How we handle
your personal data.

Who is responsible?

Yurii Bakurov (Tillgänglig Kassa) is the data controller for the processing described in this notice. For privacy questions or to exercise your rights, email [email protected].

When you visit the website

Cloudflare hosts and protects this website through Cloudflare Pages (Cloudflare, Inc.). It processes technical data such as your IP address, requested page, access time, browser details and connection information.

We use Cloudflare Web Analytics for aggregate statistics and performance measurement. It may process the page hostname and path, referring site, country, browser and device type, operating system, loading metrics and Core Web Vitals. Cloudflare says Web Analytics uses no cookies or localStorage and does not track individual visitors over time through IP addresses, user agents or other fingerprinting. Query strings are not collected. A JavaScript beacon is loaded from static.cloudflareinsights.com. With automatic activation, metrics go to the site’s own /cdn-cgi/rum address; with the optional manual beacon, they go to cloudflareinsights.com/cdn-cgi/rum.

Read Cloudflare’s Web Analytics privacy description, how the beacon and metrics are transferred and the Web Analytics FAQ.

When the contact form is enabled, it uses Cloudflare Turnstile to block automated submissions. It processes technical signals such as your IP address and browser and connection details. Cloudflare processes these signals on our behalf to protect the site, and as a separate controller to improve its bot detection. Read Cloudflare’s Turnstile privacy notice.

The legal basis for delivery, security, Turnstile and Web Analytics is legitimate interests under GDPR Article 6(1)(f). Our interests are to provide a secure, working website, limit spam and understand overall use and performance. Statistics are not used for targeted advertising or visitor profiling.

Cloudflare retention: Cloudflare says that Pages Functions real-time logs are not stored; aggregate Functions metrics can be viewed for up to three months. Cloudflare retains unsampled analytics data for seven days, then keeps reduced-volume data for longer. Statistics are available for six months. Cloudflare’s general policy otherwise bases retention on purpose, the nature of the data, risk and legal obligations, after which data is deleted or blocked from further use.

Sources: Pages Functions real-time logs, Pages Functions metrics and Web Analytics retention.

When you use the form or email us

The form collects your name, email address, online shop URL (optional), message and confirmation that you want a reply. It also sends the form language (Swedish or English) and the technical Turnstile check. A hidden check rejects automated spam attempts; its contents are not forwarded as an enquiry.

The checkbox confirms that you want a reply to your enquiry. We use your details to answer your enquiry and discuss possible work. We rely on legitimate interests under GDPR Article 6(1)(f): responding to business enquiries and assessing possible projects.

The form sends your enquiry through Resend to our Apple iCloud+ mailbox. After the enquiry has been sent, the supplied email address receives an automatic confirmation through Resend in the form’s language. Its purpose is to confirm receipt, on the same legal basis as the enquiry. It does not include what you wrote and follows the retention rules below. If the form is unavailable, email [email protected] instead. We then process the sender address, name and anything you write or attach. Do not send passwords, sensitive personal data or customer data.

We aim to reply by email within 24 hours.

Contacting us is optional. We cannot reply without working contact details. You do not need to enter your name or contact details to browse the site. Technical data is processed as described above.

How long do we keep data?

We delete enquiries and related email, including automatic confirmations, that do not lead to work 12 months after the last contact. If we work together, we keep necessary correspondence for the duration of the agreement. After that, we retain only records needed for legal claims, until the relevant limitation period expires or an ongoing claim is resolved.

Resend retains email content and logs for 30 days on its standard Free, Pro and Scale plans. Remaining customer data is deleted within 90 days of account closure; backups persist for seven days. Enterprise plans may have different retention. Messages in Apple iCloud Mail also follow our own deletion rules and Apple’s technical retention under its iCloud terms. We do not state a separate Apple deadline that Apple has not published for the selected mailbox.

Which providers receive data?

Cloudflare provides hosting, Pages Functions, Turnstile and cookieless Web Analytics. Resend sends the enquiry to our mailbox and the confirmation to the supplied email address. Apple iCloud+ and iCloud Mail receive and store email. The recipient’s own email provider also processes messages when we reply.

Roles and terms: Cloudflare processes customer logs and content as a processor under a published DPA incorporated into the main agreement, such as the Self-Serve Subscription Agreement; we do not claim a separately signed DPA. For Turnstile, Cloudflare is a processor for site protection and an independent controller for improving bot detection. Resend’s standard DPA is incorporated when a customer accepts its terms, and Resend acts as a processor for sent messages. Apple iCloud+ is used under Apple’s iCloud terms; we do not claim that a processor agreement automatically exists for this consumer service.

Sources: Cloudflare’s data processing agreement, incorporated into its main agreement, Cloudflare’s Self-Serve Subscription Agreement, Cloudflare’s Turnstile addendum, Resend’s data processing agreement and Apple’s iCloud terms.

Also read Cloudflare’s privacy policy, Resend’s privacy policy, Resend’s subprocessors and Apple’s privacy policy.

Data may be disclosed to an authority when required by law, or to an adviser when needed for a legal claim. We do not sell contact details.

Processing outside the EU/EEA

Transfers and safeguards: Cloudflare and Resend may process personal data outside the EU/EEA, including in the United States. Their published terms provide for EU standard contractual clauses and, where applicable, the EU–US Data Privacy Framework. Resend stores customer data in the United States even when emails are sent from a European region. Apple says EEA data is handled by Apple Distribution International in Ireland, may usually be stored by Apple Inc. in the US, and that international transfers are governed by standard contractual clauses.

Resend’s European sending region determines where a message is sent from; it does not move storage to the EU. Sources: Cloudflare’s DPA, Resend’s information on storage and transfers, Resend’s DPA and Apple’s privacy policy.

Email [email protected] for details of the applicable safeguards or a copy of the relevant contractual clauses. See also IMY’s information on transfers outside the EU/EEA.

Your rights

You can request access, correction, erasure or restriction of processing. You can object to processing based on legitimate interests. Exceptions may apply. We do not make solely automated decisions that have legal or similarly significant effects on you. The contact form uses an automated spam check when enabled.

Email [email protected] and explain what you want to do. We respond to requests to exercise your rights without undue delay and within one month. For complex or numerous requests, we may extend this by up to two further months. We will explain any extension within the first month. We may need to verify your identity, but ask only for information needed for that purpose.

You have the right to complain to the Swedish Authority for Privacy Protection (IMY). You do not have to contact us first. Read more about your rights at IMY.