Privacy
What happens to your data
The two forms on this site collect personal data, and both end up with a service in the United States. Here is exactly what happens to it, and how to get it back or deleted.
Most of this site collects nothing. There are no analytics, no tracking pixels, no advertising, and no cookies — the site sets none at all, and the fonts are served from this domain rather than from a third party. Reading here leaves no record tied to you beyond the server logs every website keeps.
Two things do collect personal data: the newsletter signup and the enquiry form. This page says what each one takes, where it goes, and how long it stays.
The controller is Athlegan AB (organisation number 559259-0318), owned by me, Tobias Sjösten. The registered address is Kvällsvägen 2, 146 31 Tullinge, Sweden. Write to [email protected] about any of it.
The newsletter
Subscribing sends your email address and your IP address to Buttondown, which runs the list and delivers the mail. Buttondown is a US company, in Richmond, Virginia, so subscribing transfers your address out of the EU.
What makes that transfer lawful is the European Commission’s standard contractual clauses — Module 2, controller to processor, from implementing decision (EU) 2021/914 — which Buttondown’s data processing agreement incorporates. Ask me and I’ll send you a copy.
The IP address goes with it deliberately. Buttondown screens new subscribers to keep bots off the list, and that screening weighs where the signup came from. Without your address it would judge my server instead of you, and turn away real readers.
Nothing is sent until you confirm. Signing up creates an unactivated record and Buttondown mails you a link; ignore it and the record never becomes a subscription. That also stops anyone signing you up with your address.
The legal basis is your consent, and the address is the whole of what I need — there’s no newsletter to send without one. You can withdraw consent at any time: every issue carries an unsubscribe link, and unsubscribing removes you from the list. Withdrawing stops everything from that point on; it doesn’t make the mail I already sent unlawful. Until you withdraw, your address stays.
The enquiry form
The form on Work with me takes your name, email address, an optional phone number, your message, and which offer you picked. I need the name and email to answer you; the phone number is yours to leave blank. It arrives as an email in my inbox. There is no database, no CRM, and no list — it is a message from you to me.
That inbox runs on Google Workspace. Google stores your message for me as my processor, under its Cloud Data Processing Addendum, and its servers may be in the United States. A transfer there rests on Google LLC’s certification under the EU–US Data Privacy Framework, with the standard contractual clauses in the same addendum as the fallback.
I reply personally. Your message stays in my mail archive while I’m answering it and for as long as work might still follow from it — in practice a year after we last spoke, and then I delete it. If we do end up working together, invoices and anything else that counts as accounting material stay seven years, because Swedish bookkeeping law requires it. Ask me to delete your message sooner and I will, unless it has become part of that accounting record.
The legal basis is that you asked me to get in touch: handling your message is a step towards a possible agreement, taken at your request.
Hosting and logs
The site is hosted on Cloudflare Pages. Like any web host, Cloudflare logs requests — including IP addresses — to serve pages and to absorb attacks. Keeping the site up and reachable is my legitimate interest in doing it. I use those logs for nothing else, and I don’t combine them with anything above.
What you can ask for
You can ask me for a copy of what I hold about you, to correct it, to delete it, to restrict what I do with it, to object to it entirely, or to have it handed over in a portable form so you can take it elsewhere. Mail [email protected] and I’ll handle it myself — there’s no form and no ticket queue.
If you think I’ve handled your data badly and I haven’t put it right, you can complain to the Swedish authority, IMY.
Changes
If what happens to your data changes, this page changes with it.
Last updated 6 October 2026.