Privacy

This page explains what personal data edstrom.photo processes, why, and what you can do about it. Updated 28 October 2026.

Who is responsible

Edström Photo AB, Martin Edström’s company, decides how personal data on this site is used and is responsible for it (the “controller” under the EU General Data Protection Regulation, GDPR).

Edström Photo AB
Mäster Mikaels gata 10c
116 20 Stockholm, Sweden
martin@edstrom.photo

The short version

• The site sets no cookies, shows no advertising and never sells data.
• Visits are counted without cookies and without storing IP addresses. The figures show totals, never a person.
• If you use the contact form, your details are used only to reply to you.
• Fonts, YouTube videos and the 3D map are loaded from other companies, which receive your IP address.
• You can ask what we hold about you and have it deleted, at no cost.

Hosting

The site is hosted by Cloudflare. To deliver pages to you and protect the site from attacks, Cloudflare processes technical data, such as your IP address, browser type and the page you asked for. We keep no visitor logs ourselves.

Why (legal basis): our legitimate interest in running a secure, working website (GDPR Article 6(1)(f)).

Visit statistics

We want to know how many people visit the site, not who they are. Two tools count page views. Neither uses cookies, and neither stores your IP address.

• Counterscale, an open-source tool we run in our own Cloudflare account. For each page view it records the page, the referring website, any campaign tags in the link (such as utm_source), your country, and your browser and device type. Repeat views on the same day are told apart with a date that your browser sends back from its cache, so visits can be counted without identifying anyone. A sent contact form is counted as a view of the page /contact/sent, without any of the details you wrote.
• Cloudflare Web Analytics, which records the page (without anything after a ? in the address), the referring website, your country, your browser and device type, and how fast the page loaded.

Both show us totals and lists, never an individual visitor.

Why: our legitimate interest in understanding how the site is used, so that we can improve it (Article 6(1)(f)).

Contact form

When you send a message through the contact form, we receive your name, e-mail address and message, which we need to reply. The form delivers your message to martin@edstrom.photo through the e-mail service Resend. We never add you to a mailing list.

The form uses Cloudflare Turnstile to tell people from automated spam. It checks your IP address and technical details of your browser. Cloudflare uses these only to detect bots, never for advertising.

Why: to answer your message (our legitimate interest, Article 6(1)(f)), and, if you ask about working together, to prepare an agreement with you (Article 6(1)(b)). The spam check is our legitimate interest in keeping the inbox usable (Article 6(1)(f)).

Fonts

The site’s fonts are loaded from Google Fonts. Your browser fetches them from Google’s servers, so Google receives your IP address and browser details. Google Fonts sets no cookies. See the Google Fonts privacy FAQ.

Why: our legitimate interest in showing the site as designed (Article 6(1)(f)).

Embedded videos and the 3D map

Some project pages show YouTube videos. When you scroll to one, your browser loads YouTube’s player in its privacy-enhanced mode (youtube-nocookie.com). Google receives your IP address, and may store data in your browser once you play the video, as described in Google’s privacy policy.

The Kyrgyzstan cave project shows an interactive 3D map from kyrgyzcaves.edstrom.photo, built with IVAR Studios’ field.tours. It loads 3D terrain from Cesium ion (Cesium GS) and from Cloudflare, which receive your IP address. If you ask the map’s AI guide a question, by typing or speaking, the question is sent to field.tours to produce the answer.

Why: our legitimate interest in showing our work (Article 6(1)(f)).

Stored in your browser

If you switch between light and dark mode, or pick a language, your browser remembers the choice in its local storage. It stays on your device and is never sent to us. You can clear it in your browser settings.

Who else handles data

• Cloudflare hosts the site, protects it, runs the spam check and stores the visit statistics.
• Resend delivers contact-form messages to our inbox.
• Google (Google Workspace) runs our e-mail.

They process data only on our instructions, under their data processing terms, and may not use it for anything else. Google (for fonts and YouTube) and Cesium are responsible for their own processing when they serve content to your browser.

Cloudflare, Resend and Google are US companies. Where data leaves the EU/EEA, the transfer is protected by the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses.

We never sell personal data. We disclose it to authorities only when the law requires us to.

How long data is kept

• Messages you send us: as long as we need them to reply and follow up. For work we do together, as long as the Swedish Bookkeeping Act requires for invoices and agreements.
• Copies held by Resend after delivery: 30 days.
• Counterscale statistics: 90 days.
• Cloudflare Web Analytics: six months.

Your rights

Under the GDPR you have the right to:

• get a copy of the personal data we hold about you
• have incorrect data corrected
• have your data deleted
• have our use of your data restricted
• receive data you gave us in a machine-readable format
• object to our use of your data where we rely on our legitimate interest

To use any of these rights, e-mail martin@edstrom.photo. It costs nothing. We reply within one month, and may ask you to confirm your identity first.

If you are not happy with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se).