Privacy Policy

1. Introduction

Welcome to loheden.com, the official website of Loheden AI Solutions AB ("Loheden", "we", "our", or "us"). This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our website, when you contact or otherwise deal with Loheden as a company, and when we handle payment and billing information in connection with the software products and digital services we operate. Loheden.com itself is a static landing page designed to provide information about our products and services. By accessing or using our website, you agree to the collection and use of information in accordance with this Policy. If you do not agree with any part of this Policy, please do not use our website.

For the processing described in this Policy, Loheden AI Solutions AB is the data controller. Some of the third-party services named below also process data for their own purposes and act as controllers in their own right for that processing; where that is the case, their own privacy policies govern it.

1.1 Products With Their Own Privacy Policies

Loheden AI Solutions AB operates multiple digital products and services. Individual products may have their own privacy policies describing product-specific processing of personal data. Where applicable, those product-specific privacy policies should be read together with this Privacy Policy, and they describe processing that this company-level policy does not. The products we currently operate are listed on our Digital Products page.

2. Information We Collect

We are committed to data minimization and only collect the information necessary for providing and improving our website. The types of information we may collect include:

2.1 Personal Information

Because loheden.com is a static landing page, we do not require you to create an account or register. However, if you choose to contact us (for example, via a contact form or email), we may collect personal information such as your name and email address. Such information is provided voluntarily and used solely to respond to your inquiry.

2.2 Usage Data and Technical Information

Every request your browser makes carries your IP address and a short description of the browser and its operating system, as with any website. We use them to send you the page and to block attacks (Section 2.3), and we do not keep them for anything else.

No analytics script runs on our pages, and nothing on them reports back about you. We count visits ourselves on our server: by day, by country as our network provider reports it, by the language of the page, by the kind of device (computer, phone or tablet) as your browser reports it, and by the website that brought the visit and the first page it opened. In the same way, we count how many visits go on to another page and to our Digital Products and digital marketing pages, and how many clicks lead on from this site to one of our products' websites or to an app's page in the App Store or on Google Play. That source travels from page to page in the addresses of our own links, so nothing is stored on your device for it, and nothing in the counts is made from your IP address or identifies you. We use the counts to see which pages and which ways of finding us are useful, and to improve the site.

2.3 Blocking Attacks

Some requests ask only for pages that attack tools look for, such as WordPress login pages, PHP scripts or configuration files, none of which exist on this site. Each such request is refused, and an address that keeps making them is blocked from the site for 30 days. For this, the application that runs the site keeps the address itself, with a count of those requests, in its working memory: the count until 30 days after the last such request, and the block until it ends. Both may be erased sooner, for example whenever the application restarts, as it does each time we update the site. To stop a blocked address before it reaches our server, Cloudflare keeps the address itself on a block list for at most 30 days at a time while the block lasts. The list also protects our other websites, so an address blocked on one may be refused by the others for that time. Blocking rests on our legitimate interest in protecting this site and our other websites against attacks (Section 5).

3. Payments and Billing

Payments for certain Loheden products and services are processed by Stripe. Loheden may receive and retain transaction, billing, subscription and customer information necessary to provide the purchased product or service, administer subscriptions, handle refunds, provide customer support, comply with accounting and legal obligations, and prevent fraud.

Payment card details are processed by Stripe and are not stored directly by Loheden. Stripe also processes payment data for its own purposes, such as fraud prevention and compliance with financial regulation, and acts as a controller in its own right for that processing. Its handling of that data is described in its own privacy policy.

This section describes only the billing and customer information Loheden holds as the seller. Where a purchase is made through a specific Loheden product, that product's own privacy policy describes the processing that takes place inside the product itself.

4. How We Use Your Information

We use the collected information for the following purposes:

• To operate, maintain, and improve loheden.com.
• To analyze website usage and trends, which helps us enhance your browsing experience.
• To respond to your inquiries if you choose to contact us.
• To sell, deliver and support the products and services you buy from us, including administering subscriptions, handling refunds, and preventing fraud.
• To comply with legal obligations and protect our rights.

5. Legal Bases for Processing

Under the General Data Protection Regulation we need a legal basis for every purpose for which we process personal data. Ours are the following:

• Operating and securing this website: Article 6(1)(f), legitimate interests. Our interest is in keeping loheden.com available, working and protected against attacks and abuse, and in understanding in aggregate how it is used. This covers the technical information described in Section 2.2 and the blocking described in Section 2.3, whose block list also protects our other websites against the same attacks; the visit counts we keep on our own server use no cookie, keep no IP address and build no profiles.
• Answering your enquiries: Article 6(1)(b) where your message is a step taken at your request before entering into a contract, otherwise Article 6(1)(f), our legitimate interest in replying to people who write to us.
• Providing and supporting a product or service you have bought: Article 6(1)(b), performance of a contract. This covers delivering the product, administering subscriptions, handling refunds and providing customer support.
• Keeping accounting and tax records: Article 6(1)(c), compliance with a legal obligation. Swedish accounting and tax law requires us to retain records of the transactions we make.
• Preventing fraud and misuse: Article 6(1)(f), legitimate interests. Our interest, shared with our customers and our payment provider, is in not letting fraudulent transactions go through.
• Sending marketing emails: Article 6(1)(a), your consent, or Article 6(1)(f) where you are already a customer and the message concerns something similar to what you bought. Section 15 describes this, and every such email carries a way to opt out.
• Complying with the law and establishing or defending legal claims: Article 6(1)(c) and Article 6(1)(f).

Where we rely on legitimate interests, we have weighed them against your rights and freedoms, and you may object to that processing. Where we rely on consent, you may withdraw it at any time, and withdrawing it does not affect processing carried out before you did. Section 11 explains how to exercise either right.

6. Data Retention

We retain any information you provide to us only for as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by law. Information obtained through contact inquiries will be kept only as long as needed to respond to your inquiry and for any follow-up purposes, after which it will be securely deleted or anonymized. Transaction and billing records are kept for as long as accounting and tax law requires us to keep them. The visit counts in Section 2.2 hold no personal data and are kept as long as they are useful. An address that attacks this site is kept as Section 2.3 describes: in the application's memory for at most 30 days after its last such request, and on Cloudflare's block list for at most 30 days at a time while its block lasts.

7. Sharing Your Information

We do not sell, trade, or otherwise transfer your personal data to third parties except in the following circumstances:

• Service Providers: Two providers process data on our behalf when you visit this site, and no others:
  • Cloudflare, Inc. (United States): content delivery, DNS and protection against attacks. Every request to this site passes through Cloudflare, so it processes your IP address. It also keeps the address of a visitor we have blocked on our block list (Section 2.3). Privacy policy.
  • Hetzner Online GmbH (Germany): hosting. The site runs on a server Hetzner operates in Helsinki, Finland, inside the EU. Privacy policy.

  Every asset this site uses (fonts, stylesheets, scripts and icons) is served from our own domain. No content delivery network belonging to a third party receives a request from your browser, so none of them learns your IP address or that you visited this site.

• Payment Processing: Where you buy a Loheden product or service, Stripe processes the payment and we receive the billing and transaction information described in Section 3.
• Legal Compliance: We may disclose your information if required to do so by law or in response to valid requests by public authorities, such as a court or government agency.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction. In such cases, we will notify you via this Privacy Policy.

8. Cookies and Tracking Technologies

This website sets no cookies on an ordinary visit, and its visit counts work without them.

8.1 Cookies on This Site

Our own application sets one cookie for visitors, and only if you ask for it:

• theme: set only when you switch between dark and light mode with the round button in the menu bar, so the website opens in that mode next time. It holds dark or light, nothing else, and lasts a year. Without it the website is dark.

There are no visitor accounts and no sessions. The only login is our own, for the people who run the site, and it sets cookies only to keep them signed in. Visits are counted on our own server without cookies (Section 2.2).

Cloudflare, which protects the site, sets no cookie on an ordinary visit either. If it ever has to check whether a visitor is a person rather than an automated program, for example while the site is under attack, it may place a short-lived security cookie such as cf_clearance for that check alone. It is not used to track you across other websites or to build a profile.

This describes loheden.com only. Individual Loheden products may need cookies or similar technologies of their own to work; where they do, the privacy policy for that product describes them.

8.2 No Consent Required

According to the General Data Protection Regulation (GDPR) and the ePrivacy rules, consent is not required for cookies that are strictly necessary for the provision of an information society service explicitly requested by the user. The theme cookie, which you set yourself by choosing a look, and the security cookie Cloudflare may place in the situation above are of that kind, so we do not ask for your consent and show no cookie banner.

8.3 Managing Cookies

Most web browsers allow you to control cookies through the browser settings. To learn more about cookies, including how to view, manage and delete them, please visit www.aboutcookies.org or www.allaboutcookies.org.

9. Data Transfer and Storage

Loheden AI Solutions AB is registered in Sweden, a member of the European Union. This website runs on a server in Finland, inside the EU. We may use cloud service providers with servers in various countries, including within the EU. If your data is transferred outside the EU/EEA, we will ensure that appropriate safeguards are in place (such as standard contractual clauses) to protect your information in accordance with GDPR and other applicable laws.

10. Security of Your Information

We take reasonable measures to protect the security of your information using industry-standard technical and organizational safeguards. However, no method of transmission over the Internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security.

10.1 Data Breach Notification

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of the breach, in accordance with GDPR requirements.

11. Your Data Protection Rights Under GDPR

If you are a resident of the European Economic Area (EEA), you have certain rights regarding your personal data. These rights include:

• The right to access the personal data we hold about you.
• The right to have your information corrected if it is inaccurate or incomplete.
• The right to object to our processing of your personal data.
• The right to request that we restrict the processing of your personal data.
• The right to receive your personal data in a structured, commonly used, and machine-readable format (data portability).
• The right to request the erasure of your personal data, where there is no overriding reason for us to keep it, such as an accounting or tax obligation.
• The right to withdraw consent at any time where we rely on your consent to process your data.
• The right to lodge a complaint with a supervisory authority. In Sweden this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

11.1 How to Submit a Request

To exercise any of these rights, please contact us at the address provided in Section 16. We may need to verify your identity before responding to your request, and we will endeavor to respond within one month.

12. Children's Privacy

Our website is not directed at individuals under the age of 18 ("Children"). We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child, we will take steps to delete that information as soon as possible.

13. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time. Any changes will be posted on this page with an updated "Last Updated" date. We encourage you to review this Privacy Policy periodically to stay informed about our data practices.

14. Governing Law and Jurisdiction

This Privacy Policy shall be governed by and construed in accordance with the laws of Sweden and the European Union. Any disputes arising out of or in connection with this Policy or our data processing practices shall be exclusively resolved by the courts of Sweden, and any decision rendered by such courts shall be final and binding.

15. Email Marketing

If you have a customer or partner of us, we may use Your Personal Data to contact You with newsletters, marketing or promotional materials and other information that may be of interest to You. You may opt-out of receiving any, or all, of these communications from Us by following the unsubscribe link or instructions provided in any email We send or by contacting Us.

We may use Email Marketing Service Providers to manage and send emails to You.

• Mailchimp

  Mailchimp is an email marketing sending service provided by The Rocket Science Group LLC.

  For more information on the privacy practices of Mailchimp, please visit their Privacy policy: https://mailchimp.com/legal/privacy/

• Resend

  Resend is an email sending service, including for marketing purposes.

  For more information on the privacy practices of Resend, please visit their Privacy policy: https://resend.com/legal/privacy-policy

• MailGun

  MailGun is an email marketing and sending service.

  For more information on the privacy practices of MailGun, please visit their Privacy policy: https://www.mailgun.com/legal/privacy-policy/

16. Contact Us

If you have any questions about this Privacy Policy, our data practices, or if you wish to exercise any of your data protection rights, please contact us by sending an email to:
hi@loheden.com

By using loheden.com, or by purchasing or using a Loheden product or service, you acknowledge that you have read, understood, and agree to this Privacy Policy, together with any product-specific privacy policy that applies to the product concerned.