Privacy policy

Data controller

9M Västerås AB, Västerås. Contact: [email protected].

What we process

Interest registration: email address or mobile number, optional company name, time of registration and verification status. Customer accounts: name, email, login credentials and an audit log of actions taken in the service.

Legal basis and purpose

Consent for interest registration (can be withdrawn at any time). Contract for customer accounts. Legitimate interest for security logging.

API signups

When you register interest in an API plan we store your email address, the plan, the page you signed up on and your language, to contact you about access. Legal basis: consent. The data is deleted when you ask us to, or 12 months after the plan launches.

Feature requests and bug reports

When you send a feature request or bug report we store what you write, the area you chose, your language and the page you came from; for bug reports also which browser you used. Your email address is stored only if you give it and agree. No IP address is stored. The submission is emailed to our administrators. Legal basis: legitimate interest in improving the service (consent for the email address). Submissions are deleted after 24 months.

The weekly domain email

If you sign up for the Sunday email about domains being released, we store your email address, your language, when you confirmed and when we last sent the email. You confirm the address through a link before anything is sent, and every email has a link to stop it. Legal basis: consent. Unconfirmed addresses are deleted after 7 days, and addresses that stop the email after 30 days.

Stored in your browser

If you choose light or dark mode, the choice is kept in your browser (localStorage) and never sent to us.

Analytics

We count page views with Umami, which we host ourselves. Umami sets no cookies, stores no personal data and does not track you across sites; we only see aggregate page views.

Where data is stored

All storage is on servers in Sweden. Personal data never leaves the EU in readable form. Providers are listed on the Sub-processors page.

Retention

Interest registrations are deleted 12 months after launch or when consent is withdrawn. Account data is deleted 90 days after the contract ends; audit logs are kept for 24 months.

Your rights

You have the right to access, rectification, erasure, restriction and data portability, and to lodge a complaint with the Swedish Authority for Privacy Protection (IMY). Write to [email protected].