1Who we are
This Privacy Policy applies to Piik Labs AB, a company registered in Sweden with organisation number 559577-8506 (the “Company”, “we”, “us”, “our”).
We operate IndieHacked, the website at indiehacked.com (the “Website”), and its newsletter, Weekly Unpack (together, the “Services”).
For the personal data described in this Policy, Piik Labs AB is the data controller under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Swedish Data Protection Act (lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning).
1.1Scope: which product this policy covers
IndieHacked is a Piik Labs brand. Piik Labs AB operates other products and services under separate brands. This Privacy Policy applies only to IndieHacked and indiehacked.com. Other Piik Labs products are governed by their own separate privacy policies, and the processing described here does not extend to them.
1.2Contact
- Data controller
- Piik Labs AB
- Organisation number
- 559577-8506
- VAT number
- SE559577850601
- Registered address
- Box 691, 414 52 Göteborg, Sweden
- Privacy enquiries
- privacy@indiehacked.com
- Legal and compliance
- legal@indiehacked.com
- Supervisory authority
- Integritetsskyddsmyndigheten (IMY), imy.se · imy@imy.se
Data Protection Officer. We have not designated a Data Protection Officer under Article 37 GDPR, as we are not required to do so. All privacy matters are handled directly by the Company and should be directed to privacy@indiehacked.com.
2Scope of this policy
This Policy applies to all personal data we collect when you visit the Website, subscribe to Weekly Unpack, or contact us. It does not apply to third-party websites or services linked from the Services, including the products and companies we write about and our sponsors, which process your data under their own policies.
3Personal data we collect
We collect personal data in two ways: data you provide, and data generated automatically when you use the Services.
3.1Data you provide
Weekly Unpack
- Your email address
- When you subscribed and which signup form you used, and when you confirmed your subscription
- Your subscription status, and when and why it ends if it does: you unsubscribe, your address bounces, or you mark an issue as spam
Communications
- Messages you send us by email, including advertising and press enquiries
3.2Data collected automatically
- Newsletter activity: whether you open each issue of Weekly Unpack and which of its links you click, including links to a sponsor, with the time, your IP address and approximate location, and your email client, operating system and device type.
- Technical data: IP address, browser type and version, operating system, the pages you request and the time of each request.
- Service logs: our hosting provider records the requests the Services handle, including your IP address, to diagnose faults and investigate misuse.
- Security records: to limit signups, we keep a keyed one-way hash of your email address and of your IP address, never the address or the IP address itself. Our hosting provider also runs a bot check on each signup.
- Website visits: the pages you visit on indiehacked.com, the site that sent you, your approximate location and your browser and device type, to measure visits to the website.
4How and why we use your data
We only process your personal data where we have a valid legal basis under the GDPR. The table below sets out our processing purposes, the data involved, and the legal basis for each.
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Send you Weekly Unpack: the week's news, sponsored slots, new features on the Website and launches | Email address, subscription records | Art. 6(1)(a): consent |
| Measure the opens and link clicks of each issue, and report click totals to its sponsors | Newsletter activity | Art. 6(1)(a): consent |
| Confirm your subscription and keep a record of your consent | Email address, subscription records | Art. 6(1)(c): legal obligation |
| Honour your unsubscribe | Email address, subscription records | Art. 6(1)(f): legitimate interest |
| Protect the signup form from abuse and keep the Services secure | Technical data, service logs, security records | Art. 6(1)(f): legitimate interest |
| Measure visits to the website | Website visit statistics | Art. 6(1)(f): legitimate interest |
| Answer your emails, including advertising and press enquiries | Communications | Art. 6(1)(f): legitimate interest, or Art. 6(1)(b): steps you ask for before a contract |
| Establish, exercise or defend legal claims | Relevant data as required | Art. 6(1)(f): legitimate interest |
Your consent to Weekly Unpack covers each issue and the measurement of its opens and clicks. You can withdraw it at any time with the unsubscribe link in each issue.
Where we rely on legitimate interest, our interest is in running a secure website and newsletter, and in answering the people who write to us. You can object to it at any time (section 8).
5Third-party services and data sharing
We do not sell your personal data. We share data with the service providers below, who process it on our behalf, and where required by law. Sponsors receive totals for their placement, never your name or email address.
5.1Service providers (data processors)
Hosting and storage
- Vercel Inc. (USA): hosting of the Website, its firewall and bot check, and website visit statistics. Requests pass through Vercel's network, and the server functions that handle signups run in the EU (Frankfurt, Germany). Website visit statistics may be processed in the United States. Data processing agreement in place. Review: vercel.com/legal/privacy-policy
- Supabase Pte. Ltd. (Singapore): our database, which holds the Weekly Unpack subscriber list and the security records for signups. All data is stored in the EU (Frankfurt, Germany). Data processing agreement in place, including Standard Contractual Clauses. Review: supabase.com/privacy
Email and communications
- AC PM, LLC, trading as Postmark (USA): delivery of the confirmation email and of Weekly Unpack, its unsubscribe link and the list of addresses it no longer sends to, and the record of each issue's opens and link clicks. Data processing agreement in place, including Standard Contractual Clauses. Review: postmarkapp.com/eu-privacy
- Microsoft Ireland Operations Limited (Ireland): Microsoft 365, which hosts our mailboxes and therefore stores your message and our reply if you write to us. Under Microsoft's EU Data Boundary, this data is stored and processed within the EU and EFTA; limited transfers continue outside it for remote administration and global security operations, covered by the Standard Contractual Clauses in Microsoft's Data Protection Addendum. Review: microsoft.com/privacy
5.2Disclosure required by law
We may disclose your personal data to law enforcement, regulatory authorities, or courts where we are legally required to do so. We will notify you of any such disclosure where legally permitted.
5.3Business transfers
In the event of a merger, acquisition, or sale of all or part of our assets, your personal data may be transferred to the acquiring entity. We will notify subscribers by email before their data is transferred and becomes subject to a different privacy policy.
5.4Changes to our service providers
We may add, replace, or remove service providers over time. Where a change is material, for example where a new provider processes a new category of data or introduces a transfer outside the EEA, we will update this Policy and notify you in accordance with section 12.
6International data transfers
Piik Labs AB is based in Sweden, and our database and server functions are in the EU. Some of our service providers are established or process data outside the European Economic Area (EEA), including in the United States and Singapore.
When we transfer personal data outside the EEA, we ensure appropriate safeguards are in place, including:
- Standard Contractual Clauses approved by the European Commission;
- Transfers to countries covered by an EU adequacy decision, including certification under the EU-U.S. Data Privacy Framework where applicable;
- Supplementary technical and organisational measures where required.
You may request a copy of the applicable safeguards by contacting privacy@indiehacked.com.
7Data retention
We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by law.
| Data category | Retention period |
|---|---|
| Weekly Unpack subscription | Until you unsubscribe |
| Signups that are never confirmed | 7 days |
| Your address and subscription records after you unsubscribe | 24 months, to honour the unsubscribe and show the consent we had |
| Addresses that marked an issue as spam, at our email provider | For as long as we use that provider |
| Sent emails and newsletter activity, at our email provider | 45 days, then kept only as totals |
| Security records for signups | 24 hours |
| Service logs | Up to 30 days |
| Website visit statistics | 24 hours, then kept only as totals |
| Emails you send us | 24 months after the matter is closed |
| Legal hold data | As required by applicable law |
8Your rights under the GDPR
As a data subject in the EU/EEA, you have the following rights. We will respond to all requests within one month.
- Access (Art. 15): obtain a copy of the data we hold about you.
- Rectification (Art. 16): correct inaccurate or incomplete data.
- Erasure (Art. 17): delete your data. Write to privacy@indiehacked.com from the address you subscribed with.
- Restriction (Art. 18): limit how we process your data in certain circumstances.
- Portability (Art. 20): receive the data you gave us in a structured, machine-readable format.
- Objection (Art. 21): object to processing based on our legitimate interests, and to direct marketing at any time.
- Withdraw consent (Art. 7): at any time, using the unsubscribe link in any issue of Weekly Unpack or by contacting us. Withdrawal does not affect prior processing.
To exercise any of these rights, contact privacy@indiehacked.com. You may also lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se, or with the supervisory authority where you live.
10Minimum age
Weekly Unpack is for people aged 16 and over. We do not knowingly collect personal data from anyone under 16.
If you believe a person under 16 has subscribed, contact us at privacy@indiehacked.com and we will investigate and delete that data promptly.
11Data security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:
- Encryption of data in transit using TLS 1.2 or higher
- A subscriber list that only our own server can read or change
- Limits on signups and on confirmation emails
- Credentials for our service providers held in secret storage, never in source code
- Selection of processors who offer appropriate security guarantees under Article 28 GDPR
No system is perfectly secure. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected subscribers without undue delay, as required by GDPR Articles 33 and 34.
12Changes to this Privacy Policy
We may update this Privacy Policy from time to time. When we make material changes, we will:
- Update the version number and the “Last updated” date at the top of this document;
- Notify you by email if you subscribe to Weekly Unpack;
- Where required by law, seek your renewed consent.
Earlier versions remain available from the top of this page.
13Users outside the EEA
The Services are operated from Sweden and are designed around EU data protection standards. If you use the Services from outside the EEA, your personal data will be processed in the EEA and in the other locations described in sections 5 and 6. Depending on where you live, you may have additional or different rights under local law. Contact us at privacy@indiehacked.com and we will tell you what rights apply to you and help you exercise them.
If you live in the United States, your state may give you specific rights over your personal data, such as the right to know what we hold, to have it corrected, or to have it deleted. We extend the rights described in section 8 to everyone who uses the Services, wherever they live.
14Governing law and jurisdiction
This Privacy Policy is governed by the laws of Sweden and the European Union, including the General Data Protection Regulation (EU) 2016/679 and the Swedish Data Protection Act (lag (2018:218)).
Any disputes arising from this Policy are subject to the jurisdiction of the Swedish courts, without prejudice to your rights as a consumer under applicable mandatory law in your country of residence.
15Contact us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
- Company
- Piik Labs AB
- Organisation number
- 559577-8506
- VAT number
- SE559577850601
- Address
- Box 691, 414 52 Göteborg, Sweden
- Privacy enquiries
- privacy@indiehacked.com
- Legal and compliance
- legal@indiehacked.com
- Supervisory authority
- Integritetsskyddsmyndigheten (IMY), imy.se · imy@imy.se
© 2026 Piik Labs AB. IndieHacked is a Piik Labs brand. All rights reserved.