Last updated: 17 September 2026. This policy replaces the version dated 1 July 2026.
This policy explains what Atmoz AB stores on your device when you visit atmoz.io, why, and how you control it.
It covers the public website only. Storage inside the Atmoz platform — your login session, interface preferences and integration authorisation flows — is functional only and is described in the data processing agreement with your organisation, not here. Our wider handling of personal data is described in the Privacy Policy.
What we store, and when
We use two categories of storage: strictly necessary, and analytics. We do not use advertising or marketing cookies, and we do not run a tag manager.
Nothing in the analytics category is stored or read until you consent to it. Analytics is not merely held back from sending data — the analytics code is not loaded into the page at all until you say yes. If you have not answered the banner, that counts as no.
Strictly necessary
Required for the site to work and to remember the cookie choice you made. This includes your consent record itself, and security protections such as cross-site request forgery tokens.
These are exempt from the consent requirement, so we do not ask for consent to them and they cannot be switched off. You can still block them in your browser, but parts of the site will stop working.
Analytics
Aggregate usage statistics — which pages are read, where people arrive from, where the experience breaks. We use this to improve the site.
Set only if you opt in. These commitments hold for as long as we use any analytics tool:
- Analytics data is not used for advertising. We do not run any advertising or marketing tag, pixel or tag manager on this site — not LinkedIn, Google Ads, Meta, or any other.
- It is not associated with accounts you hold elsewhere, and is not used to track you across devices or across other websites.
- We do not build personal profiles from it, and we do not reconstruct or model the behaviour of visitors who declined.
Cookies and storage we use
| Name | Set by | Category | Purpose | Retained |
|---|---|---|---|---|
__cf_bm | Cloudflare | Strictly necessary | Bot management — distinguishes automated traffic from real visitors so the site stays available. Set on the first request, before any script runs | 30 minutes |
__dpl | Our hosting platform | Strictly necessary | Marks which deployment of the site served your visit, so the pages and files you receive all come from the same version | 24 hours |
atmoz.consent.v1 | Atmoz (browser local storage, not a cookie) | Strictly necessary | Records which categories you accepted, when, and which version of this policy you were shown | Until you withdraw it, clear your browser storage, or the cookie-consent version changes. It has no expiry date of its own |
_ga | Google Analytics | Analytics — only if you consent | Distinguishes one visitor from another | 2 years |
_ga_G-ZYS0G9XGM5 | Google Analytics | Analytics — only if you consent | Keeps session state for our property | 2 years |
The first two are set by the services that host and protect the site, not by Atmoz's own code, and they are set whether or not you accept anything — that is what makes them strictly necessary rather than a choice we are offering you. The two _ga cookies are set only after you consent to analytics, and will not be present at all if you have not.
Your consent record is kept in local storage rather than a cookie. The practical difference is that it is never transmitted to us or to anyone else — it stays in your browser and is read only by the site itself.
The analytics tool we use, and how it is configured
We use Google Analytics 4, and nothing else. No second analytics tool, no advertising tag, no tag manager.
We have deliberately configured it to collect as little as possible:
| Setting | State |
|---|---|
| Event data retention | 2 months — Google's shortest available setting |
| User data retention | 2 months — Google's shortest available setting |
| Google Signals | Off. No linking of your activity to a signed-in Google account, no cross-device tracking, no sharing of data for advertising |
| User-provided data collection | Off. We send Google no email addresses or other customer identifiers, hashed or otherwise |
| Reporting identity | Observed. Reporting uses only observed identifiers; no modelled or inferred data |
IP addresses. Google Analytics 4 does not log or store end-user IP addresses. IP addresses are used transiently to derive an approximate location and are then discarded, and traffic from the EU is handled on EU-based infrastructure. This reflects Google's documented behaviour of the product rather than a setting we control.
The two-month retention above is the analytics retention period referred to in the Privacy Policy.
Changing your mind
You can change or withdraw your choice at any time using in the site footer. Withdrawing consent stops further analytics collection from that point; it does not by itself erase data already collected, which ages out on the two-month schedule above.
You can also clear or block storage in your browser's own settings, and delete anything already saved. Browsers accept cookies by default, so this is a change you have to make deliberately — your browser's help pages give the steps. Blocking strictly-necessary storage will stop parts of the site working, including our ability to remember that you declined.
The law we rely on
Storing information on your device, or reading information from it, is governed by the Swedish Electronic Communications Act (lag 2022:482, ch. 9 § 28), which implements Article 5(3) of the ePrivacy Directive.
- Strictly-necessary storage is exempt from the consent requirement under that Act. It does not rest on consent, and it does not need a separate justification to be set.
- Analytics storage requires your consent, which is why nothing in that category loads until you give it.
Where the data stored on your device is also personal data, what we then do with it is governed by the GDPR, and the legal bases are set out in the Privacy Policy.
Contact
Questions about this policy, or about cookies on our site:
Atmoz AB, corporate registration number 559345-4001
Birger Jarlsgatan 57C, 113 56 Stockholm, Sweden
privacy@atmoz.io
You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se.
Changes to this policy
If we change which tools we use or what we store, we will update this policy and, where the change affects a category you have consented to, ask for your choice again.