Privacy policy

Data controller

Who is responsible for your data.

Paperphyte AB (corporate ID 559135-5721) is the data controller for the information you share with us. Postal address: KIVRA: 559135-5721, 10631 Stockholm.

When you email us

Direct email.

If you email us, your email address and the contents of your message end up in our inbox. We use that information to reply and, if relevant, continue the conversation around an engagement.

The email is kept for as long as the conversation is active. If it leads to a business relationship we keep the records for as long as the Swedish bookkeeping law requires (see “How long we keep it” below).

When you call or send postal mail

Phone and physical mail.

If you call us we may note your name, phone number, and a short summary of what the call was about — just enough to follow up. If you mail us at our KIVRA address, we read the letter the same way we would an email. In both cases we only keep what we need for follow-up and a possible contract.

When you message us on WhatsApp

Chat via Meta.

The contact page offers WhatsApp as the fastest way to reach us. If you message us there we see your phone number, your WhatsApp name and the contents of the message, and we use it the same way we would an email: to reply and, if relevant, continue the conversation around an engagement.

WhatsApp is provided by Meta Platforms Ireland Ltd. Messages are end-to-end encrypted between you and us, but Meta processes metadata — such as phone numbers, timestamps and device information — under its own privacy policy, which we don't control. If you would rather avoid Meta, email, phone or postal mail work just as well.

Conversations that lead nowhere are deleted from WhatsApp within the same period as email (see “How long we keep it” below).

When we have an engagement together

During the contract.

During an engagement we typically process contact details for you and your colleagues, invoicing and contract information, and the material you share with us to allow us to do the work (for example access to source code, environments, or documentation). We process it only to deliver what we have agreed, and access is kept limited to the people in the collective who need it.

If the engagement requires us to process personal data on your behalf, we sign a separate data processing agreement (DPA) before we start.

When you visit this website

What happens in the browser.

We use Matomo as our analytics tool to understand how the website is used — for example which pages are visited, where traffic comes from and how long visitors stay. It helps us improve the content and notice operational issues.

Before we enable Matomo we ask for your consent in a cookie banner. Until you accept, Matomo sets no tracking cookies, records no page views and receives no visit data. If you accept, two first-party cookies (_pk_id and _pk_ses) are set with an anonymous visitor ID and session ID, and Matomo receives your IP address to determine roughly where the visit is from geographically. If you decline, Matomo instead sets a cookie (mtm_consent_removed) that only marks that you said no.

Matomo runs on Matomo Cloud (paperphyte.matomo.cloud) operated by InnoCraft Ltd in New Zealand, with data stored within the EU/EEA. We do not share this data onwards for marketing. You can change your choice at any time via “Manage cookies” in the footer.

Regardless of your choice, your browser fetches content from several services when you load a page: the page itself and the typefaces are served by Vercel (our hosting provider), text and images by Sanity's CDN, and the analytics script by Matomo Cloud's CDN. Those parties can see your IP address in their service logs. The typefaces are hosted on our own domain — no requests go to Google Fonts.

If you react to a blog post (like, dislike, love, applaud), the post's address and the reaction type are sent to our function on Vercel, which increments a shared counter in a database at Upstash. Your IP address is used there only to limit the number of reactions per ten minutes and is not stored with the counter. What you yourself have reacted to is kept in your own browser, not with us.

Which cookies and local storage entries are used is described in detail in our cookies policy at /policy/cookies.

Legal basis

Under GDPR.

When you contact us about a possible business relationship (by email, phone, postal mail or WhatsApp), we process your data based on legitimate interest (GDPR Article 6.1 f) — our interest in being able to respond to inquiries and assess whether a collaboration is feasible. If we enter into an agreement, the processing shifts to the legal basis of contract (Article 6.1 b). For accounting and invoice records the basis is legal obligation (Article 6.1 c).

For website operation itself — including IP addresses processed by our providers for hosting, the content CDN, delivery of the analytics script and abuse protection for the reaction counters — the legal basis is legitimate interest (Article 6.1 f) in delivering, monitoring and securing the site.

For visitor analytics via Matomo, the legal basis is your explicit consent (Article 6.1 a), given in our cookie banner. The storage of and access to cookies on your device is grounded in chapter 6, section 18 of the Swedish Electronic Communications Act (LEK). You can withdraw consent at any time via “Manage cookies” in the footer, after which we stop recording new visits.

How long we keep it

Retention per category.

• Inquiries that lead nowhere — normally cleared within 12 months.
• Material connected to an active engagement — for as long as the engagement runs.
• Invoices and bookkeeping records — 7 years as required by the Swedish bookkeeping law, then deleted.

Who we share data with

Vendors and authorities.

We don't sell or share your data with third parties for marketing purposes.

To operate the business we use the following providers that process data on our behalf:

• Vercel Inc. (USA) — website hosting and delivery.
• Sanity AS (Norway) — content management (CMS) and CDN for text and images.
• InnoCraft Ltd (New Zealand) — Matomo Cloud, analytics tool processing page views and IP addresses; data stored within the EU/EEA.
• Upstash, Inc. (USA; database located in the EU) — Redis database for the blog posts' reaction counters. Stores anonymous totals and, for at most ten minutes, IP addresses used to limit the number of reactions.
• Meta Platforms Ireland Ltd (Ireland) — WhatsApp, if you choose to contact us that way. Meta processes phone numbers and metadata under its own policy; message content is end-to-end encrypted.
• QRGeno (qrgeno.com) — the service behind the QR code on the contact page. If you scan or click it you pass through api.qrgeno.com before being forwarded to LinkedIn, and the time and IP address are recorded as scan statistics. Nothing is recorded until you scan or click.

We also use providers for email, accounting and other cloud infrastructure. Data processing agreements are signed where required. If an authority requests disclosure under law, we comply.

Your rights

What you can ask of us.

Under GDPR you have the right to:

• Request a copy of the data we hold about you.
• Have inaccurate data corrected.
• Have data deleted where the law permits.
• Object to or restrict processing.

Reach out and we will help you. If you think we have got something wrong you can also file a complaint with the Swedish Authority for Privacy Protection (IMY).