Privacy

Who we are

PlaceKernel is operated by Stefan Pinckney, Stralgatan 9, 112 63 Stockholm, Sweden, who is responsible for your personal data. Contact:  .

What we collect and why

We have no user accounts. We collect:

• The email address you give at purchase, with a record of your order (order reference, price, payment reference, dates and status). We use it to deliver your reports, send download links and handle support.
• Your report selections (Function, sub-functions, primary goal, region and English requirement) and the reports made from them, so we can deliver your reports again.
• A support record of your order: when you ticked the delivery consent, when you paid, when your reports were made, which emails we sent, when each report was downloaded, and when we opened or downloaded your reports or re-sent your download links while handling your order. It contains no IP address or device data. We use it to handle support, refunds and payment disputes.
• When you ask for a new download link: a keyed one-way hash of your email address and IP address, used to limit repeated requests.
• When you start a checkout: a keyed one-way hash of your IP address, used to limit repeated checkout attempts.
• Messages you send us, to answer them.

We use the first two to fulfil our contract with you, and the others for our legitimate interests in preventing abuse and answering you.

Selections made in the recommendation form are also recorded without any identifier, to understand demand. They are not linked to you and are deleted after 12 months.

We count page views and the selections made in the form for our legitimate interest in understanding how the website is used.

Payments

Payment is handled by Stripe Managed Payments. Sold through Link, LLC ("Link"), an affiliate of Stripe, sells your order as merchant of record, and Stripe companies process the payment. Link collects your name, email address, billing address and payment details (and a tax ID if you give one) under the Link Privacy Policy; Stripe and we are independent controllers of this data. Link shares your order details with us. We keep only the email address you give at checkout, the payment reference and whether the payment was completed, refunded or disputed. We do not receive or store your card details.

Cookies and tracking

Our own pages set no cookies. The order page keeps a reference to your order in your browser tab until you close it, so it can show your downloads.

We count page views without cookies. Cloudflare Web Analytics counts views without tracking individual visitors. Our own count records, for each view, the page, the time, your country and the referring website's domain, plus a code made from your IP address and browser with a key we delete every day. We never store your IP address or browser details and cannot recognise you from one day to the next. These records are kept for 12 months.

When you continue to payment, you go to Stripe's checkout page (checkout.stripe.com), run by Stripe and Link. They set the cookies and browser storage they need to take your payment securely and prevent fraud, under the Link Privacy Policy. Our own pages load nothing from Stripe.

Service providers

• Supabase: our database and file storage, in London, UK. Downloads, order status and requests for a new download link are handled by functions on Supabase, in the Supabase location closest to the visitor, which can be outside the UK and the EU. They work with the data in London and do not store it anywhere else.
• Google Cloud: creates the PDF files. London, UK. It does not receive your email address.
• Cloudflare: hosts this website, runs its server functions (recommendation results, checkout, order page, page-view counting) on its global network, and protects it against abuse.
• Resend: sends our emails (download links and order messages). It receives your email address and the content of the email. Emails are sent from the United States (North Virginia).
• Emails you send to   are handled by Proton (Switzerland).
• Cloudflare R2: encrypted backups of our database and stored reports, stored in the European Union.

The UK and Switzerland have EU adequacy decisions. Cloudflare, Supabase, Google and Resend are US-based companies, and Cloudflare's network and Supabase's server functions can process data outside the EU/EEA and the UK. For these transfers we rely on each provider's data processing agreement, which includes the EU Standard Contractual Clauses and the UK addendum, and on the EU-US Data Privacy Framework where the provider is certified.

How long we keep data

• Your order, the email address you gave, your selections and your reports: 3 years from your order. We then delete your email address, selections and reports, and keep only a record of the sale that no longer contains your email address (order number, package, amount, currency, status and dates).
• The support record of your order: 3 years from your order, deleted with your order.
• Requests for a new download link: 30 days.
• Checkout attempt records: 1 day.
• Recommendation form selections (without identifier): 12 months.
• Page view records (no IP address): 12 months.
• Download links: deleted 30 days after they expire.

• Backups: daily backups are kept for 35 days and monthly backups for 12 months, then deleted automatically. Backups made before 17 October 2026 were kept in an earlier storage location in the Asia-Pacific region; they are deleted automatically by 16 November 2027. Data we delete stays in backups until those backups expire. If we ever restore a backup, we delete that data again.
• Technical logs at Supabase and Cloudflare, which can include IP addresses: up to 7 days. Cloudflare's security event log, which records the IP addresses of blocked requests: up to 30 days. Logs of the service that creates the PDF files (Google Cloud): 30 days. That service never receives your email address or IP address.

Your rights

You can ask to access, correct or delete your personal data, to restrict how we use it, or to receive it in a portable format. You can also object to any use based on our legitimate interests. Contact  . You can also complain to the Swedish Authority for Privacy Protection (IMY), imy.se.