How this site handles your data

Who is responsible

This website is operated by Alex Hedström (“I”, “me”). I am the controller for personal data collected through this site.

Postal address (newsletter / compliance): Alex Hedström, Severin Cavallinsgatan 16 D, 235 35 Vellinge, Sweden

Questions about privacy: use the contact form.

What I collect

Depending on how you use the site, I may process:

• Contact and lead forms — name, email, message, and optional phone, company, or website URL. The same fields may be collected from popups on public pages.
• Newsletter — email and optional name; confirmation and unsubscribe tokens. That includes drip sequences you opted into.
• Payment links (PayLinks) — name, email, and billing details you enter for Stripe Checkout; payment status is updated via Stripe webhooks.
• Download links — when you open a private file link I send you, I may store a hashed IP address, browser user agent, and whether the download succeeded (including failed password attempts). File-share passwords are stored as one-way hashes, not in plaintext. The file itself is kept in private storage and is not published at a public URL.
• Technical data — IP address and related request metadata used for rate limiting and abuse prevention. Public forms also complete a self-hosted ALTCHA proof-of-work check so I can tell a person from a bot.

Honeypot fields on public forms are ignored when empty and are not stored as meaningful personal data.

Why I use it

• To reply to enquiries and evaluate project fit.
• To send newsletters and drip sequences you opted into (double opt-in) and to honor unsubscribe requests.
• To process payments you initiate through PayLinks.
• To share files through private download links and keep a record of access.
• To keep the site secure (rate limits and spam controls).

Legal bases under GDPR typically include consent (newsletter), contract / pre-contract (enquiries, payments, and file shares you request), and legitimate interests (security and abuse prevention).

Where it is processed

The site is self-hosted (Coolify). Data may be processed by service providers acting on my behalf, including:

• Coolify / self-hosted infrastructure (application hosting)
• Supabase (database, authentication, and file storage)
• useSend (transactional and newsletter email)
• Redis (rate limiting and form abuse protection)
• Umami (self-hosted page analytics on public pages)
• Stripe (payment processing for PayLinks)

Landing pages may embed videos from YouTube (privacy-enhanced / youtube-nocookie) or Vimeo. Those providers process data under their own policies.

Some providers may process data outside the EU/EEA. Where that happens, appropriate safeguards (such as standard contractual clauses) are expected as part of their terms.

Cookies and similar technology

This site uses cookies. Some are necessary for the site to work. With your consent, we also use cookies for analytics and embedded videos. You can accept all, reject optional cookies, or choose your preferences. You can change your choice at any time via cookie settings.

Necessary — required for the website to function, including remembering your cookie choice.

Analytics — if you allow it, we measure how visitors use the site. This is not used for advertising.

Embedded videos — if you allow it, videos hosted on other websites can play here. Those sites may set their own cookies.

Your browser may also store a small local flag so popups you have already seen are not shown again on every visit. That flag stays on your device and is not sent to me.

How long I keep it

• Contact and lead submissions — kept while useful for the conversation and follow-up, then deleted or archived when no longer needed.
• Newsletter subscribers — until you unsubscribe or your address is removed.
• Payment records — as needed for accounting, dispute handling, and legal obligations (Stripe also retains records under its policies).
• Download links and their access logs — until the link is deleted, or as long as needed to share the file and review access.
• Security logs and rate-limit data — short retention for abuse prevention.

Your choices and rights

You can unsubscribe from the newsletter via the link in each email or the unsubscribe page. You may request access, correction, deletion, or restriction of your personal data, and object to certain processing, by contacting me. If you are in the EU/EEA, you may also lodge a complaint with your local supervisory authority.

Children

This site is not directed at children under 16, and I do not knowingly collect their personal data.

Changes

I may update this policy when the site or providers change. The “Last updated” date at the top will change when that happens.