Privacy policy

The short version: I collect only what is needed to answer your enquiry, deliver a resource you request, protect the forms from abuse, and understand whether the site works.

Last updated: 29 August 2026

Who is responsible for your data

Filip Blomqvist AB, org.nr 559502-2772, Gothenburg, Sweden, is the data controller for this website.

Questions or privacy requests: filip@vexxa.se or +46 76 84 72 24.

What I collect and why

Contact messages

When you use the contact form, I receive your name, email address, business name and service choice if provided, and the message you write. I use these details to reply and discuss your project. The legal basis is taking steps at your request before entering a contract and my legitimate interest in answering people who contact me (GDPR Article 6(1)(b) and 6(1)(f)).

Project applications

The guided application asks about the service, business, existing website, goal, budget range, timeline, desired outcome, name, email, and any optional notes. Nothing is sent to my server until you submit the final step. The browser may temporarily keep only non-personal choices such as service, goal, budget range, and timeline in session storage so an accidental refresh does not lose your place; it is removed after submission or when the browser session ends.

I use the submitted details to assess fit, give useful advice, prepare a fixed quote when the scope is clear, and decide whether to send a private booking link. The legal basis is GDPR Article 6(1)(b) and 6(1)(f).

Website Project Brief

To send the free project brief, I collect your email address, an optional first name, and the project-stage option you select. Without marketing consent, Brevo sends one transactional email containing the brief and the address is not added to a marketing list.

If you separately tick the optional marketing box, Brevo sends a double-opt-in confirmation. Only after you confirm is the address added to the relevant list. The planned sequence is three practical emails: the brief immediately after confirmation, delay-prevention tips after about two days, and an invitation to request a fixed quote after about five days. You can unsubscribe in every marketing email. The legal basis for this optional sequence is consent (GDPR Article 6(1)(a)); withdrawing consent does not affect processing that happened before withdrawal.

Form security and technical data

Forms use Cloudflare Turnstile to distinguish legitimate requests from automated abuse. The widget and the server-side verification process technical signals such as browser characteristics, the requested action, hostname, and IP address. On my side, the IP address is converted to a one-way hash for short-lived rate limiting; it is not added to your enquiry or marketing profile. Cloudflare may process network and security logs as part of operating the service.

Hidden honeypot fields and a minimum form-completion time are also used to stop spam. A filled honeypot receives a generic response and is not delivered.

Cookies and analytics

This site uses Cloudflare Web Analytics for aggregate page-view and performance information. Cloudflare states that this product does not collect or use visitors’ personal data and does not use cookies, local storage, or fingerprinting for usage metrics. The analytics beacon is included only in the production build, not in local previews.

To understand the project funnel, a first-party endpoint records only allowlisted aggregate events such as which CTA category was chosen, which numbered application step was reached, and whether a form was completed. Each event contains the event name, page path without a query string, language, a broad source category, and a numeric step or consent value where relevant. It does not store names, email addresses, messages, full URLs, IP addresses, user IDs, cookies, or device fingerprints. The endpoint is disabled in local previews and the browser does not send these events when Do Not Track or Global Privacy Control is enabled.

The site does not use advertising trackers. Cloudflare may use strictly necessary security cookies when required to provide or protect its network services; these are not used by me for advertising.

Processors and data locations

  • Cloudflare hosts and serves the site, protects forms with Turnstile, and provides aggregate Web Analytics, Analytics Engine event counts, and rate limiting. Cloudflare can process data globally and provides a data-processing addendum and transfer safeguards, including the EU-US Data Privacy Framework and EU Standard Contractual Clauses where applicable. See Cloudflare’s privacy policy and Turnstile documentation.
  • Brevo sends contact and project notifications to me, sends the requested project brief, and, only after consent and confirmation, sends the short email sequence. Brevo states that its main data-storage servers are in the European Union. See Brevo’s privacy policy.

I do not sell personal data or share it for third-party advertising.

How long I keep data

  • Contact messages and project applications in my inbox: up to 12 months after the last exchange, unless we work together.
  • Brevo transactional delivery logs for form notifications and one-time briefs: one month; message previews are not stored.
  • Marketing contacts: until you unsubscribe, withdraw consent, or after 24 months without engagement, whichever comes first.
  • Short-lived rate-limit keys: automatically expire according to the configured rate-limit window.
  • Allowlisted aggregate funnel events in Cloudflare Analytics Engine: three months.
  • If we work together, contracts, invoices, and accounting records are kept for the period Swedish law requires.

Your rights

  • Ask what personal data I hold and receive a copy.
  • Have inaccurate data corrected.
  • Ask for deletion or restricted processing where the law allows it.
  • Object to processing based on legitimate interests.
  • Withdraw marketing consent at any time.
  • Receive data in a portable format where applicable.
  • Complain to the Swedish Authority for Privacy Protection, IMY.

To exercise a right, email filip@vexxa.se. I normally reply within one working day and always within the legal deadline.