Privacy Policy

Controller and contact

Irozon AB, organisation number 5595535658, Bjursätragatan 156, 124 63 Stockholm, Sweden, is the controller for the processing described here. Contact hello@irozon.se with privacy questions or to exercise your rights.

Contact and quote requests

When you submit the contact form, we process your name, email, message and information you choose to provide, such as company, service, budget and timeline. The form is sent through Web3Forms, operated by Web3Creative, to receive and deliver it to us. Web3Creative's published DPA says it processes form submissions as a data processor. If you email us, your address and correspondence are processed by the email services used for that communication.

We use this information to answer questions, assess projects and follow up enquiries. The legal basis is our legitimate interest in handling business enquiries (GDPR Article 6(1)(f)), or steps at your request before a contract where you are the contracting individual (Article 6(1)(b)). Information needed for legal obligations is processed under Article 6(1)(c). Do not include sensitive personal data or unnecessary information about other people.

Website Planner

The planner collects project choices, domain, inspiration links, notes and contact details (name, email and optional company and phone). Only when you submit the plan is it sent to Irozon Tools at tools.irozon.se, which uses Hostinger and stores the enquiry in Google Firebase Firestore. The database is in Google's European eur3 multi-region. No automatic TTL deletion is configured for planner enquiries, so the database does not delete them automatically. The purposes and legal bases are the same as for contact and quote requests. These submissions are not public articles.

AI assistant

The AI assistant is optional. When you send a message, your message and conversation history are sent to Irozon's AI backend, which runs as a Cloudflare Worker and forwards the content to OpenAI to generate a response. Cloudflare receives connection information, including your IP address; the backend uses a hashed IP-based identifier for rate limiting and does not store raw IP addresses or chat content in its D1 database. The Worker uses Cloudflare's global network with Default placement and may be processed outside the EU/EEA. The bound D1 database is labeled Eastern Europe with no jurisdiction restriction. Do not send sensitive data, passwords or confidential material.

The conversation is also saved in your browser's sessionStorage, separately for Swedish and English, to continue it in the same tab. The website does not save a separate chat transcript in its own server database. The OpenAI account project is configured for global data residency. OpenAI says API content is not used for model training by default and standard abuse-monitoring logs may contain prompts and responses for up to 30 days, subject to exceptions. The account's API call logging setting is 'per call'. The Cloudflare account uses Workers Free. Worker placement is set to Default, and Worker Logs, Traces and Issues are disabled. The bound D1 database has no jurisdiction restriction and the account labels its region Eastern Europe. D1 is used for project configuration and knowledge data, not chat transcripts, and its Time Travel recovery window is seven days. The D1 window does not describe retention for other Cloudflare network or security logs. We rely on our legitimate interest in offering an optional assistant and answering questions (GDPR Article 6(1)(f)). We limit its use to this purpose and ask you not to send sensitive or confidential information. AI answers may be inaccurate and are not binding quotes. The website does not use the assistant to make decisions about you with legal or similarly significant effects.

Cookies, local storage and analytics

Your analytics choice is saved in localStorage as irozon_cookie_consent_v1 with the choice and timestamp. The website code gives it no automatic expiry; it remains until replaced or the browser's site data is cleared. Your theme preference is stored as irozon-theme. This functional storage and the AI conversation's session storage are separate from analytics cookies.

Google Analytics 4 and Microsoft Clarity load only after you actively accept analytics. Google Analytics provides visitor statistics. Clarity provides aggregated heatmaps and session recordings showing how visitors navigate, click and scroll on the website. Clarity may process page URLs, browser and device details, IP-derived region, pseudonymous identifiers and interactions. Strict masking is selected for the Clarity project and masks text in recordings, including text shown in the AI chat widget; Microsoft also says input fields and dropdowns are masked in every mode. This limits what recordings show but does not by itself ensure that all personal-data processing complies with data-protection law. Microsoft's documentation lists possible first-party cookies _clck and _clsk, and Microsoft-domain cookies CLID, ANONCHK, MR, MUID and SM; which are used depends in part on consent and settings. The legal basis for our activation is your consent (GDPR Article 6(1)(a)). Google advertising consent and Clarity's ad_Storage are denied in the website configuration.

Microsoft's published Clarity information states that playback data is normally retained for 30 days. After that, a sample of 1% or at least 10 recordings per day may be retained for up to nine months; favorited recordings may also be retained for nine months. Heatmap and click data is retained for nine months. These are Microsoft's published periods, not settings we configured.

Reject also works after you previously accepted: analytics stops and known analytics cookies for this website are cleared. Open Cookie settings in the footer to change your choice at any time. Reading this policy, opening or closing the dialog, or following its policy link does not change your saved choice. Withdrawal does not affect the lawfulness of earlier processing.

Hosting, recipients and transfers

Hostinger serves the website and handles the technical information needed to deliver a web request, such as IP address, requested URL and browser information. The Hostinger account shows the irozon.se website server in Frankfurt, Germany, and the listed backup location in France. Website-file backups may remain under Hostinger retention rules. The website planner sends information to Irozon Tools at tools.irozon.se. Its documentation says the form application itself does not read or store IP address or browser information; separate infrastructure may handle network information to transmit a request. Google Firebase supports article content and planner submissions and Google sign-in for administrators; visitors do not need an account. Administrators' Google account identifiers and sign-in data are processed to authenticate authorized access. The legal basis for necessary technical operation, security and restricted administrator sign-in is our legitimate interest in operating a functional and secure website (GDPR Article 6(1)(f)).

Recipients include Irozon AB and the providers needed for each feature: Hostinger, Web3Forms/Web3Creative, Google/Firebase, Microsoft Clarity and OpenAI. Web3Forms' published DPA describes Web3Creative as a processor for form data and lists possible subprocessors. Clarity's published terms describe Irozon and Microsoft as independent controllers for personal data processed in connection with the service. Under those terms Microsoft may use the data consistently with its Privacy Statement, including to provide and improve services and for advertising purposes. The website's Clarity signal denies ad_Storage; that signal does not itself change the parties' roles under the terms. The hello@irozon.se mailbox is hosted by Hostinger. External article images may be fetched from the image host used for that article, which receives technical connection data. Social links are ordinary external links. Other websites provide their own privacy information when you visit them.

Processing may take place outside the EU/EEA. The OpenAI project is configured for global data residency, the Cloudflare Worker runs on Cloudflare's global network with Default placement, and its bound D1 database is labeled Eastern Europe without a jurisdiction restriction. Web3Creative says it operates from India and its subprocessors may process data in the United States and other countries. Microsoft says personal data may be stored and processed in the United States and other countries where Microsoft, its affiliates or service providers operate. Microsoft describes international transfer safeguards, including standard contractual clauses and Data Privacy Framework certification where applicable; the safeguards for each transfer depend on Microsoft's service terms. Hostinger's website server is in Frankfurt, Germany, and the listed backup location is France. Google Analytics uses Google's services and contractual terms; processing may include transfers outside the EU/EEA. We do not claim that all processing takes place in the EU/EEA.

Microsoft Clarity TermsMicrosoft Privacy Statement

How long is information retained?

Our target is to delete routine enquiries within 12 months after the last substantive contact and unconverted planner enquiries within 12 months of submission. These targets are not currently enforced, so information may remain longer. Firestore has no TTL deletion policy for planner enquiries; scheduled Firestore backups are disabled. AI backend retention and deletion are managed separately from the website. Microsoft's published Clarity information states that playback data is normally kept for 30 days, with a sample of 1% or at least 10 recordings per day and favorited recordings potentially kept for up to nine months; heatmap and click data is kept for nine months. Cloudflare D1 Time Travel has a seven-day recovery window, and Worker Logs, Traces and Issues are disabled; other network and security logs are governed by Cloudflare's service terms and settings. OpenAI states that standard abuse-monitoring logs may retain API prompts and responses for up to 30 days. In Google Analytics, the setting is 2 months for event data and 14 months for user data, with user-data retention reset on new activity. These settings apply only to the data types they cover. Email, Web3Forms and Hostinger server logs follow their respective provider terms and account settings. Web3Forms' published DPA and plan information describe different retention periods for different data and services. Contact us for information about retention of your particular data.

Your rights

You can request access to your personal data, correction, erasure or restriction of processing. You can object to processing based on legitimate interests. Where the GDPR conditions apply, you have a right to data portability. You can withdraw analytics consent at any time through Cookie settings. These rights are subject to the conditions and exceptions in the GDPR.

Write to hello@irozon.se. We may need to verify your identity to protect your data. You have the right to complain to the Swedish Authority for Privacy Protection (IMY). Providing information to forms and the AI assistant is voluntary; without necessary contact details we cannot answer your enquiry. Changes to this policy will be published on this page.