Melonslab, a trade name of Hypefox AB (org. no. 559570-6416), with its registered office at Hyllie Stationstorg 31, 215 32 Malmö, Sweden, is the controller of the personal data described here. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and Swedish data protection law. Where you store personal data belonging to others on our services, we act as processor on your behalf under our Data Processing Agreement — this policy covers the data for which we are the controller.
1. Personal data we collect
Account and contact data — name, email address, billing address, phone number and any company details.
Billing data — your orders and invoices. Full card details are handled directly by our payment providers and are not stored by us.
Technical and usage data — IP address, device and browser information, server and access logs, and cookie data.
Communications — messages you send to support and related correspondence.
2. Why we process data and our legal bases
To provide the Services and perform our contract with you (GDPR Art. 6(1)(b)) — creating your account, delivering and supporting services, and processing payments.
To comply with legal obligations (Art. 6(1)(c)) — such as accounting and tax records under the Swedish Bookkeeping Act.
For our legitimate interests (Art. 6(1)(f)) — securing and improving the platform, preventing fraud and abuse, and inviting customers to review our service.
With your consent (Art. 6(1)(a)) — for non-essential cookies, analytics and marketing, which you can withdraw at any time.
3. Cookies, analytics and consent
We use cookies and similar technologies. Consent for non-essential cookies is managed through our consent management platform CookieYes — see CookieYes’s Terms and Conditions and Privacy Policy.
We use Google Tag Manager (GTM) to load our tags. GTM itself loads on every visit, as our consent management script is delivered through it. GTM loads Google Analytics, which we use to understand site usage; tracking is enabled if you consent to it or if you are located outside the EEA, the UK and Switzerland (see Google’s Privacy Policy and how Google uses data). Subject to your consent, we also use the Microsoft Advertising UET tag for Bing conversion tracking (see the Microsoft Privacy Statement).
4. Marketing and service communications
We send marketing communications only if you have accepted them at signup or enabled them in your profile settings (Art. 6(1)(a)). You can withdraw this consent at any time.
Even without marketing consent, we will still send you relevant important information about your services — such as billing changes and service changes or upgrades made in your best interest. These messages are part of providing the Services and are not marketing.
5. Who we share your data with
Payments — Stripe processes your payment when you continue with the Credit Card payment method, either for a one-time payment or when you add your card to My Melonslab for auto-debit (Stripe privacy). PayPal processes your payment when you continue with the PayPal Checkout payment method (PayPal privacy).
Domains — data is transmitted to Openprovider when you register or transfer a domain, or when you update the contact details on your My Melonslab profile or on an individual domain. The information transmitted may include your full name, telephone number, email address, company name (if set) and address (including postal code, city, state/province and country). Openprovider may publish or disclose registrant data as required by registries and ICANN, as described in its Privacy Policy, Registration Data Policy and Data Disclosure Policy (all published on Openprovider’s policies page).
Reviews — when a new service is activated, your email address is automatically transmitted to Trustpilot so it can invite you to leave a review. Our team may also send manual review invitations, which may include your full name and a reference number (usually, but not always, your client ID). Trustpilot stores this information in line with its Privacy Policy; this gives us clearer insight into our business and helps avoid duplicate invitations for every new service. You can decline or unsubscribe at any time.
Analytics and advertising — Google and Microsoft, as described above.
We share only what is necessary, and our processors are bound by data processing agreements.
6. International transfers
Our infrastructure is operated in Sweden. Some processors (such as Stripe, PayPal, Google, Microsoft and Trustpilot) may process data outside the EU/EEA. Where they do, transfers are safeguarded by an adequacy decision or the European Commission’s Standard Contractual Clauses.
7. How long we keep your data
We keep personal data for as long as you have an account and as long as necessary for the purposes above. Invoicing and accounting records are retained for seven (7) years under the Swedish Bookkeeping Act. Logs and technical data are kept for a limited period for security and troubleshooting. For accounting purposes we also store a copy of your invoices in our accounting system, in line with Swedish regulations (the Swedish Bookkeeping Act, Bokföringslagen, and the Swedish Companies Act, Aktiebolagslagen).
8. Your rights under the GDPR
You have the right to access, rectify, erase or restrict processing of your personal data, to data portability, and to object to processing based on legitimate interests. Where processing is based on consent, you can withdraw it at any time without affecting prior processing.
To exercise any of these rights, contact compliance@melonslab.com. We will respond without undue delay and within one month, and may need to verify your identity first.
9. Complaints
If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) at imy.se, or with the data protection authority in your EU/EEA country of residence.
10. Security
We apply appropriate technical and organisational measures — including access controls, encryption in transit, network isolation and monitoring — to protect personal data against unauthorised access, loss or misuse.
Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Swedish Authority for Privacy Protection (IMY) and, where required, affected individuals, in line with the GDPR.
11. Changes to this Policy
We may update this Privacy Policy from time to time. We will make reasonable efforts to inform you of material changes, but we reserve the right to update it at any time. The Swedish-language version prevails in the event of any discrepancy.
12. Contact
For privacy questions or to exercise your rights, contact compliance@melonslab.com. This Policy is governed by Swedish law and subject to the courts of Malmö, Sweden.