Privacy Policy

Last updated: November 6, 2026

Policy version: paneless-privacy-2026-11-06

Who we are

Paneless is a trading name of Niclas Anderström, a sole trader based in Sweden. Privacy contact: support@getpaneless.com.

1. Data controller

The controller is Niclas Anderström (trading as Paneless), Sweden. Privacy requests: support@getpaneless.com.

2. Personal data we process

• Account data: email address and authentication/session information. Authentication is handled by Supabase; Paneless does not store plaintext passwords.
• Test data: submitted website URLs, test configuration, screenshots and page observations of public pages, findings and generated reports.
• Purchase data: payment references, entitlements and accounting events. Card details are handled by Paddle, not Paneless.
• Technical data: operational logs and diagnostics needed to run and secure the service, and transactional email delivery data. Cloudflare Web Analytics measures website visits; operational funnel records measure free-test submissions, completion, upgrades and verified payments.

3. Cookies and storage

Paneless uses strictly necessary storage for sign-in sessions and to remember recent tests in your browser.

4. Purposes and legal bases

• Providing accounts, tests and reports — performance of a contract (GDPR Art. 6(1)(b)).
• Payments, bookkeeping and tax — legal obligation (Art. 6(1)(c)).
• Security, abuse prevention and service diagnostics — legitimate interests (Art. 6(1)(f)).

5. AI providers, hosting and subprocessors

• OpenAI — AI navigation, assessment and report generation; page text and screenshots are sent to its APIs.
• Supabase — authentication, database and file storage (Stockholm, eu-north-1).
• Railway — API hosting and test execution (Europe region).
• Scaleway — transactional email (Paris).
• Lovable and Cloudflare — website hosting and content delivery.
• Paddle — payment processing as Merchant of Record (Paddle privacy notice).

These are the providers currently configured to operate the service.

6. Retention and deletion

Raw research artifacts from paid tests expire after 90 days. Paid reports, including any embedded screenshots, have no automatic expiry and are retained until you request deletion. Free check reports expire seven days after completion. Operational free-funnel records are retained for 30 days, with upgrade attribution valid for seven days. Account and project deletion removes associated research content; payment and accounting records may be retained as required by law.

7. International transfers

Primary data storage is in the EU, but some providers (such as OpenAI and CDN providers) may process data outside the EU/EEA. We do not claim that all processing stays within the EU.

8. Your rights

Under the GDPR you may request access, rectification, erasure, restriction or portability of your data, object to processing based on legitimate interests, and withdraw consent where consent is the basis. Contact support@getpaneless.com for any privacy or erasure request, including data connected to guest reports.

9. Complaints

You can complain to the Swedish Authority for Privacy Protection (IMY).

10. Security and updates

We use access controls, encrypted connections, encrypted session material and account isolation to protect data. We hold no security certifications. We will update this policy when our processing changes and revise the date above.