GDPR Compliance

Last updated: March 16, 2026

CodeForge AB ("we", "us", "our"), the company behind Middlewr, is committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) (EU) 2016/679. This page explains how we comply with GDPR and outlines your rights as a data subject.

Data Controller

The data controller for personal data processed through Middlewr is CodeForge AB (reg. nr 5595106047), located at Heleneborgsgatan 5C, 112 45 Stockholm, Sweden. As the data controller, we determine the purposes and means of processing your personal data.

Legal Basis for Processing

We process your personal data based on the following legal grounds under Article 6 of the GDPR:

  • Contract performance — Processing necessary to provide you with our link management services (Article 6(1)(b))
  • Legitimate interests — Processing necessary for our legitimate business interests, such as improving our services and preventing fraud, where these interests are not overridden by your rights (Article 6(1)(f))
  • Consent — Where you have given us specific consent to process your data for a particular purpose, such as receiving marketing communications (Article 6(1)(a))
  • Legal obligation — Processing necessary to comply with our legal obligations, such as tax and accounting requirements (Article 6(1)(c))

Categories of Personal Data

We process the following categories of personal data:

Account Data — Name, email address, and authentication credentials provided during registration.

Link Data — URLs, custom slugs, tags, and metadata associated with the short links you create.

Analytics Data — Anonymized click data including timestamps, approximate geographic location (country/city level), device type, browser, operating system, and referrer URL.

Technical Data — IP addresses (anonymized), browser type, and device information collected automatically when accessing our services.

Your Rights Under GDPR

As a data subject, you have the following rights under the GDPR:

Right of Access (Article 15) — You have the right to obtain confirmation of whether we process your personal data and to receive a copy of that data.

Right to Rectification (Article 16) — You have the right to request correction of inaccurate personal data or completion of incomplete data.

Right to Erasure (Article 17) — You have the right to request deletion of your personal data when it is no longer necessary for the purposes for which it was collected.

Right to Restriction (Article 18) — You have the right to request restriction of processing in certain circumstances, such as when you contest the accuracy of the data.

Right to Data Portability (Article 20) — You have the right to receive your personal data in a structured, commonly used, and machine-readable format.

Right to Object (Article 21) — You have the right to object to the processing of your personal data based on legitimate interests or for direct marketing purposes.

Right Regarding Automated Decisions (Article 22) — You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days as required by the GDPR.

International Data Transfers

Your personal data is primarily processed within the European Economic Area (EEA). Where we transfer data outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or transfers to countries with an adequate level of data protection as determined by the European Commission.

Data Protection Officer

For any questions regarding our data protection practices or to exercise your rights, you can reach our data protection team at [email protected].

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by Article 33 of the GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected. When your account is deleted, we will erase or anonymize your personal data within 30 days, unless we are required to retain it for legal, regulatory, or legitimate business purposes. Analytics data is stored in anonymized form and is not subject to individual data retention requests.

Sub-processors

We use the following categories of sub-processors to help deliver our services. Each sub-processor is bound by data processing agreements that ensure GDPR-compliant handling of personal data:

  • Cloud hosting and infrastructure providers (EEA-based)
  • Payment processing services
  • Email delivery services
  • Analytics and monitoring tools (anonymized data only)

Right to Lodge a Complaint

If you believe that our processing of your personal data violates the GDPR, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), which is our lead supervisory authority. You can reach IMY at imy.se or by post at Integritetsskyddsmyndigheten, Box 8114, 104 20 Stockholm, Sweden.

Changes to This Page

We may update this GDPR compliance page from time to time to reflect changes in our data processing practices or legal requirements. We will notify you of any material changes by updating the "Last updated" date at the top of this page.

Contact Us

For any GDPR-related questions or requests, please contact us at [email protected]. Our registered address is: CodeForge AB, Heleneborgsgatan 5C, 112 45 Stockholm, Sweden (reg. nr 5595106047).