01Who is responsible
[To confirm: legal name of the company behind Saga Labs] (organisation number [to confirm], [registered address], Sweden) runs Saga Labs and saga-labs.com, and is responsible for the personal data described here.
02What we collect
When you read the site
The site sets no cookies and runs no analytics, advertising pixels or other trackers. Fonts and scripts come from our own server, so your browser contacts no one else.
Like any web server, ours records each request in an access log: your IP address, the time, the page you asked for and whether it worked. We use the log to keep the site running and secure.
When you write to us
The contact form sends the topic you picked, your message, your name, your company if you gave one, and your email address. We store these with a random identifier for the message and the time it arrived.
To keep out automated spam, the form also sends a hidden field that people leave empty and how long the form took to fill in. Both are checked when the message arrives and are not stored with it. To stop the same sender flooding the inbox, we keep a one-way code made from your email address for up to 7 days. It cannot be turned back into the address.
03Why we use it
We use your message and details only to read it and reply to you. The legal bases are steps you asked us to take and our legitimate interest in answering the people who contact us. The access log and the spam check rest on our legitimate interest in keeping the site and inbox secure.
We do not add your details to a sales or marketing system, send you marketing, or share them with advertising platforms. We make no automated decisions about you.
04Who sees it
Only the founder of Saga Labs can read messages sent through the form. Access is limited in code to the founder's own accounts. No one else at Saga Labs or at Saga Compliance can open the inbox.
The site and the inbox run on our production server at DigitalOcean in Frankfurt, Germany, in the EU. Hosting, backups and delivery of the site are handled by processors that act only on our documented instructions. If we reply, we write from our company mailbox, which Google Workspace hosts as a processor. We do not sell personal data.
05How long we keep it
- Your message and details
- Deleted automatically 180 days after they arrive. The founder can delete a message sooner, and will if you ask.
- Backups
- Daily backups of the production database are kept for 30 days. A deleted message can remain in a backup for up to 30 more days before it is overwritten.
- The spam-check code
- Up to 7 days.
- The access log
- [To confirm: how long access logs are kept]
06Your rights
You can ask what personal data we hold about you, and ask us to correct it, delete it, limit how we use it or stop using it. You can also complain to a supervisory authority. In Sweden that is Integritetsskyddsmyndigheten (IMY).
To make a request, write to us through the contact form and say it is a privacy request. The form asks for a work email; if you cannot use one, write to [privacy contact address].
If this notice changes, we update the version date at the top.