Who is responsible

Quince AI is the data controller.
Organisationsnummer 559481-4799
Övre Hallegatan 50, 417 09 Göteborg, Västra Götaland, Sweden
info@quince-ai.com

What we collect, and only when you send it

We collect nothing about you until you choose to send it. There are exactly two places on this site where that happens.

The contact form

When you submit the form on the contact page we receive your name, email address, message, and the page you came from. That last field tells us which part of the site prompted you to write; it is a path like /services.html, never an identifier for you.

The submission is sent to a serverless function we operate, which stores it in our lead database and notifies us by email. If that function is unreachable, the site offers to open a pre-filled draft in your own mail client instead — you choose whether to send it, and nothing is stored on our side unless you do.

The field-guide download

The gated download on Real Value vs. Hype asks for your email address, and optionally your name and company. It reaches the same lead database.

Why we are allowed to hold it

Both cases rest on Article 6(1)(b) GDPR — steps taken at your request before entering a contract — and, where you are writing on behalf of an organisation, our legitimate interest under Article 6(1)(f) in responding to a business enquiry. We do not use your details for automated decision-making or profiling, and we do not sell, rent, or share them for advertising.

How long we keep it

We keep an enquiry until we have replied and the conversation has run its course, and for a reasonable period afterwards in case you come back to it. If nothing comes of it, we delete it. You can ask us to delete it at any time and we will do so — deleting a lead is a one-click action in our own tooling, not a support ticket.

Where it is stored, and who else touches it

These are every third party involved in running this site. There are no others.

  • Supabase — hosts our database and the serverless functions that receive form submissions. Our project runs in the EU (Stockholm, eu-north-1) region. Access to the table is locked down: the public site cannot read it, and only signed-in team members can.
  • Resend — delivers the notification email that tells us a new enquiry has arrived. It processes the message you sent us in order to deliver it.
  • Google Analytics — measures how the site is used. It sets cookies and is the one item on this list that only runs with your permission inside the EU/EEA. See the analytics section below for exactly when it loads and how to turn it off.
  • Google Fonts — serves the three typefaces this site uses. Your browser requests them from Google's servers, which means Google receives your IP address when you load a page here. This is the one third-party request the site makes on every visit, and we are naming it rather than leaving you to find it in the network tab. We intend to self-host these fonts and remove the dependency.

Analytics

There are two separate things measuring traffic here, and they behave very differently. The first always runs and cannot identify you. The second only runs if you allow it.

Our own measurement — always on, no cookies

We count page views with our own first-party analytics. There are no cookies and no localStorage identifiers involved, and nothing in it can follow you to another site.

For each page view our server derives a hash that rotates every day from your IP address and browser user-agent, then stores only that hash. Neither your IP address nor your user-agent is ever written down. Because the hash changes daily, it cannot be used to follow you from one day to the next.

We also record a two-letter country code. This is resolved on our own server against a local lookup database — your IP address is not sent to any geolocation service. If the lookup finds nothing, we store nothing.

Raw events are deleted after 90 days. Only aggregate daily totals survive, and those contain nothing about any individual.

The beacon honours Global Privacy Control. If your browser sends that signal, we do not count you at all.

Optional analytics cookies — off unless you allow them

We also use a third-party analytics product to understand how the site is used. Unlike the above, it does set cookies in your browser and sends data to a provider outside the EU. Today that product is Google Analytics. We name it rather than writing "our partners"; if we add or replace tools, this list changes with them.

Inside the EU and EEA it does not load at all unless you press Accept on the banner. Press Decline and it is never loaded.

Outside the EU and EEA it loads by default, because the consent requirement is a European one. We would rather say that plainly than let you assume otherwise — if you are reading this from outside Europe and would prefer it off, use the button below.

Your choice is remembered in your browser's own local storage, not in a cookie, and it is never sent to us.

Your rights

Under GDPR you may ask us for a copy of what we hold about you, correct it, delete it, restrict or object to how we use it, or receive it in a portable format. Write to info@quince-ai.com and we will respond within one month.

If you think we have handled your data badly, you can complain to the Swedish authority, Integritetsskyddsmyndigheten (IMY) — imy.se.

Changes

If we change how any of this works, we change this page in the same commit. It is version-controlled alongside the site itself.

Last updated .