Privacy Policy

Last update October 3, 2026

This policy explains what personal data is processed when you visit marvellunatics.com, why, on what legal basis, who receives it, how long it is kept and what rights you have.

Who is responsible for your data

The controller for the processing described in this policy is:

Marvel Lunatics 4-ever
Warfvinges väg 31
112 51 Stockholm, Sweden
Email: hello@marvellunatics.com

We have not appointed a data protection officer. Please send any privacy question or request to the email address above.

Summary

What	Why	Legal basis	Kept for
Technical data when you visit (IP address, page, browser, time)	To deliver the website and keep it secure	Legitimate interest (Art. 6(1)(f) GDPR)	See “Visiting the website”
Contact form (name, email, message)	To read and answer your message	Legitimate interest (Art. 6(1)(f) GDPR)	See “Contact form”
Your privacy choice (stored in your browser)	To remember your choice	Necessary to provide the service you asked for	Until you change it or clear your browser storage
Visitor statistics with Pikatra (only if you click “Allow statistics”)	To understand how the website is used	Consent (Art. 6(1)(a) GDPR)	See “Analytics”
YouTube videos (only if you click play)	To show the video you asked for	Consent (Art. 6(1)(a) GDPR)	Decided by Google, see “Embedded YouTube videos”

About the website

Read more about us and the website here.

Visiting the website (hosting)

The website is hosted by Vercel Inc. (USA) on our Pro plan. When you visit a page, your browser sends your IP address, the address of the page, your browser type (user agent) and the time of the request. Vercel processes this to deliver the page and to protect the service against abuse. Our legitimate interest is to run a secure and working website. Vercel acts as our data processor and keeps these logs only for a short period, as described in Vercel’s privacy notice. Vercel Inc. is certified under the EU–U.S. Data Privacy Framework, which the European Commission has found to give an adequate level of protection.

The fonts, images and scripts that make up the website are served from our own domain. Pages do not load any advertising or tracking from third parties.

Contact form

When you send a message through the contact form, we receive the name, email address and message you enter. We use them only to read and answer your message and to follow up on the conversation. Our legitimate interest is to be able to communicate with readers who contact us. Giving these details is voluntary, but without an email address we cannot reply.

The form is delivered to us by email through Web3Forms (Web3Creative, India), which acts as our data processor. Web3Forms stores submissions on its infrastructure (Amazon Web Services, Cloudflare and Hetzner) and sends your IP address and email address to the spam-filtering services CleanTalk and Akismet, which may process data in the USA. Transfers outside the EU/EEA are covered by the EU Standard Contractual Clauses in Web3Forms’ Data Processing Agreement. Web3Forms deletes submissions automatically after at most three years.

We keep messages in our mailbox for as long as we need them to answer and follow up on your message, and delete them at the latest 12 months after the conversation has ended, unless we need them longer to handle a legal claim.

Cookies and similar technologies

Under the Swedish Electronic Communications Act (2022:482), Chapter 9, Section 28, and Article 5(3) of the EU ePrivacy Directive (2002/58/EC), information may only be stored in or read from your device if you agree to it, unless it is strictly necessary for a service you have asked for.

This website does not set any cookies. The only thing we store in your browser is your answer in the privacy banner, so that we do not have to ask again on every page. It is kept in your browser’s local storage until you change your choice or clear your browser data.

Name	Purpose	Duration
`ml-cookie-consent`	Local storage that remembers your choice in the privacy banner	Until you change your choice or clear your browser data

Pikatra, which we use for visitor statistics, does not store anything on your device.

If you click play on an embedded YouTube video, Google (YouTube) may store cookies or similar data on your device. See “Embedded YouTube videos” below.

You can change or withdraw your choice at any time by clicking “Privacy settings” at the bottom of every page. Withdrawing consent does not affect processing that took place before you withdrew it.

Analytics

If you click “Allow statistics” in the privacy banner, the website uses Pikatra to collect visitor statistics: how many people visit the blog, which pages they view, which website they came from, the country they visit from, the type of device and the browser they use, and how long they stay on a page. We use the statistics to improve the website. If you click “Decline”, Pikatra is not loaded at all. Pikatra is never loaded on the search page, so your search terms are not included.

Pikatra does not use cookies or any other storage on your device. Your IP address and browser information are processed only for a moment to determine your country, device type and browser, and to calculate a short visitor ID. The visitor ID is a one-way hash (SHA-256) of your browser information and a shortened version of your IP address. It is used only to count unique visitors and is stored together with the date, not with the pages you viewed. Because the same browser and network give the same ID, it is a pseudonymised identifier and therefore personal data. We do not use it, and could not use it, to find out who you are.

The statistics are stored as daily totals (for example “the page /about/ had 42 views on October 3”). They do not show which pages a particular visitor has viewed, in which order or when.

Legal basis: your consent (Art. 6(1)(a) GDPR).
Data processor: Pikatra, provided by Bombus Interactive, Sweden.
Where the data is stored: on servers in Stockholm, Sweden, operated by Akamai Connected Cloud (Akamai Technologies, Inc., which is certified under the EU–U.S. Data Privacy Framework).
Country lookup outside the EU: to determine your country, your IP address, and nothing else, is sent to IP2Location.io (Hexasoft Development Sdn. Bhd., Malaysia) at most once every 30 days. No page addresses, browser information or other details are sent. Pikatra keeps the result for up to 30 days together with a hash of the IP address, not the IP address itself. According to IP2Location’s privacy policy, IP2Location keeps the IP addresses it is asked about for two years to prevent abuse of its service. Malaysia is outside the EU/EEA and has no EU adequacy decision. IP2Location has appointed VeraSafe as its representative in the EU (Art. 27 GDPR). This transfer is part of the statistics you agree to in the privacy banner. If you decline, your IP address is not sent to IP2Location.
Retention: IP addresses and full browser information are not stored in the statistics. Pikatra’s web server logs, which contain IP addresses, are deleted automatically after 14 days. The daily statistics and visitor IDs are kept for as long as we use Pikatra and are deleted at the latest 30 days after we stop using the service.
The data is never sold and is not used for advertising or profiling.

Embedded YouTube videos

Some articles contain YouTube videos. A video is not loaded until you click play. When you do, your browser connects to Google (YouTube), which receives your IP address and the address of our page and may store cookies or similar data on your device. We use YouTube’s privacy-enhanced mode (youtube-nocookie.com), which according to Google means that your viewing is not used to personalise your YouTube experience or the ads you see. Google processes this data as an independent controller under its own privacy policy. Google LLC is certified under the EU–U.S. Data Privacy Framework.

The share buttons under each article are plain links. Nothing is sent to a social network unless you click one of the buttons. You then leave our website, and the social network’s own privacy policy applies.

Who receives your data

Vercel Inc. (USA): hosting. Data processor. EU–U.S. Data Privacy Framework.
Web3Forms / Web3Creative (India) and its sub-processors Amazon Web Services, Cloudflare, Hetzner, CleanTalk and Akismet: contact form. Data processor. EU Standard Contractual Clauses.
Our email provider: stores the messages you send us. Data processor.
Pikatra / Bombus Interactive (Sweden), with its sub-processors Akamai Connected Cloud (servers in Stockholm) and IP2Location.io (Malaysia, country lookup only): visitor statistics, only with your consent. Data processor.
Google (YouTube, only when you play a video): independent controller. EU–U.S. Data Privacy Framework.

We do not sell your personal data and we do not use it for advertising. We may disclose data to authorities if the law requires it.

Automated decisions

We do not make decisions about you based solely on automated processing, and we do not profile you.

Your rights

Under the GDPR you have the right to:

access the personal data we hold about you and get a copy;
have incorrect data corrected;
have your data erased, for example when we no longer need it or if you withdraw your consent;
restrict our processing in certain cases;
object to processing based on our legitimate interests;
data portability: receive data you have given us, in a machine-readable format;
withdraw your consent at any time, as described under “Cookies and similar technologies”.

To use your rights, email hello@marvellunatics.com. We answer within one month. Because the visitor statistics are stored as daily totals and a hashed visitor ID, we cannot normally find the statistics that relate to a particular visitor (Art. 11 GDPR).

Right to complain

If you think we process your personal data incorrectly, please contact us first. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, Sweden, imy@imy.se, www.imy.se, or with the supervisory authority in the EU/EEA country where you live or work.

Children

The website is not aimed at children. If you are under 13, please ask a parent or guardian before using the contact form.

Security and data breaches

The website is a static site without user accounts or logins, and all traffic is encrypted (HTTPS). If a personal data breach occurs, we will report it to IMY within 72 hours where required (Art. 33 GDPR) and inform you without undue delay if the breach is likely to result in a high risk to you (Art. 34 GDPR).