Privacy policy

1. Who is responsible

The controller for the personal data described here is Rickard Winbergh (sole trader, Sweden), trading as Winbergh Media, registration number [To be confirmed: registration number], Källmyrvägen 44, 821 95 Bollnäs, Sweden. Xperimore is a product of Winbergh Media.

For questions about privacy or to exercise your rights, contact us at privacy@xperimore.com.

2. What this policy covers

• Visits to our website, xperimore.com.
• Requests for early access submitted through the website.
• Accounts and organizations in the Xperimore platform.
• Business prospecting, where we look at publicly available information about organizations that may benefit from Xperimore.

3. Personal data we process

Website visits

Our website does not use analytics, advertising or tracking tools, and it does not set cookies. Fonts and images are served from our own domain, so visiting the site does not send your data to third parties such as font or analytics services.

Like any website, the servers that deliver it process technical data such as IP address, browser type and the pages requested, so the site can be delivered and protected against abuse. This is done by our hosting provider, [To be confirmed: hosting provider]. Legal basis: our legitimate interest in operating a secure website (Article 6(1)(f) GDPR).

Early access requests

When you request early access, we store:

• your name, company name and email address;
• the time you gave your consent and the version of this policy that applied;
• a pseudonymous identifier derived from your IP address with a secret key (a keyed hash). It is used only to limit repeated submissions and protect the form against abuse; your IP address itself is not stored with your request.

We use these details only to respond to your request and contact you about early access. We do not add you to a newsletter and we do not send automated marketing emails. Legal basis: our legitimate interest in handling your request for early access (Article 6(1)(f) GDPR). You can object or ask us to delete your request at any time by contacting us.

Retention: at most 12 months from submission, unless you ask us to delete your request earlier or a separate legal basis requires us to keep it longer.

Platform accounts

If you or your organization use the Xperimore platform, we process:

• account details: email address, name (optional), language preference and sign-in information;
• your organization memberships and roles;
• the domains your organization registers, the DNS verification of those domains, and the assessment results for verified domains that your organization has authorized for monitoring;
• status changes and comments on findings, and a log of important administrative actions, including who performed them.

Legal basis: performance of our agreement with you or your organization (Article 6(1)(b) GDPR), and our legitimate interest in keeping the service secure and accountable (Article 6(1)(f) GDPR) for logs of administrative actions.

Business prospecting

To find organizations that may benefit from Xperimore, we review information about organizations from public sources: company names, domains, stated industry, and technical information that is already publicly visible on the internet, such as DNS records, certificate transparency logs, domain registration (RDAP) data and, where available, internet-wide index data from data providers. This collection is passive: we do not scan, test or access organizations’ systems.

Where this involves a business contact person (for example a name or a business email address), the legal basis is our legitimate interest in business-to-business marketing (Article 6(1)(f) GDPR). We do not send automated or bulk marketing; any contact is made manually and only after internal approval. We keep a suppression list so that people and organizations who object are not contacted. You can object at any time by contacting us.

Data providers used for prospecting: [To be confirmed: list of data providers in use]. Retention: [To be confirmed: retention period for prospecting data].

4. Who we share data with

We do not sell personal data. We use the following service providers, who process data on our behalf:

• Supabase — database and authentication for the platform and early access requests. Data location: [To be confirmed: database region].
• Hosting of the website and application: [To be confirmed: hosting provider].

Data processing agreements and the location of processing for each provider: [To be confirmed: confirmation of data processing agreements and any transfers outside the EU/EEA, with the safeguards used].

We may also disclose data where required by law.

5. Security

Data is transmitted over encrypted connections. Access within the platform is role-based, each organization’s data is isolated from other organizations at the database level, and important administrative actions are logged.

6. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict our processing;
• receive your data in a portable format, where processing is based on consent or contract;
• object to processing based on our legitimate interests, including business prospecting;
• withdraw your consent at any time.

To exercise your rights, contact privacy@xperimore.com. You also have the right to lodge a complaint with a supervisory authority: the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), or the authority in the EU/EEA country where you live or work.

7. Cookies

See our cookie policy.

8. Changes

We will update this policy when our processing changes and show the date of the latest update at the top of this page. Policy version: 2026-11-05.