Privacy policy

1. Who is responsible

FlowAppeal is run by Benjamin, based in Sweden. He is the data controller for personal data handled through this website and in client projects, and you can reach him at benjamin@flowappeal.com.

No data protection officer has been appointed, as the law does not require one for a business of this size.

2. What personal data is handled

The website itself has no contact forms, no newsletter, no advertising and no analytics or tracking cookies. Personal data comes from three places:

• Technical data, such as your IP address, browser, device and the pages you request, processed by the hosting provider when you visit.
• Messages and contact details you share when you email me, or when you contact me through Upwork if you choose to.
• Information you provide during a project, such as access to tools and business data needed for the work.

3. Why, and on what legal basis

• Delivering the website and protecting it against attacks: legitimate interest.
• Replying to your emails and preparing a proposal: steps you ask for before a contract.
• Delivering a project: performance of the contract.
• Bookkeeping and tax: legal obligation.

4. Do you have to share data?

No. You can browse the site without sharing anything. To get a reply, a proposal or a project, I need your name, contact details and a description of what you need; without them I can’t help.

5. Cookies and browser storage

This site sets no cookies of its own. Your theme (light or dark) and currency choice are saved in your browser’s local storage so they stay the same next time. They never leave your device and you can clear them in your browser settings at any time.

YouTube videos, where shown, load in privacy-enhanced mode, which does not set cookies until you play a video.

6. Who else processes data

• Vercel Inc. hosts the website and runs its firewall.
• My email provider stores the emails you send me.
• Upwork, only if you choose to contact me or sign a contract there, under its own privacy policy.
• YouTube (Google), only if you play an embedded video.

Some of these providers are based in the United States. Transfers outside the EU rely on the EU–US Data Privacy Framework or the EU Standard Contractual Clauses. Email benjamin@flowappeal.com for a copy of the safeguards.

Personal data is never sold, traded or rented.

7. How long data is kept

• Server logs: kept by Vercel for a short period, for security and troubleshooting.
• Emails and enquiries that don’t lead to a project: deleted within 12 months of our last contact.
• Project and accounting records: kept for seven years, as Swedish bookkeeping law requires.

8. How data is protected

The site is served over HTTPS and protected by Vercel’s firewall. Access to client systems and project data is limited to what the work needs and removed when the project ends.

9. Your rights

Under the GDPR you have the right to:

• Access the personal data held about you.
• Have incorrect data corrected.
• Have your data deleted.
• Restrict or object to how it is used.
• Receive your data in a portable format.
• Withdraw consent at any time, where processing is based on consent.

To use any of these rights, email benjamin@flowappeal.com. You’ll get an answer within one month.

You can also complain to the Swedish Authority for Privacy Protection (IMY) at imy.se.

10. Automated decisions

No decisions about you are made automatically, and your data is not used for profiling.

11. Contact

Questions about this policy or your data? Email benjamin@flowappeal.com and I’ll reply as soon as I can.

12. Changes to this policy

This policy is updated when the site or the way data is handled changes. The date at the top shows the latest version.