders, and sends order and download emails.
  • Stripe (processor, and a separate controller for fraud prevention and its own legal duties): takes payments.
  • PostHog (processor): website analytics, only with your consent.
  • Meta Platforms Ireland (joint controller, see Cookies): ad measurement through the Meta Pixel, only with your consent.
  • Sender (processor): sends our newsletter and campaigns.
  • Accounted (processor): bookkeeping software for invoices and accounts; data stored in Sweden.
  • Authorities such as Skatteverket: when the law requires it.

Outside the EU. Some of these companies, or their subcontractors, process data in the United States. Where they do, the transfer is covered by the EU–US Data Privacy Framework if the company is certified, and otherwise by the EU Standard Contractual Clauses.

How long we keep it

  • Orders, invoices and payment records: seven years after the end of the calendar year in which the financial year ended, as Swedish bookkeeping law requires.
  • Your customer details and download access: as long as you may need to re-download or get support, then deleted, except the records above.
  • Email list: until you unsubscribe.
  • Support conversations: two years after our last contact.
  • Meta Pixel cookie (_fbp): up to 90 days, or until you withdraw consent.

Your rights

You can ask us to:

  • show you the data we hold about you, and give you a copy;
  • correct data that is wrong;
  • delete your data, unless the law requires us to keep it (such as bookkeeping records);
  • limit how we use