Privacy at SilverMoose

Who is responsible?

SilverMoose Handelsbolag, organisation number 969805-0870, Trädgården 8, 746 32 Bålsta, Sweden, is the controller for enquiries sent to SilverMoose, its business contacts, account administration and security. Contact [email protected] or +46 76 322 72 38 about your information.

When another business uses our booking service, that business controls its customer bookings. SilverMoose operates the service on its instructions under a data processing agreement. Contact the business you booked with about its customer records. We can help route your request. This notice does not replace that business’s own privacy information.

What we use and why

Enquiries and free concepts: we use your name, business name, email, phone number, message and any optional website links or attachments to answer you, prepare a concept and discuss the work. For a business representative, the basis is our legitimate interest in handling business enquiries (GDPR Article 6(1)(f)). When you personally would be the contracting party, such as a sole trader, it is steps at your request before a contract (Article 6(1)(b)). Sending an enquiry does not place an order.

Accounts and support: we use your name, email, business details, account role, sign-in information and correspondence to provide access, administer the service and resolve support cases. The basis is performance of a contract with you, or our legitimate interest in administering the relationship with the business you represent. Your business may supply your details when inviting you. Files are received only when you choose to submit them through an upload function.

Security: IP addresses, device/browser information, session and authentication records, and relevant activity records help us prevent misuse, investigate faults and protect accounts. This is our legitimate interest in keeping the service secure (Article 6(1)(f)).

Visitor statistics: on the public website we count visits without cookies. Your browser sends which page is shown, the website you came from, such as Google or Instagram, and the screen width. The server turns the IP address and browser details into a code using a random value that changes every day, so the same visitor is only counted once per day. The IP address is not stored, and the code and the random value are deleted after the day. We only keep daily totals: the number of visitors and page views, which pages were viewed, where visits came from and the type of device based on screen width. This is our legitimate interest in understanding how the website is used so that we can improve it (Article 6(1)(f)).

Administration: necessary order, invoice and payment records are processed to fulfil bookkeeping obligations (Article 6(1)(c)). We retain necessary agreement evidence and relevant correspondence to establish or defend claims, based on our legitimate interest (Article 6(1)(f)). We do not use a business’s customer list for our own marketing. These functions do not make solely automated decisions with legal or similarly significant effects.

What you need to provide

Fields marked as required are needed to create an account or handle the requested service. Without them, that function cannot be used. Optional fields and attachments can be left empty. Do not send health information, identity documents, passwords or other sensitive material in an ordinary enquiry. Account creation and submitting a request are not consent to marketing.

Providers and access

Authorised SilverMoose personnel handle enquiries and technical support. Hostup AB (559290-1325) provides hosting, databases, email and backups. Its current processing agreement covers EU hosting and email storage, Swedish backups, and relevant subcontractors. Outgoing mail can use Hostup’s relay or MailChannels in Canada. Cloudflare, Inc. provides website delivery and protection through its global network and processes traffic such as IP addresses and requests.

We use new Outlook for Windows to read and send email from our Hostup mailbox. This setup uses Microsoft’s cloud service to synchronise email, including message content, attachments and sender and recipient details. Microsoft therefore also processes this correspondence; it is not stored only at Hostup. Microsoft’s Services Agreement and Privacy Statement apply to this Outlook service. Your chosen email provider receives messages we send to you. Providers may process their own service-security records under their privacy terms. We disclose information to authorities or professional advisers where required by law or necessary for a specific legal matter. We do not sell personal information.

Processing outside the EU/EEA

Swedish hosting does not mean that every part of delivery takes place in Sweden. Cloudflare’s global processing can include the USA. Its processing terms provide for the EU–US Data Privacy Framework where applicable and EU standard contractual clauses. Hostup identifies Canada’s adequacy decision for MailChannels. Microsoft’s processing can also take place outside the EU/EEA, including in the USA. Its Privacy Statement describes use of the EU-US Data Privacy Framework for covered transfers and European Commission standard contractual clauses where applicable. We do not promise EU-only email storage. A transfer must be covered by an applicable adequacy decision or appropriate safeguards; a provider’s name alone is not a safeguard. Ask us for the safeguards relevant to your data and how to obtain a copy. Provider documents are linked below.

How long information is kept

Enquiries that do not become a customer relationship: contact details, messages and attachments are to be deleted no later than 12 months after the last contact. We review and remove mailbox messages and attachments manually. The same review covers copies used in Outlook.

Accounts: details are needed while the account provides access to an active service or an unresolved request. On closure, we review and remove information no longer needed. Necessary records for an unresolved support case, a specific legal claim or a statutory obligation are kept separately for that purpose until it ends. An ordinary account or complete customer database is not kept merely because an invoice must be retained.

Account portal security events: the scheduled cleanup removes records older than 90 days. Email queue records are removed after 7 days; accepted email payloads are cleared earlier. Expired sign-in and verification records are removed by the same cleanup. These periods concern our account portal, not every log held by a provider.

Our website access-log archive settings and providers’ own security retention are separate from account cleanup. Logs are retained only as needed for operation, security, investigating an incident or legal requirements. Contact us for details of the relevant record rather than assuming one deadline applies everywhere.

Booking records held for another business follow that business’s documented instructions. In the standard approved departure process, the designated owner has 30 days from the agreed service end time to retrieve operational booking data before scheduled deletion. The app confirms the exact deadlines. Separate legal evidence, email and backups are not erased by that booking deletion job.

Backups and downloaded copies

The account portal’s encrypted local snapshots rotate after 8 days. Hostup’s account assistant has reported 14 daily hosting backups for our account; this is a different backup layer, and copies of an older local snapshot can remain in a later hosting backup. Those periods must not be treated as a single guaranteed deletion deadline. Hostup’s published period after closing the whole hosting account is also different from deleting one business while hosting continues.

Email archives, downloaded exports and computer or USB copies need separate removal. Remaining recovery copies are restricted to recovery use; previous deletions must be reapplied before restored data is used again. Ask us for a confirmed final deletion date covering the copies relevant to your request.

Your rights

You can request access to your personal information, correction, deletion or restriction of processing. You can object to processing based on legitimate interests; we must then assess your objection. Where the conditions apply, you can receive information you supplied in a portable format. These rights have legal exceptions. If we rely on consent for a separate optional activity, you can withdraw it without affecting earlier lawful processing.

Email [email protected]. We may ask for proportionate information to verify your identity, but do not send an identity document unless requested through an appropriate channel. We normally respond within one month and explain any permitted extension. You may complain to the Swedish Authority for Privacy Protection (IMY), imy.se, or your local supervisory authority. You do not have to contact us first.

Cookies and device storage

The public website uses language and appearance preferences, not advertising or tracking cookies. Visitor statistics do not use cookies. Its language choice lasts for the tab session; the appearance choice remains until browser storage is cleared.

The account portal uses sm_account for a 24-hour sign-in, or 14 days if you choose that option; sm_language remembers language for up to one year. Optional sm_remember_email stores an encrypted email address in your browser for 30 days, not your password. Use “Forget saved email” on the login page to remove it. The owner's visitor statistics page stores sm_nostats for up to 400 days so that the owner's own visits are not counted.

The booking owner app stores sign-in information and cached app files on your device so it can work as an installed web app. Sign out on shared devices. Notifications require your device permission; you can switch them off. Device push delivery uses the provider chosen by your browser or operating system, such as Apple, Google, Mozilla or Microsoft. Notification content is encrypted in transit to the subscribing device, but delivery providers still handle technical routing information. This is not a claim that all stored booking data is encrypted.