Back

Privacy policy

Last updated: 29 July 2026

This policy describes how Bojakt ("we") processes your personal data when you use bojakt.se. We only collect what we need in order to run your alert — and we never sell your data on.

Data controller

Ketryon AB, company reg. no. 559551-1030, Gamla Tullgatan 1, 632 17 Eskilstuna, Sweden, is the data controller for the processing of your data. Bojakt is a service operated by Ketryon AB. Contact us at bojakt.se@gmail.com with any privacy questions.

What data we collect

  • Email address — to send you your alerts, and to email you a listing when you ask us to. If you ask us only to email a listing (without starting an alert), we do not store the address in our systems — it is used solely to send that one email.
  • Search criteria — the city/area, maximum rent and number of rooms you enter.
  • Phone number — only if you choose Premium with SMS alerts.
  • Alert history — which homes we have notified you about, so that we do not send the same listing twice.
  • Profile details — first name, surname, optional search preferences (move-in date, furnishing, household size) and your choice of whether to be visible to landlords (optional, see below). You enter this yourself under My account and can change or delete it at any time.
  • Landlord details — if you publish a rental listing with us, we process your name, phone number and email address, the details of the home (address, rent, description) and the photos you upload. See the section If you publish a listing below.
  • Marketing consent — if you tick the box to receive tips and news, we store your choice (along with when and where it was given). It is off by default and you can withdraw it at any time under My account.
  • Ad ID (if you arrived via an ad) — if you came to bojakt by clicking a Google ad, there is a click ID (gclid) in the web address. We store it together with your alert so that we can see which marketing works. It says nothing about who you are or what you have done on other websites, and we store nothing on your device for it — we only read the address you arrived on.

Without your consent we set no tracking cookies and load no analytics or advertising tools. If you choose "Accept" in the cookie banner, the tools listed under Cookies below are used — you can change or withdraw that choice at any time.

Why we process the data (legal basis)

  • Performance of the service (contract): matching homes against your criteria and sending you alerts.
  • Legitimate interests: operating, securing and improving the service.
  • Consent: if you choose to be visible to landlords (see below), and if you choose to receive optional newsletters, tips or marketing (off by default — we send those only to people who have actively ticked the box). You can always withdraw your consent.

Being visible to landlords (optional)

Under My account you can optionally choose to be visible to landlords. If you turn it on, your first name and your search criteria (city, rent, number of rooms, move-in date, furnishing and household size) are shown on our Find tenants page, so that landlords can find you and get in touch via bojakt. We never show your surname, your email address or your phone number, and all contact goes through us. It rests entirely on your consent: it is off by default and you can turn it off at any time, after which your profile is removed from the page.

If you publish a listing (landlord)

If you publish a rental listing with us, we process your name, phone number and email address as well as the details of the home and the photos you upload. We use this to review the listing by hand (to keep the market free of scam listings), publish it, match it against people watching that city, and to pass on contact. Once the listing is approved, the listing and your first name are shown publicly — your email address and phone number are never shown publicly. The photos are stored with Cloudflare (see below). We may refuse or remove a listing that breaches our terms. You can edit or delete your listing at any time under My account.

How long we keep the data

We keep your alert for as long as it is active. When you cancel it, we immediately delete your phone number, your maximum rent, your number of rooms and your ad ID. What remains is your email address and which city the alert covered — we keep those as a suppression list, so that we cannot accidentally email you again when new homes appear. If you want that deleted too, email us and we will do it. Your profile (name and your visibility choice) is kept until you delete the details or ask us to erase them. Alert history — which homes we have emailed you about — is kept for no more than 12 months and is then cleared automatically every night; it exists only so that we do not send you the same home twice. Published listings and their photos are kept for as long as the listing is active; when you delete it, the listing is unpublished and the photos are deleted.

We also keep statistics on when alerts are created, paused and cancelled, in order to understand how the service is used. They contain no email address and no id — only the city, whether the alert was free or Premium, and how many days it was active. Once you have deleted your alert there is therefore nothing left that links the statistics to you. They are kept for no more than 12 months. We never use them to send you anything.

Who we share data with

We share data only with the providers (data processors) required to run the service:

  • Neon — database (stored within the EU, Frankfurt).
  • Resend — sending email.
  • 46elks — sending SMS (Premium), Sweden.
  • Vercel and Fly.io — hosting of the website and the background service respectively.
  • Cloudflare — storage and delivery of listing photos (including photos you upload as a landlord).
  • Stripe — payment processing for Premium.
  • Google Analytics — anonymous visitor statistics, only with your consent (see the Cookies section).
  • Microsoft Clarity — anonymised usage analytics (session recording and heatmaps), only with your consent (see the Cookies section). Microsoft Ireland Operations is an independent data controller for that data — that is, not our data processor — and processes it in accordance with Microsoft's privacy statement.

Some of these may process data outside the EU/EEA. Where that happens, the transfer is made with appropriate safeguards, for example the European Commission's standard contractual clauses.

If you have turned on Being visible to landlords, your first name and your search criteria are shown to landlords on the Find tenants page — never your surname or your contact details. That never happens without your consent, and you can withdraw it at any time.

How we protect your data

We use technical and organisational measures to protect your data. All traffic is encrypted (HTTPS/TLS). Logging in is done via one-time links by email — we store no passwords that could leak — and sessions are cryptographically signed. SMS verification codes are stored hashed. Access to the database is restricted and the data is stored with providers within the EU/EEA. No method is entirely without risk, but we work continuously to maintain a high level of protection.

Cookies

We use two kinds of cookies:

  • Necessary — required for the service to work and always used: bojakt_session (keeps you logged in to My account), bojakt_unlocked (remembers that you have confirmed you are a human, so that you do not have to do it for every listing) and bojakt_consent (remembers your cookie choice). These require no consent.
  • Statistics (Google Analytics) — anonymous visitor statistics that help us understand how the service is used and how our marketing performs. These cookies (including _ga) are set only if you click "Accept" in the cookie banner. If you decline, no statistics cookies are set (we use Google Consent Mode, where everything is off by default).
  • Usage analytics (Microsoft Clarity) — to see how the site is actually used and where it goes wrong, we record anonymised sessions (mouse movement, clicks, scrolling) and produce heatmaps. We do not record what you type — text you enter in forms, such as email, phone number and address, is masked automatically before anything leaves your browser, and we cannot see who you are. The tool is loaded only if you click "Accept" — if you decline, it is not loaded at all. Cookies: _clck, _clsk. Provider: Microsoft.
  • Marketing (Google Ads) — if you consent, we measure when an alert is created after you have clicked one of our ads, so that we can evaluate our marketing. To improve the accuracy of that measurement, your email address may then be sent to Google in encrypted (hashed) form (Google "enhanced conversions"). This happens only if you click "Accept" — if you decline, no such data is sent.

You can change or withdraw your choice at any time via the Cookie settings link in the footer. Google may process statistics data in the USA; the transfer is covered by the EU–US Data Privacy Framework.

Your rights

You have the right to access, rectify and erase your data, among other things. Read more and see how to exercise your rights on our Data protection & GDPR page.

Changes

We may update this policy. We will notify you of material changes by email or on the website.

Privacy policy — Bojakt