Privacy
What happens to your data
Both forms on this site send personal data to services run by US companies. Here is exactly what happens to it, and how to get it back or deleted.
Most of this site collects nothing. There are no analytics, no tracking pixels, no advertising, and no cookies — the site sets none at all, and the fonts are served from this domain rather than from a third party. Reading here leaves no record tied to you beyond the server logs every website keeps.
Two things do collect personal data: the newsletter signup and the enquiry form. This page says what each one takes, where it goes, and how long it stays.
The controller is Athlegan AB (organisation number 559259-0318), owned by me, Tobias Sjösten. The registered address is Kvällsvägen 2, 146 31 Tullinge, Sweden. Write to hello@seastone.io about any of it.
The newsletter
Subscribing sends your email address and your IP address to MailerLite, which runs the list and delivers the mail. MailerLite stores both in the EU, in Google’s data centre in the Netherlands. The company I have the agreement with is MailerLite, Inc. in San Francisco, though, so subscribing still counts as a transfer out of the EU.
What makes that transfer lawful is the European Commission’s standard contractual clauses for controller-to-processor transfers, which MailerLite’s data processing addendum incorporates. Ask me and I’ll send you a copy.
The IP address is part of the proof of your consent: together with the time, it shows where the signup came from, which is what I’d point to if that consent were ever questioned.
Nothing is sent until you confirm. Signing up creates an unconfirmed record and MailerLite mails you a link; ignore it and the record never becomes a subscription. That also stops anyone signing you up with your address.
MailerLite can track who opens an issue and which links they click. I’ve turned both off, so the mail you get carries no tracking pixel and its links go straight where they say.
The legal basis is your consent, and the address is the whole of what I need — there’s no newsletter to send without one. You can withdraw consent at any time: every issue carries an unsubscribe link, and unsubscribing removes you from the list. Withdrawing stops everything from that point on; it doesn’t make the mail I already sent unlawful. Until you withdraw, your address stays.
The enquiry form
The form on Work with me takes your name, an email address or a phone number, your message, and which offer you picked. I need your name and one way to reach you, so one of email and phone is enough. It arrives as an email in my inbox. There is no database, no CRM, and no list — it is a message from you to me.
That inbox runs on Google Workspace. Google stores your message for me as my processor, under its Cloud Data Processing Addendum, and its servers may be in the United States. A transfer there rests on Google LLC’s certification under the EU–US Data Privacy Framework, with the standard contractual clauses in the same addendum as the fallback.
Before the form sends, Cloudflare’s Turnstile checks that a person is sending it rather than a script. To do that it looks at your IP address and technical details of your browser, such as its user agent, and it sets no cookies. Cloudflare also uses those details on its own account to improve its bot detection, under its own notice. I run the check because I have a legitimate interest in keeping scripts from filling my inbox. It’s also why the form needs JavaScript to send.
I reply personally. Your message stays in my mail archive while I’m answering it and for as long as work might still follow from it — in practice a year after we last spoke, and then I delete it. If we do end up working together, invoices and anything else that counts as accounting material stay seven years, because Swedish bookkeeping law requires it. Ask me to delete your message sooner and I will, unless it has become part of that accounting record.
The legal basis is that you asked me to get in touch: handling your message is a step towards a possible agreement, taken at your request.
Hosting and logs
The site is hosted on Cloudflare Pages. Like any web host, Cloudflare logs requests — including IP addresses — to serve pages and to absorb attacks. Keeping the site up and reachable is my legitimate interest in doing it. I use those logs for nothing else, and I don’t combine them with anything above.
What you can ask for
You can ask me for a copy of what I hold about you, to correct it, to delete it, to restrict what I do with it, to object to it entirely, or to have it handed over in a portable form so you can take it elsewhere. Mail hello@seastone.io and I’ll handle it myself — there’s no form and no ticket queue.
If you think I’ve handled your data badly and I haven’t put it right, you can complain to the Swedish authority, IMY.
Changes
If what happens to your data changes, this page changes with it.
Last updated 8 October 2026.