Last updated: 28 September 2026
This policy explains what personal data IVAR Studios processes, why, and what you can do about it. It covers:
Apps and websites we build for clients and publish under the client’s name are covered by the client’s own privacy policy.
IVAR Studios AB (org. nr 559059-5392) decides how your data is used, and is responsible for it (the “controller” under the EU General Data Protection Regulation, GDPR).
IVAR Studios AB
Mäster Mikaels Gata 2 A
116 20 Stockholm, Sweden
[email protected]
Write to [email protected] with any question about privacy.
The website is hosted by Cloudflare. To deliver pages to you and protect the site from attacks, Cloudflare processes technical data, such as your IP address, browser type and the page you asked for. We do not keep visitor logs. In Cloudflare’s dashboard we see only totals, such as the number of visits per day, never individual visitors.
If your browser prefers Swedish, the start page sends you to the Swedish version. The site reads your browser’s language setting to do this, and stores nothing.
Why (legal basis): our legitimate interest in running a secure, working website (GDPR Article 6(1)(f)).
When you send a message through a form on the site, we receive your name, e-mail address and message. We need these to reply. If a form asks for anything else, such as your organisation or group size for a workshop, those fields are optional.
The form sends your message to our e-mail inbox through the e-mail service Resend. We never add you to a mailing list.
Why: to answer your message (our legitimate interest, Article 6(1)(f)). If you ask us about working together, we also use it to prepare an agreement with you (Article 6(1)(b)).
How long we keep it: see How long we keep data.
The contact form uses Cloudflare Turnstile to tell people from automated spam. It checks your IP address and technical details of your browser, such as its type and version. Cloudflare uses these only to detect bots and to improve that detection, never for advertising.
Why: our legitimate interest in keeping spam out of our inbox (Article 6(1)(f)).
The site’s fonts are stored on ivar.studio. Loading a page makes no request to Google or any other font service.
Some project pages show videos from YouTube or Vimeo. When you scroll to a video, your browser loads the player from YouTube or Vimeo. They receive your IP address, and may set cookies or store data in your browser, as described in their own policies (Google, Vimeo). We use the settings that limit this: YouTube’s privacy-enhanced mode (youtube-nocookie.com) and Vimeo’s “do not track” setting.
Why: our legitimate interest in showing our work (Article 6(1)(f)).
If you switch between light and dark mode, your browser remembers your choice (in its local storage). It stays on your device and is never sent to us. You can clear it in your browser settings.
We set no cookies of our own. YouTube and Vimeo may set cookies on pages with one of their videos (see above).
The site links to other websites, such as our partners and our social media pages. Their own privacy policies apply once you follow a link.
This section covers every app published by IVAR Studios, on any device.
Our apps:
Some apps save settings or progress on the device, for example your language choice. That data stays on the device. We cannot see it, and uninstalling the app deletes it.
On a VR headset you can use your hands instead of controllers. The headset’s own system software tracks your hands. While the app is running, it reads hand positions so your virtual hands can move and pick things up. It never stores or sends them.
Your device and the store you download an app from process data under their own privacy policies, for example to handle downloads and to give developers usage figures. From the stores we see only totals, such as the number of downloads, and nothing about you personally.
Our apps send us no personal data, so there is nothing about you on our side to delete. To delete what an app has saved on your device, uninstall it. If you believe we hold any data about you, e-mail [email protected] and we will delete it at no cost, wherever you live (see Your rights).
Our apps are made for education, including use in schools by students aged 13 and older. The website is not aimed at children. We do not knowingly collect personal data from anyone under 13. If you think a child has sent us personal data, for example through the contact form, contact us and we will delete it.
Schools and organisations that manage devices are responsible for the device accounts and settings they use.
We use a few service providers. They process data only on our instructions, under data processing agreements, and they may not use it for anything else.
| Provider | What they do for us | Where the data is |
|---|---|---|
| Cloudflare | Hosts the website, protects it from attacks, runs the spam protection | Cloudflare’s global network (US company) |
| Resend | Delivers form messages to our inbox | Sent from Ireland, stored in the US |
| Google (Google Workspace) | Our e-mail | Google’s data centres (US company) |
YouTube (Google) and Vimeo receive data when you open a page with one of their videos. The app stores process data as described above. Both are responsible for their own processing. They are not our service providers.
We never sell personal data. We disclose it to authorities only when the law requires us to.
Cloudflare, Resend and Google are US companies. Where your data leaves the EU/EEA, the transfer is protected by the EU–US Data Privacy Framework, which all three take part in, and by the European Commission’s standard contractual clauses in our agreements with them. You can ask us for more information on these safeguards.
| Data | How long |
|---|---|
| Messages you send us that do not lead to working together | Deleted 24 months after our last contact |
| Messages about work we do together | For as long as the collaboration and our legal obligations require, for example the Swedish Bookkeeping Act for invoices and agreements |
| Copies held by Resend after delivering a message | 30 days |
| Website technical data at Cloudflare | Short-term, for security, under Cloudflare’s policy. We keep none ourselves. |
| Data saved by an app on your device | Until you uninstall the app. We never receive it. |
The site is served only over encrypted connections (HTTPS). Only our own staff can read messages sent to us, and all our e-mail and service accounts use two-factor authentication.
Under the GDPR you have the right to:
Your right to object. Where we rely on our legitimate interests (see “Why” in each section), you have the right to object to that use of your data at any time, for reasons relating to your situation. We will then stop unless we have compelling legitimate grounds to continue, or need the data for a legal claim.
To use any of these rights, e-mail [email protected]. It costs nothing. We reply within one month, and may ask you to confirm your identity first. If we cannot do what you ask, for example because the law requires us to keep a record, we will tell you why.
We make no decisions about you by automated means, and we do not profile you.
If you are not happy with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se).
When we start processing data in a new way, for example when an app starts sending statistics, we update this policy first and change the date at the top. You can ask us for earlier versions.
IVAR Studios AB
Mäster Mikaels Gata 2 A
116 20 Stockholm, Sweden
[email protected]