Privacy

Who is responsible

Sleeken AB, org.nr 559599-3600, is the data controller for this site. Registered office in Stockholm, Sweden.

For anything in this notice, including a request to exercise your rights, write to hi@suruosh.se.

What is not collected

To be specific, because most privacy notices are vague about this:

• No cookies of any kind — not functional, not analytical, not advertising.
• No local storage, session storage or IndexedDB. Nothing is written to your device.
• No analytics, no tag manager, no advertising pixels, no fingerprinting.
• No account, no sign-up, no newsletter, and no form other than the Ask box.
• No profiling, no automated decision-making, and nothing sold or handed to data brokers.
• Not even the light and dark setting. It is recalculated from your clock on every load.

Server logs

This site is hosted on Vercel. Like any web host, Vercel records the requests it serves: IP address, user agent, the URL requested and a timestamp. That happens for every site on the internet, and it is how a server stays secure and debuggable.

The legal basis is legitimate interest, Article 6(1)(f) — keeping the site up and detecting abuse. Vercel Inc. acts as a processor under a data processing agreement. These logs are not read for any other purpose.

The Ask box

The Ask box answers questions about my work. When you send a question, that question and the rest of your conversation are forwarded to the Google Gemini API so it can produce an answer.

The request runs on a paid Gemini API tier. Under those terms Google does not use the content to train its models; it is held transiently for abuse monitoring and then deleted.

Nothing is stored at this end. There is no database. Your conversation lives in your browser tab and is gone when you close or refresh it.

It is a portfolio question box, so treat it as public. It is not the place for personal, confidential or sensitive information.

Rate limiting

So that one visitor cannot exhaust the endpoint, the server counts requests per IP address in memory for sixty seconds and then forgets them. That counter is never written to disk and is not joined to anything else.

Fonts and other requests

The typeface is served from this domain. Loading this site does not send your IP address to Google, or to anyone else, for fonts or for anything else.

Links to my ventures and to client work open those sites in a new tab. Once you are there you are on their site, under their privacy notice, not this one.

Email

If you write to me, I keep the correspondence so I can answer it and so there is a record of what was said. Legal basis: legitimate interest, or the steps leading to a contract where that is what we are discussing.

Transfers outside the EU and EEA

Two processors are American: Google LLC, for the Gemini API behind the Ask box, and Vercel Inc., for hosting. Both transfers rely on the European Commission’s Standard Contractual Clauses, and both companies are certified under the EU–US Data Privacy Framework.

How long anything is kept

Server logs: a short rolling window, per Vercel’s platform retention. Ask box conversations: not retained here at all. The rate-limit counter: sixty seconds. Email: as long as the matter is live, and after that as long as accounting law requires for anything that became an engagement — seven years under the Swedish Bookkeeping Act.

Your rights

Under the GDPR you have the right to:

• Ask what personal data is held about you, and get a copy of it.
• Have inaccurate data corrected.
• Have data erased, where there is no overriding reason to keep it.
• Restrict or object to processing carried out under legitimate interest.
• Receive data you provided in a portable format.

Write to hi@suruosh.se and you will have an answer within a month. Given how little is collected, most requests here resolve quickly.

If you think this site handles your data badly, you can complain to the Swedish Authority for Privacy Protection — Integritetsskyddsmyndigheten, at imy.se. You can go to them directly; you do not have to raise it with me first, though I would rather you did.

Changes

If what this site does with data changes, this page changes first and the date at the top moves. It never moves backwards.