PRIVACY

What we do with your details

The short version: you fill in the form, it becomes an email to us, and we reply. We keep the thread afterwards, and we may come back to you about related work. You can tell us not to, at any point. Nothing goes into a database, and this site doesn't track you.

Who's responsible

Humblebee AB, company registration number 556909-7594, Kvarnbergsgatan 2, 411 05 Göteborg, Sweden, is the controller of the personal data described here. Write to aireadiness@humblebee.se with anything on this page and it reaches the people responsible for it. We have no data protection officer. At our size the GDPR doesn't require one, so there is no separate address to write to instead.

What we collect

Only what the form asks for:

• Name and email. Required, because we can't answer you otherwise.
• Company. Required, so we know who we'd be working with.
• Role and website. Optional. They give us context before we talk.
• When you sent it, and which page you sent it from. Added automatically, so we have the context.

No account, no profile, no scoring, no enrichment from other sources. What you type is what we have.

One technical detail worth stating: when you submit, our function sees your IP address and keeps it in memory for ten minutes to stop bots hammering the form. It isn't written to disk, isn't put in the email, and disappears when the function shuts down. Vercel, who host this site, keep their own request logs. That's ordinary server logging, and it's covered by their agreement with us.

Why we're allowed to

Two separate things happen with your details, and each stands on its own footing.

• Answering you. You asked about a report, so replying, and whatever back-and-forth follows, is us doing the thing you asked for before there's any contract. Article 6(1)(b) of the GDPR.
• Staying in touch afterwards. We keep the thread once the immediate question is settled, and we may write to you about work in the same area as the report, not about everything else we happen to do. That's our own legitimate interest in building the business, Article 6(1)(f). You're being contacted at work, about work.

We've weighed that second one against your side of it and written the reasoning down. Ask and we'll show you. And you can refuse it outright, which is the next thing on this page.

Who else touches it

• Resend delivers the two emails: the one to us, and your confirmation.
• Microsoft 365 holds the shared mailbox the request lands in. That mailbox is the record.
• Vercel hosts the site and runs the form's function.

All three act on our instructions only, under a data processing agreement. Microsoft holds the mailbox inside the EU. Resend is in the US and holds the message there. Their agreement with us commits to deleting it within 90 days of the account closing; their own documentation says copies clear sooner than that, but 90 days is the part we could actually hold them to, so it's the figure we'll quote. Either way the mailbox keeps the lasting copy. Vercel is US-based too.

Those transfers out of the EU/EEA rest on the European Commission's Standard Contractual Clauses, and in two cases on a second safeguard as well. Resend, formally Plus Five Five, Inc., is covered by the Clauses in their Module Two form, written into our agreement and treated by both sides as signed, and is separately certified under the EU-U.S. Data Privacy Framework; where the two disagree, the Clauses win. Vercel relies on the Data Privacy Framework. Microsoft keeps the mailbox inside the EU Data Boundary in the first place, covers any transfer out with the 2021 Standard Contractual Clauses, and is Framework certified too. We hold copies of all of this and will send them to you if you ask.

We don't sell your details, and we don't hand them to anyone for their own purposes.

How long we keep it

While your enquiry is live, and after that while there's a realistic prospect of us working together. That's what the staying-in-touch above amounts to. Once that's clearly over, there's no reason for us to be holding the thread at all.

Nothing deletes it on a timer, though, and we'd rather say so than imply otherwise. The mailbox is the only copy and clearing it is a manual job. So if you want your details gone at a particular moment, don't wait for us to get round to it. Ask, and we'll do it.

One exception: if you've told us to stop contacting you, we keep the bare minimum needed to remember that. Otherwise we'd have no way of knowing, and you'd hear from us again.

Cookies and tracking

We set no cookies, no advertising pixel, no embedded video, no chat widget, and no fonts or scripts from someone's CDN. Text, icons and the animation code all come from this domain.

We do count page views, using Vercel Web Analytics. The counting script is served from this domain, sets no cookies and stores nothing on your device. Each view records the page, where you arrived from, your rough location, and your browser and device type. It does not record your IP address or your name, and it cannot follow you to another site. What reaches us is a total, not a person.

That's also why you're not reading this above a cookie banner. Nothing is stored on your device, so the consent rules a banner exists to satisfy aren't triggered. One would add nothing but a click.

Your rights

You can ask us for a copy of what we hold, have it corrected or deleted, restrict or object to what we do with it, and take it elsewhere. Email aireadiness@humblebee.se and we'll answer within a month.

If you think we've handled this badly, tell us first, because we'd rather fix it. You also have the right to complain to the Swedish Authority for Privacy Protection, IMY, at imy.se.

Last updated 2 September 2026.