Privacy policy

Who is responsible

This website is operated by Alex Hedström (“I”, “me”). I am the controller for personal data collected through this site.

Postal address (newsletter / compliance): Alex Hedström, Severin Cavallinsgatan 16 D, 235 35 Vellinge, Sweden

Questions about privacy: use the contact form.

What I collect

Depending on how you use the site, I may process:

• Contact and lead forms — name, email, message, and optional phone, company, or website URL.
• Newsletter — email and optional name; confirmation and unsubscribe tokens.
• Payment links (PayLinks) — name, email, and billing details you enter for Stripe Checkout; payment status is updated via Stripe webhooks.
• Technical data — IP address and related request metadata used for rate limiting and abuse prevention; basic usage analytics via Vercel Analytics.
• Admin accounts — if you are invited to the admin area: email, name, password hash, and login/security events (including email one-time codes).

Honeypot fields on public forms are ignored when empty and are not stored as meaningful personal data.

Why I use it

• To reply to enquiries and evaluate project fit.
• To send newsletters you opted into (double opt-in) and to honor unsubscribe requests.
• To process payments you initiate through PayLinks.
• To keep the site secure (rate limits, spam controls, admin authentication).
• To understand aggregate traffic (Vercel Analytics) and improve the site.

Legal bases under GDPR typically include consent (newsletter), contract / pre-contract (enquiries and payments), and legitimate interests (security, abuse prevention, and basic analytics).

Where it is processed

The site is hosted on Vercel. Data may be processed by service providers acting on my behalf, including:

• Vercel (hosting, analytics, file storage)
• Neon (database)
• useSend (transactional and newsletter email)
• Upstash (rate limiting)
• Stripe (payment processing for PayLinks)

Some providers may process data outside the EU/EEA. Where that happens, appropriate safeguards (such as standard contractual clauses) are expected as part of their terms.

Cookies and similar technology

Public pages do not use advertising cookies. Vercel Analytics is privacy-oriented and does not rely on invasive tracking cookies for its core metrics.

Session cookies are used for the admin area (login and two-factor verification) and are not set for ordinary site visitors.

How long I keep it

• Contact and lead submissions — kept while useful for the conversation and follow-up, then deleted or archived when no longer needed.
• Newsletter subscribers — until you unsubscribe or your address is removed.
• Payment records — as needed for accounting, dispute handling, and legal obligations (Stripe also retains records under its policies).
• Security logs and rate-limit data — short retention for abuse prevention.

Your choices and rights

You can unsubscribe from the newsletter via the link in each email or the unsubscribe page. You may request access, correction, deletion, or restriction of your personal data, and object to certain processing, by contacting me. If you are in the EU/EEA, you may also lodge a complaint with your local supervisory authority.

Children

This site is not directed at children under 16, and I do not knowingly collect their personal data.

Changes

I may update this policy when the site or providers change. The “Last updated” date at the top will change when that happens.