Privacy policy

Scope

This policy covers Swifle’s websites, correspondence and the common privacy information for our products. A product’s privacy notice describes its specific processing and takes precedence for that processing. Read both notices together.

Who is responsible

Swifle OÜ is the data controller for the processing described here. You can contact us at [email protected].

You’ll find our registered office and company details in our legal notice.

What we process and why

Website visits. Hosting and network providers process IP addresses, requested pages, timestamps and technical browser and request information, including in access and security logs, to deliver and protect our websites. These technical details are necessary to serve your request. The legal basis is our legitimate interest in operating reliable, secure websites (Article 6(1)(f) GDPR).

Audience measurement. We count visits to this website with a cookie-less measurement tool that we host on our own server in the European Union. It records the pages viewed, the referring site, the browser, operating system and device type, the screen size, the language and an approximate location (country, region and city) derived from the IP address. The IP address itself is not stored: it is only combined with other request details and a regularly rotated secret to derive a temporary, non-reversible identifier that groups the page views of one visit. Nothing is placed on your device, we do not follow you across websites and the statistics cannot be linked to you. The legal basis is our legitimate interest in understanding how our website is used (Article 6(1)(f)).

Correspondence. When you email us or use our contact form, we receive your email address, your name if provided, your message and any attachments sent by email. We use this information to respond and follow up. General enquiries are handled in our legitimate interest in communicating with you (Article 6(1)(f)). Requests to enter into or perform a contract with you are handled under Article 6(1)(b). Providing this information is voluntary, but we may be unable to respond without relevant details.

Form security. Cloudflare Turnstile checks technical browser and device signals, including your IP address, to distinguish people from automated submissions. We also use temporary request counters to limit abuse. This processing serves our legitimate interest in protecting our contact service (Article 6(1)(f)). You can contact us by email if you prefer not to use the form.

Legal obligations. We process information where necessary to comply with applicable law, including handling privacy requests and responding to binding requests from competent authorities (Article 6(1)(c)).

We do not sell personal data, follow you across websites or build advertising profiles. We do not use personal data for advertising or make solely automated decisions that have legal or similarly significant effects on you.

Cookies and tracking

We do not use advertising cookies, tracking pixels or third-party analytics. Our own audience measurement, described above, sets no cookies and stores nothing on your device. Fonts and images are served with the website. The contact page uses essential session and security cookies to protect form submissions. These expire after two hours of inactivity. Your browser may also retain navigation state to support moving between pages.

Cloudflare may use security cookies to protect this website and remember completed security checks. Their purposes and lifetimes are explained in Cloudflare’s cookie documentation.

Service providers and transfers

Hosting. Laravel Cloud, operated by Laravel Holdings Inc., hosts our websites in the European Union on Amazon Web Services (AWS) infrastructure. Laravel and its infrastructure providers process technical request data and operational logs to run the service. See Laravel’s data-processing agreement.

Audience measurement. Our visit statistics run on a dedicated server we rent from Hetzner Online GmbH in Germany. The data stays under our control and is not shared with any third-party analytics provider.

Delivery and security. Cloudflare, Inc. provides content delivery and protection against malicious traffic. Requests pass through its network, which processes IP addresses and technical request and security information. Our contact form also uses Cloudflare Turnstile. Cloudflare also processes its security signals as a controller to improve bot detection, as explained in the Turnstile privacy addendum and Cloudflare’s data-processing terms.

Email. Fastmail Pty Ltd, based in Australia, handles correspondence, including message contents, attachments and sender and recipient details. The primary copy of our mailbox is stored in the European Union, with replicas, backups and technical logs in the United States. See Fastmail’s privacy policy and data protection agreement.

Providers acting on our behalf are subject to applicable confidentiality and data-protection obligations. We may disclose information where required by law.

Providers may process information outside the European Economic Area, including in the United States. An EEA hosting location does not restrict all network, support or email processing to the EEA. Where required, transfers are covered by an adequacy decision or appropriate safeguards, such as European Commission Standard Contractual Clauses. Contact us for details or a copy of the safeguards applicable to your information.

How long we keep information

We retain correspondence until your enquiry and necessary follow-up are resolved. Records needed for a contract, legal obligation or dispute are retained for that purpose and the applicable legal period, then deleted.

Laravel Cloud retains our routine application and access logs for up to seven days. Temporary counters used to limit contact-form abuse expire within one hour.

Cloudflare’s retention of security information depends on the service involved and whether it is needed to detect abuse, investigate incidents or meet legal obligations. Its privacy policy explains these criteria.

Records needed to investigate a security incident or handle a legal claim may be retained for that purpose and the applicable legal period. Visit statistics are anonymous and cannot be linked to you; we keep them for as long as we operate this website. We do not maintain a database that identifies individual visitors.

Your rights

Subject to the GDPR’s conditions, you may request access, correction, erasure, restriction or portability of your personal data. Where consent is the legal basis, you may withdraw it without affecting earlier lawful processing.

Right to object. Where we rely on legitimate interests, you may object at any time on grounds relating to your particular situation. We will stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.

Write to [email protected]. We respond without undue delay and normally within one month. We will explain any permitted extension within that month. We may ask for information reasonably necessary to verify your identity.

You may complain to the Estonian Data Protection Inspectorate or the supervisory authority in the EEA where you live, work or believe an infringement occurred.

Changes

We update this policy when our practices change. We provide further notice, and request consent, where required by law.