Privacy Policy
Last updated: 10 September 2026
twenlo (the "Service", "we") is a website builder at twenlo.com / minsajt.se. The Service is operated by Jalma Hultsfred AB, Sweden (VAT-registered). Contact: jonas@jalma.se. This policy covers your account with us (twenlo.com / app.minsajt.se) — not the sites you build and publish yourself, see section 5.
1. What data we collect
When you create an account, we process:
- Your email address and, if you provide it, your name — to identify your account and sign you in (password or an email sign-in link).
- A password hash if you choose a password (we never store the password itself).
- The content you write on your sites — pages, text, images you upload, contact details you fill in for the site.
- Email addresses you invite as members on a site (the Members feature), and the role you give them (administrator/editor).
- If you choose a paid plan: your email is sent to Stripe (our payment processor) for billing. We then store a Stripe customer id tied to the site (not to you personally) and subscription status. We never see your card details.
- If you connect a custom domain: the domain name you enter, to link it to your site.
2. Why we process it
Solely to deliver the service you requested: create and run your account, publish your site, manage members you invite, handle billing if you upgrade, and connect a custom domain if you ask for one. The legal basis is contract (performing the service) and, for invite emails, your own active choice to invite that person.
3. How and where data is stored
- Data is stored in a database on our own server (Hetzner, EU), placed outside the public web root with restricted file permissions.
- All traffic between your browser and the Service uses encrypted HTTPS/TLS.
- Sign-in uses a session cookie (keeps you logged in) and, for email sign-in links, a one-time token that expires after 30 minutes or on use.
4. Sharing with third parties
We do not sell your data or share it for advertising. Data leaves the server only in these cases:
- Stripe — only if you upgrade a site: email and payment are handled by Stripe.
- Hetzner — our server provider, as a technical processor (hosts and runs the server for us).
- Email — sign-in links and invites are sent directly from our server (no third-party email service in between).
We run no third-party tracking (no GA/GTM/Hotjar/Facebook pixel) on twenlo.com, minsajt.se, or in the app itself. Our own usage stats for your account (views/unique visitors for your site) are computed from web server logs after the fact, without cookies aimed at individual visitors.
5. Sites you publish yourself — who's responsible for what
The content on the sites you build is yours. We store it for you as a processor — you are the controller for your published site's visitors, just as with any other website you run. If you enable Google Analytics on your own site by entering your own measurement ID, a cookie banner is shown to your visitors, and it's your responsibility to keep your site's own privacy information accurate if you do. Without a measurement ID, no visit data is sent to Google from your site.
6. Retention and deletion
There is currently no self-service button in the app to delete an account or a site. If you want your account, sites and all associated data deleted entirely — or want help exporting the content first — email jonas@jalma.se and we'll do it for you.
7. Your rights (GDPR)
You have the right to access, rectification, erasure, restriction and data portability under the GDPR. Contact jonas@jalma.se to exercise your rights. You may also lodge a complaint with the Swedish Authority for Privacy Protection (IMY).
8. Changes
We may update this policy. Material changes will be announced in the Service. The "Last updated" date above reflects the current version.