Privacy Policy

Last updated: 2026-07-29

Who is responsible

Pihlfelt (pihlfelt.se) is the data controller for the processing described here. Contact us via the support page if you have questions about your data.

Data we process on pihlfelt.se

  • Account: name, email address and password (stored hashed). Legal basis: contract.
  • Licenses and purchases: license keys, the sites a license is activated on, order history and payment references. Card details are handled by our payment provider and never reach our servers. Legal basis: contract and bookkeeping law.
  • Support requests: whatever you send us yourself. Legal basis: legitimate interest in helping you.
  • Cookies: only technically necessary cookies for login and language selection. We use no third-party tracking cookies.

The AI service in our plugins (api.pihlfelt.se)

When you actively use an AI feature in Pihlfelt Image Assistant, the following is sent to our server:

  • The image you request metadata for
  • The image file name and, if enabled in the settings, the title of the page/product where the image is used and its existing alt text
  • A pseudonymized site identifier (a hash — we cannot derive the email address from it)
  • For Pro: your license key, to verify plan and quota

Images are never stored. They are processed in memory and discarded as soon as the response is sent. For the image analysis we use OpenAI as a sub-processor; the image is forwarded for analysis but is not used to train their models under our agreement (API service). Nothing is ever sent automatically — only when you start an AI action yourself, and only after you have approved this in the plugin.

We keep usage logs (number of requests, timestamp, site identifier, action type) for quota management and abuse prevention. Legal basis: contract and legitimate interest. Logs are deleted after 24 months.

Server-side image optimization (Pro) works the same way: the image is processed in memory, returned optimized and never stored.

Sub-processors and storage

  • Oderland Webbhotell AB (Sweden): hosting of pihlfelt.se.
  • Hetzner Online GmbH (Germany/Finland): hosting of api.pihlfelt.se. All storage is within the EU.
  • OpenAI (USA): image analysis for the AI features. Transfers are protected by the EU Commission's standard contractual clauses.

Your rights

You have the right to request access to, rectification or erasure of your personal data, as well as data portability and restriction of processing. Contact us via the support page. You can also lodge a complaint with the Swedish Authority for Privacy Protection (IMY).

Changes

If this policy changes, the new version is published on this page with a new date.