Privacy notice

Last updated: 10 October 2026

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

PolarPixel Media HB, Hålberg 14, 933 94 Glommersträsk, Sweden
Corporate identity number 969800-7979
Email: hello@polarpixel.se

We have not appointed a data protection officer, as we are not required to do so (Art. 37 GDPR). For any privacy question, write to the address above.

2. In short

• This website uses no cookies, no tracking, no analytics and no advertising tools.
• It loads no content from third parties (no external fonts, scripts, maps or videos).
• There is no contact form. If you want to reach us, you write an email yourself. Incoming emails may be sorted with AI assistance (section 4).
• Our web server keeps a short technical log. It stores your IP address only in shortened form and deletes the log after 14 days (section 3).

3. Server logs

The website runs on a server that we rent from Hetzner Online GmbH. The server is located in a data centre in Nuremberg, Germany. Hetzner Online GmbH processes data on our behalf as a processor under a data processing agreement (Art. 28 GDPR). The data stays in the EU; no transfer to third countries takes place.

What is processed. When you open a page, your browser sends technical data that the server needs to deliver it. The web server writes the following to its own access log for this website:

• your IP address in shortened form: for IPv4 addresses the last octet, for IPv6 addresses everything after the first 48 bits is replaced by zeros before storage,
• date and time of the request,
• the page or file requested, the HTTP method and status code, and the amount of data transferred,
• the browser identification (user agent) and other standard request headers your browser sends, such as the preferred language.

The log does not contain cookies, authorisation data or the referring page. Your full IP address is used only briefly in the server's memory to establish the connection and send the page to you. It is not written to the access log of the website.

Purpose. To deliver the website, to keep it secure and stable, to detect and fend off attacks and to find errors.

Legal basis. Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the website.

Storage period. Entries in the access log are deleted automatically after 14 days. We keep an entry for longer only if it is needed to investigate a specific security incident, until the investigation is completed.

Security logs of the server. To protect the server, the operating system also keeps technical logs that are not specific to this website: a firewall log (blocked connection attempts with their source IP address), the log of SSH logins and the system log, which we keep for up to 5 weeks, and the system journal, which we keep for 30 days. These logs can contain the full IP address of a connection attempt. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in the security of our systems.

No profiling. We do not combine log data with other data and do not use it to identify visitors.

Note. Because the IP address is shortened before storage, entries in the access log generally can no longer be linked to an individual. We nevertheless treat them as personal data and apply this notice to them.

4. Contacting us by email

The website links to our address hello@polarpixel.se. If you write to us, we process the data you send: your email address, your name if given, the content of your message and attachments, and technical email metadata (such as time of sending).

Purpose and legal basis. To answer your enquiry. If your enquiry concerns a possible or existing contract with us, the legal basis is Art. 6(1)(b) GDPR; otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering messages sent to us.

Email provider. Our mailbox is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, Larnaca 6023, Cyprus, which processes emails on our behalf as a processor (Art. 28 GDPR).

AI-assisted processing. Incoming emails to hello@polarpixel.se are processed with AI assistance (Claude, provided by Anthropic) to sort them and to prepare internal tasks for us. For this, email content is transmitted to Anthropic and may be processed in the USA (see section 6). The AI does not send emails and does not change the mailbox. Legal basis: our legitimate interest in handling business enquiries efficiently (Art. 6(1)(f) GDPR). No decision with legal or similarly significant effect on you is made solely by automated means.

Storage period. We keep emails for 24 months after the matter has been concluded and then delete them. Emails that form part of our accounting records (for example, an order confirmation) are kept until the end of the seventh year after the end of the calendar year in which the financial year ended, as required by the Swedish Bookkeeping Act (bokföringslagen, 1999:1078, chapter 7, section 2).

Security. Please note that emails are not end-to-end encrypted by default. Do not send us sensitive data by email.

5. Recipients

We do not sell your data and do not pass it on for advertising. Recipients are the service providers named above who act on our behalf (Hetzner Online GmbH for hosting, Hostinger International Ltd. for email), Anthropic for the AI-assisted processing of emails described in section 4, and public authorities where we are required by law.

6. Transfers outside the EU/EEA

The website itself is hosted in Germany; visiting it does not involve a transfer to a third country. When emails are processed with AI assistance (section 4), their content is transmitted to Anthropic and may be processed in the United States. We are currently completing the documentation of the safeguards for this transfer under Chapter V GDPR and will update this section accordingly. You can request information at hello@polarpixel.se.

Hostinger may use sub-processors outside the EEA (including in the USA); such transfers are based on the EU Standard Contractual Clauses.

7. Your rights

You have the right to:

• access your personal data (Art. 15 GDPR),
• have incorrect data corrected (Art. 16),
• have your data erased (Art. 17),
• have processing restricted (Art. 18),
• receive your data in a portable format (Art. 20).

Right to object (Art. 21 GDPR). Where we process your data on the basis of our legitimate interests (Art. 6(1)(f)), you may object at any time on grounds relating to your particular situation. We will then stop the processing unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or need the data for legal claims.

To exercise your rights, email hello@polarpixel.se.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). In Sweden this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, Sweden, www.imy.se. You may also contact the authority in the EU country where you live or work.

8. Do you have to provide data?

You can use this website without providing any data yourself. The server log entries (section 3) are technically necessary to show you the website. Writing to us is voluntary.

9. Changes

We will update this notice if our website or our processing changes. The current version is always available on this page.