Privacy policy
Frontness is a website platform operated by Life flow AB (org. no. available on request), Kristinebergsgatan 11A, 504 41 Borås, Sweden. This page explains what personal data we handle and why.
Two different roles
For your own account — your email address, sign-in and billing — we are the controller.
For the websites you host with us we are a processor. You decide what those sites contain and which forms they have; we store and serve it on your instruction. A data processing agreement is part of our terms.
Your account
We store your email address and the times you signed in. We do not store a password: you sign in with a one-time code sent to your email. Billing details are handled by Stripe and never reach our servers.
Website content
Whatever you or your agent writes into a site is stored as files, together with earlier versions so a change can be undone. We do not inspect it.
Form submissions
If a site you host uses a form, what a visitor submits is stored so that nothing is lost if delivery fails.
| We store | We do not store |
|---|---|
| the fields the visitor filled in | the raw IP address |
| a salted hash of the IP, for rate limiting | the full user-agent string |
| country, two letters | any cookie or visitor identifier |
| device class: mobile, desktop or tablet |
Submissions are deleted after the retention period the site owner chose — 90 days by default, and immediately after delivery if they set it to zero. Deletion runs both when new submissions arrive and as a daily job, so a dormant site is emptied too.
Visitor statistics
We count page views at the edge. No cookie, no IP address, no visitor identifier, no tracking script. What we keep is the path, the referring domain, a country, a device class and a timestamp — nothing that identifies a person.
This is why hosted sites need no consent banner for our measurement, and also why there are no unique visitors or session lengths: both would require recognising someone between two requests, which is exactly what we avoid.
Connected accounts
If you connect Google Search Console, we store the access tokens you granted, encrypted. They are deleted when you disconnect.
Sub-processors
| Who | What for | Where |
|---|---|---|
| Cloudflare | serving, file storage, measurement | EU (R2 with EU jurisdiction) |
| Vercel | the application | Stockholm |
| Supabase | database and sign-in | EU North |
| Twilio SendGrid | outgoing email | United States |
| Stripe | payments | United States / Ireland |
| Search Console, only if you connect it | United States |
SendGrid, Stripe and Google involve transfers outside the EU, under the transfer mechanisms those providers offer. Everything else stays in the EU. We will tell you before this list changes.
Your rights
You can ask for a copy of your data, have it corrected, or have it deleted. Deleting a site removes its files, versions and form submissions. Write to help@frontness.com and we will answer within 30 days.
If you think we handle your data wrongly you can complain to the Swedish Authority for Privacy Protection (IMY).