Xits

Privacy

Privacy notice

This site has no accounts, no analytics and no advertising. We handle personal data only when you write to us and when your browser loads the site. Last updated 8 November 2026.

Who is responsible

Enformica AB, which runs this site under the name Xits, is the controller for the personal data described here. Organisation number 559077-3528, registered in Stockholm. For any privacy question or request, write to [email protected]. We have not appointed a data protection officer.

What we collect and why

When you use the contact form

  • Data: your name, e-mail address and the message you write.
  • Purpose: to read your message and reply to you.
  • Legal basis: our legitimate interest in answering enquiries about Xits (Article 6(1)(f) GDPR), or, if you ask us for something ahead of a possible agreement, taking steps at your request (Article 6(1)(b)).
  • How long: we keep an enquiry in our Gmail mailbox for as long as it is needed to deal with it and any follow-up, and we delete it whenever you ask us to.
  • You do not have to use the form. You can e-mail us instead, and the same rules apply to that e-mail.

The bot check on the form

  • Data: when the form loads and when you send it, Cloudflare Turnstile receives your IP address, TLS fingerprint and browser (user-agent) details, together with our site key and the address of this site. Cloudflare says Turnstile does not read what you type into the form.
  • Purpose: to tell people from automated bots and stop spam and abuse. Nothing is sent from the form without this check.
  • Legal basis: our legitimate interest in keeping the site and form secure (Article 6(1)(f)).
  • Cloudflare’s role: Cloudflare acts for us for this purpose. It also uses these signals as an independent controller to improve Turnstile’s bot detection, on its own legitimate interest. See theTurnstile privacy addendum.
  • Automated decision: Turnstile automatically judges whether a request looks automated. If it wrongly blocks you, e-mail us instead. It has no other effect on you.

Loading the site

  • Data: like any website, our host, Cloudflare, processes technical request data such as your IP address and browser details to deliver the pages and protect the service.
  • Purpose and basis: delivering and securing the site; legitimate interest (Article 6(1)(f)).

Demo videos

  • Data: the demo videos and their preview images are served from Google Cloud Storage, so your IP address and browser details reach Google when they load.
  • Purpose and basis: showing you the videos; legitimate interest (Article 6(1)(f)).

Cookies and similar technologies

We set no cookies and use no local or session storage of our own. We have no analytics, advertising or social-media tracking, and the fonts are served from this site, not from a font service.

Cloudflare may set strictly necessary security cookies in connection with its bot protection. Itscookie policy lists names such as_cf_bm and cf_clearance. These exist to detect and block bots, cannot be switched off in Cloudflare’s products, and do not need your consent. If we ever add anything that does need consent, we will ask first and update this notice before we use it.

Who receives your data

  • Cloudflare (hosting and the bot check), acting for us under itsdata processing addendum.
  • Resend (e-mail delivery of your form message to us), acting for us under a data processing addendum. Resend keeps e-mail and log data for 30 days, and may scan a sample of messages for spam and phishing.
  • Google Cloud (video hosting), acting for us.
  • Google (Gmail), where the message is stored in our mailbox, and the people at Xits who answer enquiries.

We do not sell personal data and do not share it with anyone else for their own purposes.

Transfers outside the EU/EEA

Resend stores data in the United States, and Cloudflare and Google may process data there too. Where data leaves the EU/EEA we rely on the EU–US Data Privacy Framework, under which Cloudflare and Resend are certified, and on the EU standard contractual clauses in their agreements with us. You can ask us for details.

Your rights

You can ask us for access to your personal data, correction, erasure, restriction of its use, or a copy in a portable format. You can object at any time to processing we base on legitimate interest. Write to[email protected] and we will answer within one month. Where your request involves data held by Cloudflare or Resend, we will pass it on or direct you to them.

You can complain to the Swedish supervisory authority, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), or to the authority in your own country. We would appreciate the chance to put things right first.

Changes

We update this notice when the site changes how it handles personal data, and change the date at the top.