Privacy policy

How Ketryon collects, uses and protects your personal data.

Last updated: September 2026

1. Who we are

Ketryon AB is a Swedish software development company. We build web and app services on subscription and as separate engagements, and offer technical advice. This privacy policy explains how we handle personal data in connection with our website (ketryon.com) and our consulting services.

Data controller: Ketryon AB (company reg. no. 559551-1030), Eskilstuna, Sweden. Contact: hello@ketryon.com.

2. What data we collect

We collect personal data in the following situations:

Client engagements — contact details, company information and project-related data needed to deliver our consulting services under a signed agreement.
The form — if you answer the three questions on /onboarding, we process your three answers (where you are today, who the service is for, and when you want to start). The form does not ask for your email address and sends no email. The answers are passed to the sketch tool as background and are not stored in any database of ours.
The sketch tool — on /editor, what you write about what you want to build is processed, together with your three answers if you came through the form, to generate a sketch. This only happens at your own request. The input is sent to Anthropic; see section 5.
If you ask for the sketch to be built for real — then, and only then, you give us your email address. We process the address, the description you wrote and your three answers to send you a confirmation and to be able to reply to you. The data sits in the log at our email provider and in the email correspondence that follows, and is not stored in any database of ours. The address is not linked to the saved sketches below.
Saved sketches — what you write in the sketch tool and the page generated from it are saved by us, so that we can see what visitors actually want to build and improve the tool. The data is stored with Cloudflare (see section 5) and is deleted automatically after 12 months. It is saved without your email address and without your IP address: a random identifier keeps together what you wrote during a single visit, but we cannot link it to you as a person. If you ask for the sketch to be built for real, the fact that this happened is saved — never who asked. The legal basis is our legitimate interest in developing the service (Article 6(1)(f)).
Website analytics — anonymised usage data collected through Vercel Analytics. No cookies are used. No personally identifiable information is tracked.
Visitor statistics — if you consent, Microsoft Clarity records how the site is used (mouse movements, clicks and how far you read) and sets cookies that tie your page views to the same recorded session. The data is pseudonymous, not anonymous: it cannot be linked to your name, but it is personal data under the GDPR. This never happens without your consent. See section 8.
Ad measurement — if you consent, the OpenAI Ads pixel reads and stores cookies in your browser to link a visit to an ad. This never happens without your consent. The pixel also has a feature called automatic advanced matching: when you enter your email address in the sketch tool, it can read the address, turn it into a cryptographic hash (SHA-256) in your browser and send the hash along with the measurement, so that OpenAI can connect you with the ad you came from. The address in plain text never leaves your browser for OpenAI, but a hash of an email address is still personal data. What you write about what you want to build is not sent. See section 8.

3. How we use your data

We use personal data only for the following purposes:

To answer your enquiries and provide requested information.
To book and hold consultations.
To contact you if you have given your email address in the sketch tool.
To deliver consulting services under a client agreement.
To send project-related communication during an active engagement.
To meet legal obligations (bookkeeping, tax reporting).

We do not use your data for marketing without your explicit consent. We do not sell, rent out or share your personal data with third parties for their own marketing purposes.

4. Legal basis for processing

Under the General Data Protection Regulation (GDPR), we process your data on the basis of:

Legitimate interest — answering enquiries, improving our services and website analytics.
Contractual necessity — processing required to deliver services under a client agreement, and steps taken at your own request before an agreement is entered into — for example when you give your email address in the sketch tool so that we can contact you.
Legal obligation — keeping accounting records under the Swedish Bookkeeping Act (1999:1078).
Consent — where applicable, for example for marketing communication.

5. Sharing of data and third parties

We may share personal data with the following categories of data processors:

Hosting and infrastructure — Vercel (web hosting), within the EU/EEA.
Storage — Cloudflare (R2), where the sketches and what you wrote in the sketch tool are saved. The objects are stored in Europe. Cloudflare is certified under the EU-US Data Privacy Framework; to the extent that any transfer to the United States occurs, it takes place on that basis and under standard contractual clauses.
Communication tools — Cal.com (meeting bookings).
Email services — Resend, for transactional emails connected to your enquiry or your project. The email address you gave in the sketch tool is sent here, together with your three answers and the description you wrote, so that the confirmation can be sent to you.
AI services — Anthropic (Claude), only if you choose to open the sketch tool on /editor yourself. What you wrote about what you want to build and your three answers are sent here to generate the sketch. Your email address is not sent. Anthropic is certified under the EU-US Data Privacy Framework; transfers to the United States take place on that basis and under standard contractual clauses.
Advertising platforms — OpenAI (ChatGPT Ads), only with your consent, to measure how well ads work. Visit data and, through automatic advanced matching, a SHA-256 hash of the email address you entered are sent here. Transfers to the United States take place under the EU-US Data Privacy Framework and standard contractual clauses.

We make sure that all third-party processors meet the requirements of the GDPR or have appropriate safeguards (standard contractual clauses) in place for transfers outside the EU/EEA.

Microsoft Clarity — visitor statistics (session recording and heatmaps), only with your consent. The recordings show how the site is used — mouse movements, clicks and how far you read. They do not contain text you type: Clarity masks form content, numbers and email addresses in the browser before anything is sent, and the email field in the form on /onboarding is also explicitly masked in the code. Microsoft Ireland Operations is an independent controller of that data, not our processor, and handles it in accordance with Microsoft's privacy statement.

6. How long we keep data

Client project data — kept for the duration of the engagement plus 24 months, unless Swedish law requires a longer period.
Requests from the sketch tool — the email address, the description and the answers sit in the log at our email provider and in the correspondence that follows, and are deleted when the contact has ended, no later than 12 months after they were given.
Saved sketches — deleted automatically 12 months after they were created. The deletion is handled by the storage service itself, not by a manual routine.
Accounting records — kept for 7 years under the Swedish Bookkeeping Act (1999:1078).
Website analytics — Vercel Analytics is anonymised and stores no personal data. Microsoft Clarity keeps recordings for 30 days, except recordings marked as favourites and a random sample, which are kept for up to 9 months. Heatmaps are available for up to 9 months. The retention period is set by Microsoft.
Cookies — the consent cookie is kept for 12 months, after which you are asked again. Statistics and advertising cookies are deleted as soon as the corresponding consent is withdrawn.

7. Your rights under the GDPR

As a data subject, you have the following rights under the GDPR and Swedish data protection law:

Right of access — request a copy of your personal data.
Right to rectification — request that incorrect data is corrected.
Right to erasure — request that your data is deleted when there is no legal basis for keeping it.
Right to restriction — request that we limit how we use your data.
Right to data portability — receive your data in a structured, machine-readable format.
Right to object — object to processing based on legitimate interest.
Right to withdraw consent — where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, contact us at hello@ketryon.com. We reply within 30 days.

8. Cookies

We set no cookies before you have made a choice in the cookie banner, and nothing is loaded in advance. If you choose “Necessary only”, no cookies are set at all apart from the one that stores your choice. You can accept statistics and ad measurement separately under “Customise”.

Necessary — ketryon_consent stores your own choice for 12 months. Without it, the banner would appear on every page load. No consent required.
Necessary — kt_sketch is set when you have completed the form and gives access to the sketch tool on /editor for two hours. It is httpOnly, so it cannot be read by JavaScript, contains no information about you — only a signature and an expiry time — and disappears on its own. Without it the tool cannot be used. No consent is required, because it is necessary for a feature you asked for. If you want to get rid of it early, clearing the site data for ketryon.com is enough.
Necessary — sessionStorage briefly holds kt_sketch_seed, your three answers, so that the sketch tool knows who the sketch is for. It is read once, deleted straight away and only ever stays in the current tab. localStorage holds kt_sketch_work — the sketch you just received and what you wrote to get it — so that a reload or a closed tab doesn't cost you the work. It is deleted automatically after two hours, at the same time as access to the tool expires, and you can clear it yourself by clearing the site data for ketryon.com. Neither leaves your device except as the input for the sketch. No consent required.
Statistics (requires consent) — Microsoft Clarity sets _clck and _clsk on our own domain, and CLID, ANONCHK, MR, MUID and SM on Microsoft's domains. They tie page views together into one recorded session. The script is only loaded after you consent.
Ad measurement (requires consent) — the OpenAI Ads pixel sets __oaiq_consent, __oaiq_domain_probe, __oaiqInitialized and __oppref and __obref, which link a visit to an ad for up to 30 days. The script is only loaded after you consent. In addition to these cookies, the pixel may send a SHA-256 hash of an email address you entered — see section 2.

Vercel Analytics uses no cookies and stores nothing on your device, so it does not require consent.

You can change or withdraw your choice at any time through Cookie settings at the bottom of the page. When you withdraw consent, the cookies for that purpose are deleted straight away. Microsoft's own cookies are deleted by Clarity at our request, because they sit on Microsoft's domains and cannot be deleted from our side.

9. Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction. These include encrypted connections (HTTPS/TLS), access controls and regular security reviews.

10. Personal data breaches

In the event of a personal data breach that poses a risk to your rights and freedoms, we will report it to the Swedish Authority for Privacy Protection (IMY) within 72 hours and inform the people affected without undue delay, in accordance with Articles 33 and 34 of the GDPR.

11. Supervisory authority

You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) if you believe your data is being processed unlawfully.

Website: www.imy.se

12. Changes to this policy

We may update this privacy policy to reflect changes in our services or in legal requirements. The “Last updated” date at the top of this page shows when the policy was last revised. We encourage you to review this page regularly.

Contact

For privacy-related questions, contact us at hello@ketryon.com.

This is a translation. If the English and Swedish versions differ, the Swedish version applies.