This site collects
almost nothing.

Who is responsible

Chenborg AB, Göteborg, Sweden, part of Chenist Cyber Security, is the data controller for this website. Write to hej@chenborg.com with anything on this page and a person will answer.

Cookies

There are none. Not "essential only" — none at all. That is why you were not shown a consent banner: there is nothing to consent to. Nothing is written to your browser's storage by this site.

Analytics

There are none of those either. We do not run Google Analytics, Plausible, Matomo, or any self-hosted equivalent. We genuinely do not know how many people read any given page, and have decided we can live with that.

Third-party requests

Loading this page contacts no server other than ours. Fonts, styles, scripts, icons and images are all served from this domain.

Earlier versions of this site loaded its typefaces from Google Fonts, which transmits the visitor's IP address to a third party on every page load. That was a real contradiction of what we tell clients, so the fonts are now self-hosted. We mention it because we would rather describe the fix than quietly pretend it was always this way.

Links that leave this site — to Chen.ist, Codeberg, Mastodon or a project's own pages — are ordinary links. Nothing is requested from those domains until you choose to follow one.

The contact form

The form on our contact page posts to a small function on our own Cloudflare account, which composes one email and hands it to Cloudflare Email Service for delivery to our mailbox. There is no third-party form service, no database, and no cookie: what you type is turned into an email and nothing else. The fields we receive are the ones on the form — your name, email address, organisation, topic, timing and message — and they are then treated exactly like any other mail you send us, described under If you write to us below.

Server logs

Our web server keeps ordinary access logs: IP address, timestamp, requested path, response code, referrer and user agent. This is the minimum needed to keep a public server running and to investigate abuse.

Legal basis is legitimate interest (Article 6(1)(f) GDPR) in operating and securing the service. Logs are kept for 14 days and then deleted. They are not joined to anything else, not profiled, and not shared.

If you write to us

Your email, and whatever you put in it, sits in our mailbox. We use it to answer you and, if we end up working together, to run the engagement. Legal basis is legitimate interest or, once there is a contract, its performance (Article 6(1)(b)).

Enquiries that do not lead to work are deleted after 24 months. We do not add you to a mailing list — there is no mailing list — and we never pass your details to anyone.

Where the data lives

This site and our mail are hosted in the EU. Client systems we operate are hosted in Romania, Sweden or Germany, at the client's choice, on providers incorporated in the EU. No personal data is transferred outside the EU or EEA in the course of running this website.

Your rights

Under the GDPR you may ask for access to your personal data, correction, erasure, restriction of processing, portability, and you may object to processing based on legitimate interest. Write to hej@chenborg.com and we will answer within 30 days, usually the same week.

If you are unhappy with how we have handled it you may complain to your national supervisory authority — in Sweden, the Integritetsskyddsmyndigheten (IMY).

Security reports

If you have found a vulnerability in this site or something we operate, the details are in /.well-known/security.txt. We will not threaten you for reporting something in good faith.

Changes

This page is version-controlled along with the rest of the site, so its history is a matter of record rather than a claim. Last substantive change: 24 September 2026.