Privacy policy

Effective date: October 2, 2026

This Privacy Policy explains how SAAI Retail OÜ ("we", "us" or "our") collects, uses, discloses and protects personal information when you visit or use sleepanatomy.co, purchase products, contact us, subscribe to marketing communications or otherwise interact with Sleep Anatomy.

SAAI Retail OÜ, registered at Viru väljak 2, 10111 Tallinn, Estonia, is the controller of personal data processed through the store.

Information we collect

Depending on how you use the store, we collect the following categories of information:

  • Identity and contact information, such as your name, email address, shipping address, billing address and telephone number where supplied for an order or delivery.
  • Order and transaction information, including products ordered, order history, shipping information, returns, refunds and transaction records.
  • Limited payment-related information, such as payment method, the last four digits of a payment instrument where supplied by the payment provider, transaction identifiers, authorization results, payment status and refund status. We do not store full payment-card numbers or card security codes.
  • Account information, if you create or use a customer account.
  • Customer-service information, including messages, questions, return requests, complaints and other correspondence with us.
  • Review and submission information, when you submit a review, rating, feedback or other content.
  • Marketing information, including your email address, subscription status, consent records and interactions with marketing communications.
  • Device and technical information, including IP address, browser and device information, operating system, referring pages, pages viewed, timestamps, cookie identifiers and similar technical data.
  • Analytics and advertising information, including information generated through analytics, advertising pixels, tags and similar technologies where those technologies are enabled.
  • Fraud and security information, including information used to identify suspicious transactions, misuse, security incidents or other risks.

Pillow Finder and health-related answers

The Pillow Finder may ask questions about comfort, sleeping position and symptoms such as neck stiffness, shoulder or back tension, headaches, tingling or numbness in order to provide an on-page product suggestion.

The health or symptom answers selected in the Pillow Finder are designed to remain within the page and are not intentionally transmitted to SAAI Retail OÜ or used to create a customer health profile.

Please do not send us medical records, diagnoses or other unnecessary health information through customer service, reviews or other free-text fields.

How we use personal information

We use personal information to:

  • operate the store and provide requested products and services;
  • process and fulfill orders;
  • accept and administer payments and refunds;
  • arrange shipping, tracking and delivery;
  • manage returns, complaints and customer service;
  • maintain customer accounts;
  • prevent fraud, abuse and security incidents;
  • maintain and improve website performance and functionality;
  • measure website usage and understand how visitors interact with the store;
  • conduct advertising and measure advertising performance where permitted;
  • send email marketing where permitted and maintain unsubscribe preferences;
  • comply with accounting, tax, legal and regulatory obligations; and
  • establish, exercise or defend legal claims.

Legal bases

Because SAAI Retail OÜ is established in Estonia, the General Data Protection Regulation applies to processing carried out in the context of our European Union establishment.

Depending on the processing activity, we rely on one or more of the following legal bases:

  • Performance of a contract, including processing necessary to accept, fulfill, deliver, return or refund an order.
  • Legal obligations, including accounting, tax, consumer-protection and regulatory requirements.
  • Legitimate interests, including operating and securing the store, preventing fraud, improving our services and establishing or defending legal claims, where those interests are not overridden by your rights.
  • Consent, including for non-essential cookies or tracking where consent is required and for marketing activities where consent is the applicable basis.

Cookies, analytics and advertising

We use Shopify, Google Analytics, Google Ads tracking, Google Tag Manager, Meta Pixel and Meta Ads, TikTok advertising and tracking technologies, Microsoft Advertising/Bing, and Cookiebot.

Cookiebot is used to provide cookie-consent and privacy-preference controls. You can use those controls to change or withdraw choices relating to non-essential browser cookies and tracking.

Detailed information about cookies, technologies, purposes and expiration periods is maintained in our Cookie Policy.

For further information about major technology providers, you can review:

Our website does not treat the legacy browser "Do Not Track" setting as a separate privacy request. You should use the Cookiebot controls provided on the website to manage non-essential browser cookies and tracking. Third-party analytics or advertising providers can collect information about browsing activity over time when their technologies are permitted to operate.

Who receives personal information

We disclose personal information only as appropriate for the purposes described in this Policy. Recipients can include:

  • Shopify and ecommerce infrastructure providers;
  • payment providers;
  • fulfilment, logistics and delivery providers;
  • email-marketing service providers;
  • review-functionality providers;
  • customer-support service providers;
  • fraud-prevention and security providers;
  • analytics and advertising providers;
  • professional advisers such as accountants, auditors or legal advisers; and
  • government authorities or other parties where disclosure is required by law or necessary to protect legal rights.

We do not provide full payment-card numbers or card security codes to our own general business systems.

International transfers

We sell to customers in the United States while SAAI Retail OÜ is established in Estonia and use service providers that operate internationally. Personal data can therefore be processed in Estonia, the United States and other countries in which our service providers operate.

Where European data-protection law requires safeguards for a transfer outside the European Economic Area, we use an appropriate lawful transfer mechanism, such as an adequacy decision, applicable contractual safeguards or another legally permitted mechanism.

How long we keep information

  • Order, transaction, invoice, accounting and tax records: generally 7 years after the end of the relevant financial year.
  • Customer-support records: generally 12 months after the matter is closed.
  • Ordinary complaint and legal-claim records: generally 3 years after resolution, with longer retention where a specific dispute, bodily-injury matter, litigation hold or legal requirement requires it.
  • Customer-account data: generally 24 months after account closure or last activity, except information that must remain with transaction or legal records.
  • Newsletter subscription data: until you unsubscribe or withdraw consent. Information necessary to record and demonstrate the opt-out or prior marketing permission is generally retained for 3 years afterward.
  • Cookie and marketing-consent evidence: generally 3 years after the relevant consent is replaced or withdrawn.
  • Analytics information under our control: generally up to 14 months.
  • Advertising identifiers and audience information under our control: generally up to 13 months.
  • Routine server and security logs: generally 30 days unless required for investigation of a security incident.
  • Fraud and security case records: generally 3 years after the case is closed.

If a written long-term product warranty is provided, information required to administer and document that warranty can be retained for the warranty period and for an additional period required for related contractual, accounting or legal records.

Your data-protection rights

Subject to the conditions and exceptions in applicable law, you can request:

  • access to your personal data;
  • correction of inaccurate personal data;
  • deletion of personal data;
  • restriction of processing;
  • data portability;
  • objection to processing based on legitimate interests; and
  • objection at any time to processing for direct marketing.

Where processing is based on consent, you can withdraw that consent at any time without affecting processing that was lawful before withdrawal.

To exercise these rights, email info@sleepanatomy.co. We may need information reasonably necessary to verify your identity and the request.

We respond to GDPR requests within one month of receipt. Where permitted because of the complexity or number of requests, that period can be extended by up to two additional months. If an extension is required, we will inform you within the initial one-month period.

Marketing choices

You can unsubscribe from marketing emails using the unsubscribe link contained in the message or by contacting info@sleepanatomy.co.

We do not conduct SMS marketing. A telephone number provided during checkout, delivery or customer support is used for transactional or operational purposes and does not constitute consent to promotional SMS messages.

Nevada privacy requests

We do not sell covered personal information for monetary consideration as "sale" is defined under Nevada's online privacy law.

A Nevada consumer can nevertheless submit a verified request concerning a future sale of covered information by emailing info@sleepanatomy.co. We will respond within 60 days after receiving a verified request, subject to a permitted extension of up to 30 additional days where reasonably necessary.

Automated decision-making

We do not use personal information to make decisions based solely on automated processing that produce legal effects or similarly significant effects concerning you.

Automated signals can be used to assist with fraud prevention, security or transaction-risk screening, but they are not used to make the type of solely automated significant decision described above.

Children

The store is intended for a general adult consumer audience and is not directed to children under 13. We do not knowingly collect personal information from children under 13.

If you believe a child under 13 has provided personal information to us, contact info@sleepanatomy.co so that we can review the situation and take appropriate action.

Security

We use reasonable technical and organizational measures intended to protect personal information against unauthorized access, loss, misuse, alteration or disclosure. No internet transmission or storage system can be guaranteed to be completely secure.

Complaints

You can contact us first at info@sleepanatomy.co with a privacy concern.

You also have the right under European data-protection law to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia. Information about the authority is available at https://www.aki.ee/.

Changes to this Policy

We may update this Privacy Policy to reflect changes in our services, practices, technology or legal obligations. The current version will be published on this page with its effective date.

Contact

SAAI Retail OÜ
Viru väljak 2, 10111 Tallinn, Estonia
Email: info@sleepanatomy.co

Customer service is available Monday to Friday, 9:00 AM–5:00 PM. We strive to respond within 24 hours on weekdays.