Privacy Policy

1. Data Controller

Bluffkollen is the data controller responsible for the processing of your personal data. If you have any questions about how we handle your data, please reach out via our contact page.

2. What data do we handle, and why?

We try to handle as little personal data as possible. Using Bluffkollen does not require an account, a name or an email address.

• Website checks. When you check a website, we store the domain name, the time and the result, to keep statistics and to speed up later checks of the same site. These are not linked to you.
• Image checks. An image you upload is stored briefly with Amazon Web Services in Stockholm, analysed by OpenAI and then deleted from our storage. OpenAI processes the image in the United States and, according to its terms for API customers, does not use it to train its models but may keep it for up to 30 days to detect abuse. Please avoid uploading images that show sensitive information about yourself or others.
• Activation key for the browser extension. The beta key is anonymous: it is not linked to your name or email address. We store when it was created and activated, and roughly when it was last used (at most once an hour), so we know how many keys are in use.
• Your safe/unsafe reports. If you mark a website as safe or unsafe in the extension, we store the domain and your verdict together with your anonymous activation key, so that each key counts once per website.
• Feedback. If you send feedback from the extension, we store your message, the domain it concerns (if any) and the extension version — not your activation key. Please don't include personal information in the message.
• Newsletter. If you sign up for our newsletter, your email address is handled by our newsletter provider MailerLite, based on your consent. You can unsubscribe at any time via the link in every newsletter.
• Visitor statistics. We use Nullitics to count visits to the website. It records the page, the referring page and the screen width, without cookies and without identifying you.
• Emails to us. If you contact us, we use your email address and message to answer you.

The legal basis is our legitimate interest in providing and protecting the service and in helping people avoid fraud, except for the newsletter, which is based on your consent.

3. Information about the websites we check

To assess an online shop, we collect information that the shop itself publishes, such as contact details, company registration numbers and its own image, together with technical and public registry information about its domain. For newly registered .se domains we use Internetstiftelsen's public zone data. If this includes information about you as a sole trader and you think it is wrong, please contact us.

4. The Browser Extension

When you visit a page that looks like an online shop, the extension sends its domain name to our API to be checked — not the full address, the page content, or anything you type. Other pages are not sent. We do not log which websites you visit, and the checks are not stored linked to you or your activation key.

Your activation key and recent results are stored locally in your browser. The extension does not collect browsing history, passwords or other sensitive information.

5. Who processes the data for us?

We do not sell your data or share it for marketing. We use these providers to run the service:

• DigitalOcean — our API and database (Amsterdam, EU).
• Amazon Web Services — temporary image storage and zone data (Stockholm, EU).
• OpenAI — image analysis (United States).
• Netlify — hosting of this website.
• Contentful — the articles and pages on this website (no visitor data).
• MailerLite — the newsletter.
• Nullitics — visitor statistics.

Where data is processed outside the EU/EEA, this is done under the providers' data processing terms and the EU's standard contractual clauses or adequacy decisions. Our hosting providers may record technical information such as IP addresses in their server logs for security purposes.

6. How long do we keep data?

Images are deleted from our storage as soon as they have been analysed. Activation keys are kept while they are in use. Reports and feedback are kept for as long as they help us improve the service. Newsletter subscriptions are kept until you unsubscribe. If you want data about you deleted, contact us and we will remove it without delay.

7. Your rights

Under GDPR, you have the right to:

• Request access to the data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data.
• Object to the processing of your data.
• Lodge a complaint with the Swedish Authority for Privacy Protection (IMY) at imy.se.

8. Contact

For questions about this privacy policy or your personal data, please contact us via our contact page.