What we do with your data
Short version: we collect as little as possible. No advertising trackers, no data selling, no consent banner to click away.
Last updated: September 2026
The one cookie we set
A single functional cookie, pixelcake-locale, remembers whether you prefer English or Swedish so you land on the right version next time. It stores nothing but a language code, expires after a year, and is never used to profile you. Because it is strictly functional, no consent banner is required.
Analytics without tracking
We use Vercel Analytics to see which pages are read. It is cookieless and aggregated: no cross-site tracking, no advertising profiles, no selling data onward. We cannot identify you from it.
When you use our forms
Whether you request a free review or use the contact form, the details you enter — your name, email, website address, and message — are emailed to us so we can reply. We also record your browser user agent and approximate request origin to filter spam. We keep inquiries only as long as needed to answer them and follow up, and we never add you to a marketing list without asking. To prepare the review we may check the submitted website address with third-party website-audit services (for example Google PageSpeed Insights); their reports concern the public website only and may be publicly viewable on those services. If we send you the review as a link, we count how many times the page is opened and when, but not who opened it.
When we reach out to businesses that haven't contacted us
We look for small businesses that might need a more modern website. The starting point is public registry data from Bolagsverket and Statistics Sweden (via the BolagsAPI service) — organisation number, legal form, address, industry — together with what the company's own public website shows. We process it on the basis of a balancing of interests (GDPR art. 6(1)(f)): our interest in offering our services to businesses in our trade and region. We contact the company's role address first (info@, for example) and only record named contact people when they have published their role themselves. Sole traders are never imported automatically. You can say no at any time: reply UNSUBSCRIBE to an email or write to us, and the company goes on our do-not-contact list for good — even if its details reappear in the registry later. Personal data about contact people we have had no contact with for 18 months is deleted automatically.
When we've visited you
Sometimes we stop by and leave a postcard with a QR code to a review of your website on pixelcake.se. The page isn't searchable and stops working after four months. We count how many times it is opened and when, but not who opened it — no IP address and no browser details. If you write to us through the page, we keep what you write as an enquiry, just as from the contact form. If we talk to someone in person, we note what concerns the business and its website, and a name only if the person gave it themselves at work. If you don't want to hear from us again, just say so and it applies for good.
Your rights
Under GDPR you can ask what we hold about you, request a copy, ask us to correct it, or ask us to delete it. Email us and we will action it within 30 days.
Questions?
Email us and a human will answer.
hello@pixelcake.se