bojakt
Back

Privacy policy

Last updated: 20 August 2026

This policy describes how Bojakt ("we") processes your personal data when you use bojakt.se. We only collect what we need in order to run your alert — and we never sell your data on.

Data controller

Ketryon AB, company reg. no. 559551-1030, Gamla Tullgatan 1, 632 22 Eskilstuna, Sweden, is the data controller for the processing of your data. Bojakt is a service operated by Ketryon AB. Contact us at bojakt.se@gmail.com with any privacy questions.

What data we collect

  • Email address — to send you your alerts, and to email you a listing when you ask us to. If you ask us only to email a listing (without starting an alert), we do not store the address in our systems — it is used solely to send that one email.
  • Search criteria — the city/area, maximum rent and number of rooms you enter.
  • Google sign-in — if you choose to sign in with Google we take only your email address, and only to know who you are. We do not request, receive or store your name, your profile picture or anything else from your Google account.
  • Saved homes — the listings you save with the heart, so they are still there under Saved the next time you sign in. You can remove them whenever you like.
  • Phone number — only if you choose Premium with SMS alerts.
  • Alert history — which homes we have notified you about, so that we do not send the same listing twice.
  • Profile details — first name, surname, optional search preferences (move-in date, furnishing, household size) and your choice of whether to be visible to landlords (optional, see below). You enter this yourself — when you start an alert, or later under My account — and can change or delete it at any time.
  • Income — you can optionally tell us what you take home after tax, how many adults live with you and how many children. We use it for one thing: working out which homes you would probably meet the landlord’s income requirement for, and showing that to you. It is never shown to a landlord, never part of an application, never used to score you and never passed on. It is entirely optional — the service works the same without it — and you remove it by clearing the field under My account.
  • Landlord details — if you publish a rental listing with us, we process your name, phone number and email address, the details of the home (address, rent, description) and the photos you upload. See the section If you publish a listing below.
  • Marketing consent — if you tick the box to receive tips, news and offers, we store your choice (along with when it was given, where it was given and the exact wording you ticked). It is off by default and you can withdraw it at any time under My account.
  • Homes you have opened — while you are signed in we store which listings you clicked through to, so that you can find your way back to them under My account. We keep one row per home (not one per click), and if you later mark that you applied for it we store that too. Only you see the list. We never share it, and we do not use it to decide what we email you. You can turn the feature off under My account — the history is then deleted immediately, not paused. Signed out, nothing is stored at all.
  • Ad ID (if you arrived via an ad) — if you came to bojakt by clicking a Google ad, there is a click ID (gclid) in the web address. We store it together with your alert so that we can see which marketing works. It says nothing about who you are or what you have done on other websites, and we store nothing on your device for it — we only read the address you arrived on.

Without your consent we set no tracking cookies and load no analytics or advertising tools. If you choose "Accept" in the cookie banner, the tools listed under Cookies below are used — you can change or withdraw that choice at any time.

Why we process the data (legal basis)

  • Performance of the service (contract): matching homes against your criteria and sending you alerts.
  • Legitimate interests: operating, securing and improving the service — and remembering which homes you have opened so that you can find your way back to them. You always have the right to object: turn the feature off under My account and the history is deleted.
  • Consent: if you choose to give us your income so we can show which homes you meet the income requirement for (withdraw by clearing the field, which deletes it), if you choose to be visible to landlords (see below), and if you choose to receive optional newsletters, tips or marketing (off by default — we send those only to people who have actively ticked the box). You can always withdraw your consent.

Being visible to landlords (optional)

When you start an alert, and at any time afterwards under My account, you can optionally choose to be visible to landlords. If you turn it on, your first name and your search criteria (city, rent, number of rooms, move-in date, furnishing and household size) are shown on our Find tenants page, so that landlords can find you and get in touch via bojakt. We never show your surname, your email address or your phone number, and all contact goes through us. It rests entirely on your consent: it is off by default and you can turn it off at any time, after which your profile is removed from the page.

If you publish a listing (landlord)

If you publish a rental listing with us, we process your name, phone number and email address as well as the details of the home and the photos you upload. We use this to review the listing by hand (to keep the market free of scam listings), publish it, match it against people watching that city, and to pass on contact. Once the listing is approved, the listing and your first name are shown publicly — your email address and phone number are never shown publicly. The photos are stored with Cloudflare (see below). We may refuse or remove a listing that breaches our terms. You can edit or delete your listing at any time under My account.

How long we keep the data

We keep your alert for as long as it is active. When you cancel it, we immediately delete your phone number, your maximum rent, your number of rooms and your ad ID. What remains is your email address and which city the alert covered — we keep those as a suppression list, so that we cannot accidentally email you again when new homes appear. If you want that deleted too, email us and we will do it. Your profile (name and your visibility choice) is kept until you delete the details or ask us to erase them. Alert history — which homes we have emailed you about — is kept for no more than 12 months and is then cleared automatically every night; it exists only so that we do not send you the same home twice. Published listings and their photos are kept for as long as the listing is active; when you delete it, the listing is unpublished and the photos are deleted.

We also keep statistics on when alerts are created, paused and cancelled, in order to understand how the service is used. They contain no email address and no id — only the city, whether the alert was free or Premium, and how many days it was active. Once you have deleted your alert there is therefore nothing left that links the statistics to you. They are kept for no more than 12 months. We never use them to send you anything.

Who we share data with

We share data only with the providers (data processors) required to run the service:

  • Neon — database (stored within the EU, Frankfurt).
  • Resend — sending email.
  • 46elks — sending SMS (Premium), Sweden.
  • Vercel and Fly.io — hosting of the website and the background service respectively.
  • Cloudflare — storage and delivery of listing photos (including photos you upload as a landlord).
  • OpenFreeMap — map imagery, only if you open the map in a listing feed. Your IP address is then sent to OpenFreeMap (Hungary, within the EU) so the map tiles can be delivered. OpenFreeMap is an independent data controller for that data and, per their policy, does not log IP addresses. The map sets no cookies and stores nothing on your device. See OpenFreeMap's privacy policy.
  • Slack — internal notifications to us when something happens in the service, e.g. a watch being created or someone signing in. The notification contains your email address. Slack Technologies (USA, part of Salesforce) is covered by the EU–US Data Privacy Framework and by standard contractual clauses. Messages are deleted at Slack within one year. See Slack's privacy policy.
  • Stripe — payment processing for Premium.
  • Google Analytics — anonymous visitor statistics, only with your consent (see the Cookies section).
  • Microsoft Clarity — anonymised usage analytics (session recording and heatmaps), only with your consent (see the Cookies section). Microsoft Ireland Operations is an independent data controller for that data — that is, not our data processor — and processes it in accordance with Microsoft's privacy statement.
  • Meta (Facebook and Instagram) — measurement of our advertising via the Meta Pixel, only with your consent (see the Cookies section). For the collection on this site and the transfer to Meta, Meta Platforms Ireland Ltd and we are joint controllers; Meta is solely responsible for its own subsequent processing of that data. You can contact us about your rights, but you can also approach Meta directly. Read more in Meta's privacy policy.
  • OpenAI (ChatGPT) — measurement of our advertising in ChatGPT via the OpenAI pixel, only with your consent (see the Cookies section). We send page views and the moments a watch is created or a Premium purchase completes — never your email address and never what you are searching for. OpenAI is the controller for its own subsequent processing. Read more in OpenAI's privacy policy.

Some of these may process data outside the EU/EEA. Where that happens, the transfer is made with appropriate safeguards, for example the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.

If you have turned on Being visible to landlords, your first name and your search criteria are shown to landlords on the Find tenants page — never your surname or your contact details. That never happens without your consent, and you can withdraw it at any time.

How we protect your data

We use technical and organisational measures to protect your data. All traffic is encrypted (HTTPS/TLS). Logging in is done via one-time links or with Google by email — we store no passwords that could leak — and sessions are cryptographically signed. SMS verification codes are stored hashed. Access to the database is restricted and the data is stored with providers within the EU/EEA. No method is entirely without risk, but we work continuously to maintain a high level of protection.

Cookies

We use four kinds of cookies:

  • Necessary — required for the service to work and always used: bojakt_session (keeps you logged in to My account) and bojakt_consent (remembers your cookie choice). These require no consent.
  • Statistics (Google Analytics) — anonymous visitor statistics that help us understand how the service is used and how our marketing performs. These cookies (including _ga) are set only if you click "Accept" in the cookie banner. If you decline, no statistics cookies are set (we use Google Consent Mode, where everything is off by default).
  • Usage analytics (Microsoft Clarity) — to see how the site is actually used and where it goes wrong, we record anonymised sessions (mouse movement, clicks, scrolling) and produce heatmaps. We do not record what you type — text you enter in forms, such as email, phone number and address, is masked automatically before anything leaves your browser, and we cannot see who you are. The tool is loaded only if you click "Accept" — if you decline, it is not loaded at all. Cookies: _clck, _clsk. Provider: Microsoft.
  • Flow statistics (our own, cookieless) — to see where the flow breaks down we record which types of page are visited and in what order (for example "a location page", "a home page"), plus a small number of named events such as an alert being created. No cookie is set and nothing is stored in your browser, so no consent is required — but we are telling you anyway. We store neither your IP address nor your browser signature: they are turned straight into a random code that is replaced every 24 hours, which means visits cannot be followed from one day to the next. Nothing you type is recorded, and addresses are reduced to a page type before they are stored. The data stays in our own database within the EU — no external provider.
  • Marketing (Google Ads, Meta and OpenAI) — if you consent, we measure when an alert is created, when you start a purchase (press the button that takes you to payment) and when a Premium purchase is completed after you have clicked one of our ads, so that we can evaluate our marketing. We only measure these events on our own site — we do not follow you to other websites. Google Ads: to improve the accuracy of that measurement, your email address may then be sent to Google in encrypted (hashed) form (Google "enhanced conversions"). Cookies: _gcl_*. The Meta Pixel (for our ads on Facebook and Instagram) measures the same events. Cookies: _fbp, a random identifier for your browser, and _fbc, which is set only if you arrived by clicking a Meta ad. We do not send your email address to Meta. The OpenAI pixel (for our ads in ChatGPT) measures the same events. Cookies: __oaiq_consent, __oaiq_domain_probe, __oppref and __obref. We do not send your email address to OpenAI. All of this happens only if you consent to marketing — if you decline, neither the Meta nor the OpenAI pixel is loaded at all and no such data is sent.

You can change or withdraw your choice at any time via the Cookie settings link in the footer; if you withdraw your consent we delete the cookies that were set, including _ga, _gcl_*, _fbp, _fbc and __oaiq*. Google, Meta and OpenAI may process the data in the USA; the transfer is made with appropriate safeguards, for Google and Meta through the EU–US Data Privacy Framework.

Your rights

You have the right to access, rectify and erase your data, among other things. Read more and see how to exercise your rights on our Data protection & GDPR page.

Changes

We may update this policy. We will notify you of material changes by email or on the website.