Privacy policy

Data controller

Who is responsible for your data.

Paperphyte AB (corporate ID 559135-5721) is the data controller for the information you share with us. Postal address: KIVRA: 559135-5721, 10631 Stockholm.

When you email us

Direct email.

If you email us, your email address and the contents of your message end up in our inbox. We use that information to reply and, if relevant, continue the conversation around an engagement.

The email is kept for as long as the conversation is active. If it leads to a business relationship we keep the records for as long as the Swedish bookkeeping law requires (see “How long we keep it” below).

When you call or send postal mail

Phone and physical mail.

If you call us we may note your name, phone number, and a short summary of what the call was about — just enough to follow up. If you mail us at our KIVRA address, we read the letter the same way we would an email. In both cases we only keep what we need for follow-up and a possible contract.

When we have an engagement together

During the contract.

During an engagement we typically process contact details for you and your colleagues, invoicing and contract information, and the material you share with us to allow us to do the work (for example access to source code, environments, or documentation). We process it only to deliver what we have agreed, and access is kept limited to the people in the collective who need it.

If the engagement requires us to process personal data on your behalf, we sign a separate data processing agreement (DPA) before we start.

When you visit this website

What happens in the browser.

We use Matomo as our analytics tool to understand how the website is used — for example which pages are visited, where traffic comes from and how long visitors stay. It helps us improve the content and notice operational issues.

Before we enable Matomo we ask for your consent in a cookie banner. Until you accept, Matomo sets no cookies, records no page views and does not receive your IP address. If you accept, two first-party cookies (_pk_id and _pk_ses) are set with an anonymous visitor ID and session ID, and Matomo receives your IP address to determine roughly where the visit is from geographically.

Matomo runs on Matomo Cloud (paperphyte.matomo.cloud) operated by InnoCraft Ltd in New Zealand, with data stored within the EU/EEA. We do not share this data onwards for marketing. You can change your choice at any time via “Manage cookies” in the footer.

Regardless of your choice, your browser fetches content from several services when you load a page: the site itself is served by Vercel (our hosting provider), text and images from Sanity's CDN, and fonts from Google Fonts. Those parties can see your IP address in their service logs.

Which cookies and local storage entries are used is described in detail in our cookies policy at /policy/cookies.

Legal basis

Under GDPR.

When you contact us about a possible business relationship, we process your data based on legitimate interest (GDPR Article 6.1 f) — our interest in being able to respond to inquiries and assess whether a collaboration is feasible. If we enter into an agreement, the processing shifts to the legal basis of contract (Article 6.1 b). For accounting and invoice records the basis is legal obligation (Article 6.1 c).

For website operation itself — including IP addresses processed by our providers for hosting, CDN and fonts — the legal basis is legitimate interest (Article 6.1 f) in delivering, monitoring and securing the site.

For visitor analytics via Matomo, the legal basis is your explicit consent (Article 6.1 a), given in our cookie banner. The storage of and access to cookies on your device is grounded in chapter 6, section 18 of the Swedish Electronic Communications Act (LEK). You can withdraw consent at any time via “Manage cookies” in the footer, after which we stop recording new visits.

How long we keep it

Retention per category.

• Inquiries that lead nowhere — normally cleared within 12 months.
• Material connected to an active engagement — for as long as the engagement runs.
• Invoices and bookkeeping records — 7 years as required by the Swedish bookkeeping law, then deleted.

Who we share data with

Vendors and authorities.

We don't sell or share your data with third parties for marketing purposes.

To operate the business we use the following providers that process data on our behalf:

• Vercel Inc. (USA) — website hosting and delivery.
• Sanity AS (Norway) — content management (CMS) and CDN for text and images.
• InnoCraft Ltd (New Zealand) — Matomo Cloud, analytics tool processing page views and IP addresses; data stored within the EU/EEA.
• Google LLC (USA) — Google Fonts loads typefaces directly from Google when the page opens. Google sees the visitor's IP address at load time.

We also use providers for email, accounting and other cloud infrastructure. Data processing agreements are signed where required. If an authority requests disclosure under law, we comply.

Your rights

What you can ask of us.

Under GDPR you have the right to:

• Request a copy of the data we hold about you.
• Have inaccurate data corrected.
• Have data deleted where the law permits.
• Object to or restrict processing.

Reach out and we will help you. If you think we have got something wrong you can also file a complaint with the Swedish Authority for Privacy Protection (IMY).