Press On Negler

We collect as little as we can. Our analytics is anonymous and runs without cookies, and the only personal data we store about you is your e-mail address, and only if you sign up for the newsletter yourself. We do not sell data and we do not build advertising profiles.

Who the controller is

press-on-negler.com is run by X Beauty AB, the company that also runs the shop xnails.no. X Beauty AB is the data controller for the personal data processed through this site, and decides why and how it is processed.

You can reach us at hei@press-on-negler.com. Put the word privacy in the subject line and it gets to the right person faster.

What we collect

The newsletter

If you sign up for the newsletter, we store four things:

the e-mail address you give us
the language you were reading in, Norwegian or English, so the e-mail arrives in the right one
where on the site you signed up, for example the footer or a particular article. It tells us what people actually want to read more about.
a salted hash of your IP address. A hash is a one-way calculation: it cannot be turned back into an IP address. We use it only to stop automated abuse of the signup form.

We never store your IP address in clear text anywhere.

Anonymous analytics

We count page views ourselves, without cookies and without an analytics vendor such as Google Analytics. For each event we store:

which path on the site was opened
the host you came from, meaning the domain name of the referrer, not the full address
UTM tags in the link if it had any, so we can see which campaigns work
a coarse country from the CDN. We see Norway, not a city and not an address.
a device class, meaning phone, tablet or computer
a random, anonymous id kept in your browser local storage, so that two page views in the same browser can be counted as one visit

That random id is not linked to a name, an e-mail address or an IP address, and it does not follow you to other websites. Clear your browser data and it is gone, and you are counted as a new visitor next time.

What we do not collect

No name, address, phone number or date of birth.
No IP address in clear text.
No advertising profiles and no segmentation for advertising.
No cross-site tracking, no social media pixels and no tracking cookies.
We never sell personal data, and we do not share it with ad networks or data brokers.

Legal bases

We process personal data under the General Data Protection Regulation (GDPR).

The newsletter rests on consent, GDPR Article 6(1)(a). You give consent by signing up, and you can withdraw it at any time. Every e-mail carries an unsubscribe link, and leaving should be as easy as joining.
The anonymous statistics rest on legitimate interest, GDPR Article 6(1)(f). The interest is knowing which articles are actually read, so we can write better ones. Because the measurement is anonymous, cookieless and never used to profile anyone, we consider the impact on your privacy to be small.
The hash of your IP address at signup also rests on legitimate interest: keeping the form from filling up with fake sign-ups.

How long we keep it

The e-mail address on the newsletter list: until you unsubscribe, at which point it is deleted from the list.
The hash of the IP address: 12 months after signup, then deleted.
Analytics events: up to 24 months. After that we keep only aggregate numbers that cannot be tied to a single browser.

Who processes data on our behalf

We use two subprocessors. Both are data processors, and we have a data processing agreement with each of them.

Vercel hosts the site and serves the pages through its content delivery network.
Supabase hosts the database that holds the newsletter list and the analytics events.

Neither of them is allowed to use the data for their own purposes.

Transfers outside the EEA

We choose European regions at our providers wherever that is possible. Processing outside the EEA can still happen, for example during operations and support. When it does, the transfer relies on the European Commission standard contractual clauses (SCCs) or on a valid adequacy decision.

Your rights

Under the GDPR you have the right to

access the data we hold about you
have inaccurate data corrected
have data erased
ask us to restrict processing
receive your data in a machine-readable format, meaning data portability
object to processing based on legitimate interest
withdraw a consent you have given. That does not affect the lawfulness of processing that happened before you withdrew it.

Write to hei@press-on-negler.com and we will answer as quickly as we can, and within one month at the latest. Because we do not store names, we have to ask you to write from the e-mail address the request concerns. It is the only way we can find you on the list.

Complaining to the Norwegian Data Protection Authority

If you believe we are handling data about you in breach of the rules, you can complain to Datatilsynet, the Norwegian Data Protection Authority. We would appreciate hearing from you first so we can put it right, but you are not obliged to come to us.

Changes to this policy

If we change anything here, we update the date at the top of the page. If the change is significant, we say so in the newsletter rather than hoping you notice on your own.