DRAFT — for lawyer review before publishing

This is a draft, not legal advice. Every [TO VERIFY: …] placeholder must be checked, filled in or removed before publishing.

Published at: /privacy (the path is on Google's consent screen and must not change). The "Delete your data" section must keep its own anchor, /privacy#delete-your-data.

Privacy policy

Last updated: [DATE]

1. The short version

• We read your Google Analytics and Tag Manager accounts. We never change anything in them.
• We mostly read settings and aggregated figures. We also read the list of people who have access to your accounts, to check who holds which rights.
• Our database is in the EU and our servers run in Stockholm.
• Our website uses no analytics, no third-party trackers and no advertising cookies.
• We do not sell data and do not use it for advertising.
• You can revoke our access at any time. If you delete your account, we delete the data within 30 days.

2. Who is responsible

The nicelookingdata service is run by Ludvig Nyström, a sole trader (enskild firma) in Sweden ("we").

• Address: [ADDRESS]
• Privacy email: [CONTACT EMAIL: suggested privacy@nicelookingdata.com]

We are the controller for data about you when you visit the website, use the domain scan, join the waitlist or hold an account with us. We are also the controller for the limited processing that happens when we scan public websites.

The content of the accounts you connect (Google Analytics 4 and Google Tag Manager) is different. There, your company is the controller and we are the processor. This is governed by our data processing agreement at /dpa.

We have not appointed a data protection officer. [TO VERIFY: that no data protection officer is required under Article 37 of the General Data Protection Regulation.]

3. Website visitors

What we process. IP address and technical details in server logs, such as browser, time and the page requested.

What we do not use. No analytics, no third-party trackers, no advertising pixels and no cookie banner. Our fonts are hosted on our own server, so loading a page sends nothing to a font provider. The only cookies are the strictly necessary ones in section 10.

Why. To run the website securely.

Legal basis. Legitimate interest (Article 6(1)(f)).

Retention. Server logs are kept by our hosting provider, Vercel: [TO VERIFY: Vercel's log retention on our plan].

4. People who use the domain scan

The domain scan at /check needs no login. You enter a domain and get a result.

What we process.

• The domain you enter, the result and the times of the scan.
• Your IP address, to limit scans to 10 per IP address per day. This protects the service from abuse. We never store the IP address itself. We store a shortened SHA-256 hash of it in a counter for that day.
• If you click "Send to your agency", your own email app opens with a prepared message. We send no email. We only record that the button was clicked.
• If you click "This isn't right", we record which finding you disputed.

The result is about the website, not about you. It normally contains no personal data. The addresses of tracker requests that we show as evidence can contain IDs. The result page has its own link that cannot be guessed. Anyone with the link can view it. Result pages are not indexed by search engines.

We also record events about the scan, see section 6.6.

Legal basis. Legitimate interest (Article 6(1)(f)): delivering the scan you asked for and preventing abuse.

Retention. Scan results are deleted 30 days after the scan. The IP counters are deleted after 2 days.

5. People who join the waitlist

What we process. Your email address, the page you signed up on and the time.

Why. Only to tell you about the beta.

Legal basis. Consent (Article 6(1)(a)). You can withdraw it at any time by emailing us.

Retention. [TO VERIFY: waitlist retention.]

6. Account holders

6.1 Sign-in

During the closed beta, sign-in is by invitation only. When you enter an invite code, we store it in a cookie (nld_invite) so you do not have to enter it again.

You sign in with Google. We receive your email address, name and profile image.

6.2 Your connected Google account

When you sign in, we receive a refresh token from Google. It lets us read your accounts without you signing in each time, so that weekly monitoring can run. We store it encrypted with AES-256-GCM. It is deleted when you delete your account with us.

Everything is read under your own login. We use no shared accounts and no service accounts to read your data.

What we read is set out in section 7.

6.3 What we produce for you

Audits with findings, scores and questions for your agency. You can save a report as PDF.

We store each audit with your email address, the GA4 property ID and name, the Tag Manager container ID and name, and the findings. Findings can include the email addresses of people who have access to your GA4 property or Tag Manager account. Only you can open your audits.

Retention: [TO VERIFY: audit retention].

6.4 Weekly monitoring

Monitoring is opt-in, per property. If you choose "Monitor every week", we re-run the audit every Monday with your stored token. We then email your sign-in address through Resend with the change in score, new findings, fixed findings and a link to the audit.

We do not track whether the email is opened or whether links are clicked. Every email has a stop link. It leads to a page where you confirm that you want to stop.

6.5 Payment

Payments are not open yet. When they open, they will be handled by Paddle, acting as merchant of record. Paddle will be the seller and an independent controller for the purchase, and follows its own privacy policy. We will never see your card details. From Paddle we will receive [TO VERIFY: which fields, for example name, email, company name, country, VAT number, plan and payment status].

6.6 Product analytics

We record our own events in our database, on our server. We use no cookies for this. The events are:

• scan started, completed or failed,
• share clicked,
• finding disputed,
• waitlist joined,
• invite redeemed,
• audit completed or failed,
• PDF saved,
• monitoring started or stopped,
• weekly report sent or failed.

Events carry scan or audit IDs, scores, GA4 property IDs, and the scanned domain when a finding is disputed. They do not carry IP addresses. Events about audits and monitoring can be linked to your account through the audit or property ID. The events stay with us.

Legal basis: legitimate interest (Article 6(1)(f)). Retention: [TO VERIFY: event retention].

6.7 Legal basis and retention

• Contract (Article 6(1)(b)): delivering the service you chose.
• Legitimate interest (Article 6(1)(f)): security, debugging, product analytics and service messages.
• Legal obligation (Article 6(1)(c)): bookkeeping, once payments open.

We keep the data for as long as you have an account. When you delete your account, we delete it within 30 days. Once payments open, the exception is the records the Swedish Bookkeeping Act (bokföringslagen) requires us to keep for seven years. Invoices and receipts will be held by Paddle. The whole database is exported to a backup in Google Cloud Storage every night. Backups are kept for [TO VERIFY: backup bucket lifecycle rule].

7. Data from Google

We only read. We ask Google for read-only access and nothing else. This is what we read and why.

About the user lists. We read who has access to your GA4 property and Tag Manager account so we can report on access governance. One example is a personal Gmail address with admin rights. These people's names and email addresses are personal data. Your company is the controller for them.

About aggregated figures. Most of what we read in GA4 is totals per day, page or event. Personal data can still appear. That happens if your website sends, for example, email addresses in URLs to GA4. We do not look for such data in order to use it. If we find it, we show it as a finding so you can fix it. [TO VERIFY: whether examples of such values are stored, and if so, masked.]

About older permissions. Earlier versions of the service sometimes asked for permission to make changes in GA4 and Tag Manager. This version never asks for or uses them. If you granted them earlier, you can remove them as described in section 12.

Other accounts. We do not connect to Search Console, Google Ads or Meta. We will update this policy before we add them.

Limited Use. nicelookingdata's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice this means:

• We use the data only to provide the features you see in the service.
• We do not sell it and do not use it for advertising.
• No human reads it, unless you ask us to, it is needed for security or to investigate abuse, or the law requires it.
• We do not use it to train general-purpose AI models.

8. Who receives the data

We use a small number of providers for hosting, storage and email. Once payments open, Paddle will handle payment. The providers are listed on the sub-processor page at /subprocessors. We sell no personal data. We disclose data to authorities only when the law requires it.

9. Transfers outside the EU

We store and process data in the EU. The database is in Belgium. The server runs in Stockholm. Some of our providers are US companies, such as Vercel. This means data can in some cases be accessed from the United States. For such transfers we rely on the European Commission's standard contractual clauses, or on the provider's certification under the EU–US Data Privacy Framework. The basis used for each provider is shown in the sub-processor list.

10. Cookies

We use only strictly necessary cookies. They need no consent, so there is no cookie banner.

We use no analytics cookies and no advertising cookies.

11. Delete your data

This is how you delete your data with us.

Delete your whole account Email [CONTACT EMAIL] from the address you sign in with. Put "Delete my account" in the subject line. We confirm when it is done.

Within 30 days we delete: your account, your token, your audits and findings, your monitoring settings and the events linked to you.

What remains: once payments open, bookkeeping records required by law and Paddle's own records of your purchase. Backups until they are overwritten [TO VERIFY: retention].

Stop the weekly email Use the stop link in any weekly email.

Delete a scan result Domain scan results are deleted automatically 30 days after the scan. If you want one gone sooner, email us the link.

Do you own a website that has been scanned? Email us the domain. We delete the results and stop scanning the site. See also our legitimate interest assessment for scanning public websites at [TO VERIFY: path].

12. Removing our access to your accounts

You can remove our access directly at Google. Go to myaccount.google.com/permissions, select nicelookingdata and remove access. We then stop all reads in your Google accounts, including weekly monitoring.

What we have already stored remains until you delete your account. [TO VERIFY: whether we should delete the token and data automatically when we detect that access was removed. This is recommended.]

13. Your rights

Under the General Data Protection Regulation you have the right to:

• know what data we hold about you and get a copy,
• have incorrect data corrected,
• have data deleted,
• restrict how we use it,
• receive data you provided yourself in a machine-readable format,
• object to processing based on legitimate interest,
• withdraw consent. This does not affect what has already been done.

Email [CONTACT EMAIL]. We reply within one month.

If your question concerns data in your company's connected accounts, the company is the controller. We will then help the company respond.

We make no decisions about you based solely on automated processing that have legal effects for you.

14. Complaints

Please contact us first. You also have the right to complain to the Swedish Authority for Privacy Protection (IMY).

Integritetsskyddsmyndigheten, Box 8114, 104 20 Stockholm, Sweden. imy.se

15. Security

We ask only for read-only access. Tokens are stored encrypted. All traffic is encrypted. The database can only be reached from our server, not from browsers. Only Ludvig Nyström has access to production data. Further measures are listed in Annex 2 of the data processing agreement.

16. Children

The service is for businesses. It is not directed at children.

17. Changes

We update this policy when the service changes. For significant changes, we email account holders before the change takes effect. The date at the top shows when the policy last changed.