Privacy policy

• No accounts, no cookies, no tracking, no forms. The Website stores nothing on your device, runs no analytics, and has nothing to fill in.
• Nothing is collected on the Website itself. To reach us you email info@elmastudio.co from your own mail app. If you never email us, no personal data about you reaches us at all.
• One email means one email. No newsletter, no marketing list, nothing passed on, nothing sold. Deleted on request.
• Hosting request data. Like every website host, ours processes request data (such as your IP address) to serve the page and keep the site online. We do not enable or read any analytics on top of that.
• Our own apps are covered elsewhere. Tuloma and our other apps have their own privacy policies, published with their store listings.
• No data about children. The Website is written for adults and asks for nothing about a child.

Elma Studio AB is a Swedish limited liability company (aktiebolag), registered office c/o Tim Schulz, Rönngatan 6, 211 47 Malmö, Sweden, company registration number 559600-5354. We are the data controller for the processing described in this policy. Contact: info@elmastudio.co.

• We are established in Sweden, so we are not required to appoint a representative in the EU.
• We have not appointed a data protection officer. Our processing does not meet the thresholds in Article 37 GDPR, and the people who decide about your data can be reached directly at info@elmastudio.co.
• Sending us personal data is never required. You do not have to send us anything to use this Website.

• It sets no cookies, and it uses no other browser storage (no localStorage, no sessionStorage).
• It runs no analytics, advertising, tracking, or A/B testing of any kind.
• It embeds no third-party scripts, font services, or iframes. Its fonts and images are served from the Website itself.
• It has no form and no input field, so there is nothing to submit here.
• It does not ask for, target, or process any data about children.
• It does not sell, rent, or share personal data. There is nothing to sell.

Because the Website stores nothing on your device, there is no cookie banner here and nothing for you to consent to. If that ever changes, we will add a proper consent mechanism and update this policy before enabling anything.

There are only two categories, and this is all of it.

How it works in practice. The Website has no forms. A message to us is an ordinary email sent from your own mail app. We receive your address and whatever you wrote, and nothing else beyond what a normal email carries.

Who else is involved. The only parties that process anything are the service providers named above, acting on our instructions under their data processing terms. Incoming mail to info@elmastudio.co is received through Google Workspace, which processes those messages on our behalf as our email provider. Their own privacy documentation: cloudflare.com/privacypolicy, policies.google.com/privacy.

Nobody else. We do not sell personal data and we do not share it with advertisers, data brokers, or anyone for their own purposes. We do not use your data for automated decision-making or profiling, and we do not use anything you send us to train AI models.

• Correspondence: your email stays in our mailbox and is not copied anywhere else. We keep no marketing list and no contact database. It is deleted when you ask us to, as described below.
• Client engagements: if your email turns into work, the correspondence and contract documents stay for as long as the engagement and our legal obligations require. Where Swedish bookkeeping law applies to them, accounting records must be kept for seven years.
• Request data: held by the host, not by us, under the host’s own practices.
• You can end this at any time. Ask us to delete your email at info@elmastudio.co and we will, unless the law requires us to keep something. Since one email is the whole of it, deleting it usually takes one action.

Under the GDPR you may:

• ask what we process and why (access, Art. 15);
• have anything inaccurate corrected (rectification, Art. 16);
• have your data deleted (erasure, Art. 17);
• have processing restricted (Art. 18);
• object to processing we base on legitimate interests (Art. 21);
• receive the data you gave us in a machine-readable format (portability, Art. 20);
• not be subject to a decision based only on automated processing (Art. 22), which we do not do anyway.

Write to info@elmastudio.co and we will act within the time the law allows. Because we hold so little, most requests are satisfied immediately.

Complaints. You can complain to your local data protection authority, or to Sweden’s supervisory authority, Integritetsskyddsmyndigheten (IMY): imy.se. In the United Kingdom, the Information Commissioner’s Office (ico.org.uk) handles the same role.

Our providers are established in the EU or in the United States. Cloudflare and Google are certified under the EU–U.S. Data Privacy Framework, so transfers to them in the United States rely on the European Commission’s adequacy decision for that framework. As a fallback, and wherever personal data is otherwise processed outside the EU/EEA, the transfer is covered by the European Commission’s standard contractual clauses, together with the additional measures those providers have put in place. We do not ourselves transfer your data anywhere.

The Website is served over HTTPS. We collect as little as possible, so there is simply less to protect, and access to info@elmastudio.co is limited to the company’s two founders. No third party has access to anything you send us beyond the providers named in section 4.

If a personal data breach ever affected you, we would tell you and the supervisory authority as Articles 33 and 34 GDPR require.

The Website is a company site written for adults, and it is not directed to children. We do not knowingly collect personal information from children under 13, and we process no children’s data through the Website.

Our apps are different, and they are built differently: the Tuloma app requires no account, uses no tracking, and keeps a child’s progress on the device. Its own privacy policy is published with its store listing. If you believe a child has sent us personal data, write to info@elmastudio.co and we will delete it promptly.

We will update this policy when the Website changes, and we will update the date at the top when we do. For a material change, meaning anything beyond the hosting and email processing described above, we will say so on the Website before the change takes effect.

Elma Studio AB
c/o Tim Schulz
Rönngatan 6, 211 47 Malmö, Sweden
Org.nr: 559600-5354
info@elmastudio.co