What we collect

• The contact form: name, email address and whatever you write in the message. Voluntary, and only when you choose to send it.
• Visitor statistics: anonymized usage data via Google Analytics and Microsoft Clarity — but only if you said yes in the cookie box. Clarity records how the pages are used (clicks and scrolling) with form fields and sensitive data masked. Details in the cookie policy.
• Marketing: say yes in the cookie box and the Meta pixel measures which ads lead to contact. Events are sent both from your browser and from our server — the latter with your IP address and browser information. If you get in touch, your name and email come along, hashed with SHA-256 and never in plain text. Say no and nothing is sent.

What we do with it

Contact details are used for exactly one thing: replying to you and following up on what you asked about (legal basis: legitimate interest — you did reach out, after all). Statistics are used to make the site better. Nothing is sold, shared with third parties for marketing, or put in newsletters you never asked for.

How long we keep it

Form submissions arrive as email and are kept for as long as the conversation is relevant — then they're cleared out. If you become a client, accounting and contract requirements apply to what must be kept.

Companies we find ourselves

We keep a register of companies in Malmö. We collect the details (name, address, phone, website and email address) from open sources, mainly reco.se and the company's own website. We look at the website from the outside, the way a visitor sees it, with a robot that obeys robots.txt and introduces itself at /en/bot. Legal basis: legitimate interest. We only email confirmed limited companies, never sole traders.

The company gets one email from us with a link to a page of its own, listing a few things we noticed on the website. We count how many times the page has been opened, without IP addresses, and the page stops working after 90 days. If you write to us through the page we keep your email address and message, and delete them 90 days after we have dealt with the request. Personal email addresses (such as firstname.lastname@) are kept if they appear on the website, but we do not use them for cold emails. We note replies to our emails (that a reply has arrived, the sender's address and the time) so that we stop sending more emails; our code does not read the content of a reply, Sebastian reads it in his ordinary inbox. The address in the note is deleted 90 days after we have dealt with the reply.

Every email has a link where the company can click to be struck from our list. You can also reply to the email or write to sebastian@kaftsmallonline.se. We then keep a block, so you get no more emails from us. If you want the data deleted entirely that works too, but we can then no longer remember that you do not want to hear from us.

Check your site

If you fill in the "Check your site" box on the front page, we store your email address and the web address you gave us. We send a confirmation link to that address (it is valid for 24 hours and works once), and only after you click it do we look at the site. We then email you the link to the page with what we found, and we store that the page has been opened. If you want me to call you, you can leave your name and phone number on the page; that is optional, and then we store those too. The details are also sent to Sebastian by email so that he can call you: your email address when the page is ready, and your name and phone number when you leave them.

The data is used to carry out the check you asked for, email you the result and, if you left a number, call you back (legal basis: legitimate interest, you asked for it). The analysis only reads the site's public pages, the way a visitor does, with the robot described at /en/bot. We store no IP address and use no pixel in this flow. Email address, name and phone number are deleted 90 days after the request, and the page stops working then. If you never click the confirmation link, your email address is deleted within three days. Checking your site does not sign you up for a newsletter or cold emails. To be deleted sooner, email sebastian@kaftsmallonline.se.

Your rights

You can request access, correction or deletion of your data at any time — email sebastian@kaftsmallonline.se and it gets sorted without fuss. If you're unhappy with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (imy.se).

Data controller

Käftsmäll online AB, through Sebastian Kentander. Questions? Same address as above — you'll get an answer from a human, not a department.