Privacy Policy
Last updated: 2026-05-23 (v1) · Operator: Igelkott Film AB (org.nr 556998-7794, SE)
This Privacy Policy describes how Igelkott Film AB ("we", "us", "Igelkott") processes personal data of operator-account holders who sign in to hub.igelkottplates.com ("the Service"). Igelkott Film AB is the controller for personal data described here, under the EU General Data Protection Regulation (GDPR) and Swedish Data Protection Act (Dataskyddslagen, 2018:218).
1. Data we collect
| Category | Examples | Why | Retention |
|---|---|---|---|
| Account data | Name, email, role (admin / producer / member) | Authentication, access control | Until account deletion |
| Authentication artifacts | Hashed magic-link tokens, device-cookie hashes, session IDs | Passwordless sign-in, session continuity | 24h – 30 days (sliding) |
| Audit log | Sign-in events, IP, browser user-agent, normalized email | Security, fraud detection, account-recovery support | Up to 2 years |
| Application logs | Error traces, request URLs, optional user-email + project context | Reliability + bug investigation | 10 000 most recent rows (rotating) |
| Media-access log | File path, IP, user-agent, HTTP range, status code | Content-delivery audit (industry MPA/TPN compliance) | Up to 1 year |
| Project collaboration data | Name, phone (optional), session ID — entered by collaborators during project edits | Attribute edits to a person within a project session | Up to 1 year after last activity |
2. Legal basis
We rely on the following GDPR Article 6 grounds:
- Contract (Art. 6(1)(b)) — providing the Service to operator-users under our Terms of Service.
- Legitimate interest (Art. 6(1)(f)) — for security logging, fraud detection, and reliability monitoring. You can object to processing under this basis; see "Your rights" below.
- Legal obligation (Art. 6(1)(c)) — accounting records related to subscriptions or invoices, when applicable.
3. Cookies and similar technologies
We use three first-party cookies, all strictly necessary for the Service to function. We do not use third-party tracking cookies, advertising cookies, or web-analytics cookies. See our Cookie Policy for details.
4. Sub-processors
We use the following third parties to operate the Service. Each receives the minimum data necessary for its function.
| Provider | Purpose | Data flowed | Location |
|---|---|---|---|
| Loopia AB | SMTP email delivery (sign-in magic links) | Recipient email, magic-link URL, message body | Sweden (EU/EEA) |
| Google LLC (Maps API) | Map tile rendering for location-aware features | Geographic coordinates and address strings (proxied server-side; your IP is not sent directly) | EU + USA (Standard Contractual Clauses) |
| jsDelivr (StackPath/Cloudflare) | Static JavaScript library hosting (Three.js for 360° viewer) | Your IP address and browser user-agent when the viewer loads | Global CDN |
| Let's Encrypt (ISRG) | TLS certificate issuance for HTTPS | None (domain-level only) | USA |
| GoDaddy / DNS provider | Domain name resolution | None (DNS lookups are anonymous to us) | USA |
Infrastructure hardware (Synology NAS) is owned and operated by Igelkott Film AB on-premises. Synology Inc. does not process personal data on our behalf.
5. International transfers
Where sub-processors are located outside the EU/EEA, we rely on the European Commission's Standard Contractual Clauses (SCCs) or equivalent safeguards. Static asset CDN traffic (jsDelivr) is pseudonymous and limited to IP + user-agent.
6. Your rights
Under GDPR, you have the right to:
- Access (Art. 15) — request a copy of your personal data.
- Rectification (Art. 16) — correct inaccurate data.
- Erasure (Art. 17) — delete your account. Some audit-log entries may be retained in anonymized form to preserve tamper-evident security trails.
- Restriction (Art. 18) and portability (Art. 20) — for data you provided to us.
- Object (Art. 21) to processing based on legitimate interest.
- Lodge a complaint with the Swedish data protection authority, Integritetsskyddsmyndigheten (IMY), imy.se.
To exercise these rights, email sales@igelkottplates.com. We will respond within one month of your request.
7. Data retention
See the retention column in the table in section 1. Logs that contain personal data are pruned automatically at the stated intervals. Hashed authentication artifacts (magic-link, device, session) are deleted immediately upon expiry or revocation.
8. Security
We use passwordless authentication, HTTP-only secure cookies, CSRF protection, rate limiting, brute-force lockout, append-only tamper- chained audit logs, and TLS for all network traffic. The application is self-hosted on hardware located in Sweden.
9. Changes to this policy
We may update this Privacy Policy. The "Last updated" date at the top reflects the latest revision. Material changes will be communicated to operator-users via email.
10. Contact
Igelkott Film AB
Org.nr 556998-7794 · VAT SE556998779401
Email: sales@igelkottplates.com
Igelkott Studios® is a Swedish trademark (PRV reg. no. 545539, class 41, valid until 2028-05-03) owned by Igelkott Film AB.