Flumen Labs

Data Protection & Privacy

Privacy Policy

Flumen Labs builds calm, trauma-informed, accessibility-first software. That posture extends completely to how we handle personal data: with restraint, total clarity, and rigorous adherence to the EU General Data Protection Regulation (GDPR).

1. Who is responsible for your data

Flumen Labs (enskild näringsverksamhet Dorian Avillus Irilone, org. nr. 19940501-3138) is the data controller for personal data processed across flumenlabs.eu and its platform subdomains. We are based in Gothenburg, Sweden, with our registered postal address at IXF 381-S BILLO, 106 43 Stockholm, Sweden.

For any data protection inquiries or to exercise your GDPR rights, contact us directly at privacy@flumenlabs.eu or scan@flumenlabs.eu.

2. What data we collect and why

  • Accessibility Scans: The website URL submitted for automated analysis and the email address you provide to receive the compliance report (GDPR Art. 6(1)(b) — contract performance / service delivery).
  • Consultancy Enquiries: Your name, email, company, and project requirements submitted via contact forms to evaluate and respond to your request.
  • Abuse Prevention & Security: We store a one-way, irreversible cryptographic hash of IP addresses and user-agent strings to enforce rate limits and prevent automated abuse. We do not store raw IP addresses.
  • Cookies: We use zero advertising cookies, zero cross-site trackers, and no third-party profiling scripts. A single secure, encrypted session cookie is issued only when authenticated team members log in to the administrative portal.

3. Sub-processors and infrastructure

We never sell, rent, or trade your personal data. We engage only carefully selected infrastructure partners under strict Data Processing Agreements (DPAs):

  • Cloudflare: DNS, SSL termination, and edge routing (EU-friendly).
  • Render & TiDB: Application runtime hosting and secure encrypted database storage.
  • Resend: Transactional email delivery operated from EU-west-1 infrastructure.

4. Retention and deletion

Automated scan results and associated submission records are retained for a maximum of six months to allow historical comparison and verification, after which they are automatically pruned. Consultancy enquiries are kept only as long as active correspondence requires. You may request immediate deletion at any time.

5. Your rights under GDPR

Under European data protection law, you hold the right to:

  • Request access to any personal data held about you;
  • Request rectification of inaccurate or outdated information;
  • Request erasure ("right to be forgotten") without undue delay;
  • Restrict or object to processing;
  • Receive your data in a structured, commonly used, machine-readable format (portability).

If you believe our processing infringes your rights, you have the right to lodge a complaint with your supervisory authority. In Sweden, this is Integritetsskyddsmyndigheten (IMY) at imy.se.