Privacy Policy

Last updated: 2026-10-02

This policy describes how we process personal data when you visit pihlfelt.se, have an account with us or use our WordPress plugins. Each plugin has its own section further down.

Who is responsible

Pihlfelt & Vänner AB (Swedish company reg. no. 556952-1056), Boda Båtmanstorp 203, 395 94 Rockneby, Sweden, is the data controller for the processing described here. Contact us at [email protected] or via the support page if you have questions about your data.

Data we process on pihlfelt.se

  • Visits: IP address, browser and timestamp end up in server logs at our hosting provider. Legal basis: legitimate interest in operations and security.
  • Account: name, email address, password (stored hashed) and your settings. Legal basis: contract.
  • Purchases and licenses: license keys, the sites a license is activated on, order history, invoices, billing address, VAT number where applicable, and payment references. Card details are handled by our payment provider Stripe and never reach our servers. Legal basis: contract and Swedish bookkeeping law.
  • Contact, support requests and feature requests: name, email address, phone number if you provide one, and whatever you write to us. Legal basis: legitimate interest in being able to reply and help you.
  • Email from us: we send service messages such as receipts, license keys and replies to requests, and log recipient, subject and time so we can troubleshoot delivery. Legal basis: contract and legitimate interest.
  • Downloads: when you download a plugin from pihlfelt.se, the IP address and browser are stored for statistics and abuse prevention. Legal basis: legitimate interest.
  • Security logs: login attempts (email address, IP address, browser, whether the attempt succeeded) and a log of events on the account. IP addresses that abuse the service may be blocked. Legal basis: legitimate interest in protecting accounts and the service.
  • Spam protection: the contact, support and feature request forms are protected by Google reCAPTCHA, which assesses whether a submission comes from a human. Google then receives, among other things, your IP address and information about your browser. Legal basis: legitimate interest in stopping spam.

We never sell personal data and do not use it for automated decision-making.

Cookies and similar technologies

  • Necessary: pihlfelt-session (keeps you logged in and remembers language and currency, 2 hours) and XSRF-TOKEN (protects forms against forged requests, 2 hours). Your cookie choice is saved in the browser's local storage. On pages with forms, Google reCAPTCHA may set its own cookie for spam protection.
  • Analytics — only with your consent: Google Analytics (_ga, _ga_*, up to 2 years) helps us see how the site is used. The scripts are not loaded until you have accepted analytics cookies.
  • Marketing: we currently use no marketing cookies.

You can change or withdraw your choice at any time using the cookie button at the bottom of the page. Fonts are loaded from Bunny Fonts and some script libraries from jsDelivr; they set no cookies, but your IP address is technically transmitted when the files load.

Our WordPress plugins

The plugins run on your own WordPress site. What they store lives in your own database, which we have no access to, and you are responsible for the personal data on your site. The plugins contain no telemetry and send no usage statistics to us. The following applies to all plugins:

  • Free versions installed from WordPress.org are updated through WordPress.org, under their privacy policy.
  • License (Premium/Pro): when you activate, check or deactivate a license, the license key and the site address are sent to pihlfelt.se. We store which sites the license is activated on in order to apply the plan's limit.
  • Updates (Premium/Pro): an update check sends the license key, the installed version and the site address. Downloads are logged as described above.

Legal basis for license and update checks: contract.

WP Technical Site Auditor

All scanning and analysis happens locally on your server, and the reports are stored in your own database. The plugin sends no personal data or scan results to us.

The external requests the plugin makes from your server are:

  • api.wordpress.org — checking for updates and the integrity of WordPress core files during a scan
  • the addresses your own links point to, if you have enabled external link checking
  • pihlfelt.se — license and update checks (Premium)

Pihlfelt Image Assistant

Resizing, compression, backup and metadata editing happen locally on your server. The AI features use our service at api.pihlfelt.se. When you actively use an AI feature, the following is sent to our server:

  • The image you request metadata for
  • The image file name and, if enabled in the settings, the title of the page/product where the image is used and its existing alt text
  • A pseudonymized site identifier (a hash — we cannot derive the email address from it)
  • For Pro: your license key, to verify plan and quota

Images are never stored. They are processed in memory and discarded as soon as the response is sent. For the image analysis we use OpenAI as a sub-processor; the image is forwarded for analysis but is not used to train their models under our agreement (API service). Nothing is ever sent automatically — only when you start an AI action yourself, and only after you have approved this in the plugin.

We keep usage logs (number of requests, timestamp, site identifier, action type) for quota management and abuse prevention. Legal basis: contract and legitimate interest. Logs are deleted after 24 months.

Server-side image optimization (Pro) works the same way: the image is processed in memory, returned optimized and never stored.

Pihlfelt Cost & Margin Pricing for WooCommerce

Purchase costs, suppliers, margins, rules and the price log are stored in your own WooCommerce database and are never sent to us.

The external requests the plugin makes from your server are:

  • The European Central Bank (ECB) and the fallback source open.er-api.com — fetching exchange rates once a day. The requests contain no information about your store, your products or your customers. If you enter rates manually, no such requests are made.
  • pihlfelt.se — license and update checks (Pro)

Recipients and sub-processors

  • Oderland Webbhotell AB (Sweden): hosting of pihlfelt.se and our email.
  • Hetzner Online GmbH (Germany/Finland): hosting of api.pihlfelt.se. All storage is within the EU.
  • Stripe Payments Europe Ltd (Ireland): payments, invoicing and tax calculation. Stripe is an independent controller for parts of the payment processing.
  • OpenAI (USA): image analysis for the AI features in Pihlfelt Image Assistant. Transfers are protected by the EU Commission's standard contractual clauses.
  • Google Ireland Ltd (Ireland): Google Analytics, if you have consented, and reCAPTCHA on forms.
  • BunnyWay d.o.o. (Slovenia) and jsDelivr: delivery of fonts and script libraries.

Stripe and Google may transfer data to the USA. This is done under the EU–US Data Privacy Framework or the EU Commission's standard contractual clauses.

How long we keep data

  • Account: until you delete the account in your account settings or ask us to.
  • Purchases and invoices: seven years after the end of the financial year, under Swedish bookkeeping law.
  • Licenses and activated sites: for as long as the license is linked to your account.
  • Contact and support requests: for as long as they are needed to follow up on the request; they are deleted on request.
  • Security logs and download IP addresses: 12 months, after which they are deleted automatically.
  • Usage logs for the AI service: 24 months.

Deleted data may remain in backups for a short time before being overwritten.

Your rights

You have the right to request access to, rectification or erasure of your personal data, as well as data portability and restriction of processing. You can object to processing based on legitimate interest and withdraw a consent at any time, for example for analytics cookies. Contact us via the support page. You can also lodge a complaint with the Swedish Authority for Privacy Protection (IMY).

Changes

If this policy changes, the new version is published on this page with a new date. The terms for the website and our plugins are found in our terms.