Privacy Policy

A. Who is responsible for your data

Webestate, a Swedish sole trader operating SpareGraph, is the controller for the personal data described in this notice. You can reach the controller at info@sparegraph.com. Registered business and contact details are available on the Legal page.

B. Scope

This notice covers the public SpareGraph website — public search and the published knowledge pages — as well as Deep Search submissions, the public feedback function and authorized internal user accounts. It does not cover third-party websites linked to from SpareGraph pages.

C. Public search and privacy-minimized analytics

To operate and improve search, understand knowledge gaps, measure page and referral usage, and diagnose abuse and service quality, SpareGraph records a server-side event when public pages are used. Each event may contain:

• the event type (for example a search or a page view)
• the requested route or page path
• the search query, when a search is performed
• the referrer domain only — never the full referring URL
• UTM parameters, when present in the address of the page opened
• a two-letter country code only when it is supplied by trusted hosting/request metadata; no external geolocation service is used
• a short-lived, daily-rotating pseudonymous visitor identifier, derived on the server with a secret key; it is designed to rotate daily and does not provide SpareGraph with a stable identifier across days

The raw IP address and the raw User-Agent string are not stored in SpareGraph's analytics tables. SpareGraph builds no cross-site behavioural profile, uses no advertising identifier, and does not itself use advertising or analytics cookies or a browser-storage analytics identifier on public pages. Platform and edge cookies are described in the Cookie & Storage Notice).

The published site is hosted on Lovable. Lovable's hosting and platform may collect or generate app-usage and operational analytics associated with the published site, including metrics such as visits and pageviews, page and source, device category, country and session-level usage metrics. This hosting-level processing is separate from SpareGraph's own privacy-minimized server-side analytics described above.

The legal basis for this processing is legitimate interests under GDPR Article 6(1)(f) — operating, securing and improving the service while minimising data collection.

Please do not enter personal, confidential or sensitive information into the public search box. Search queries are stored (with obvious email addresses and phone numbers redacted) to identify knowledge gaps, and other people can theoretically read whatever you type.

D. Deep Search

A Deep Search submission stores the technical details you provide: part number, manufacturer, machine manufacturer and model, description of the problem, country and urgency; an optional email address if you choose to give one; timestamps and internal investigation/status fields; the private random status token; the referrer domain and UTM parameters if present; and a short-lived rate-limit identifier kept only in the separate rate-limit mechanism. The raw IP address is not stored in the application tables.

Purpose: to investigate and respond to the voluntarily submitted technical request, to manage status and result delivery, to prevent abuse and to improve the knowledge base. Legal basis: legitimate interests under GDPR Article 6(1)(f).

Email. An optional Deep Search email is used only for that Deep Search request and related status/result communication. It is never used to subscribe you to newsletters or marketing.

Knowledge reuse. Verified technical findings may later be converted into public SpareGraph knowledge pages. Before publication, contact details, company-specific identifiers, unnecessary free-text personal data and other information that could identify the submitter are removed. Public knowledge is technically useful but anonymised — the submitter's email is never published.

Retention. An active Deep Search is kept while the investigation remains active. A closed Deep Search is deleted 12 months after closure. Once the underlying request is deleted, the private status link stops working.

E. Public feedback

The "Did this solve your problem?" function stores your rating (Yes / Partly / No), an optional comment, the page or entity the feedback was given on, and a timestamp. A short-lived rate-limit identifier is maintained separately for abuse protection; it is not stored on the feedback record itself. Feedback records are kept for 12 months.

Purpose: to evaluate and improve published knowledge and prevent repeated automated abuse. Legal basis: legitimate interests under GDPR Article 6(1)(f).

F. Security and rate limiting

Network information such as your IP address and User-Agent string is necessarily processed transiently by the web server and hosting infrastructure when requests are made. SpareGraph uses this information only transiently to derive a short-lived pseudonymous rate-limit value; raw IP addresses and User-Agent strings are not stored in SpareGraph's application tables for this purpose. Rate-limit rows are automatically removed after 7 days. Hosting and infrastructure providers may maintain their own operational and security logs under their applicable terms and retention practices.

G. Internal authorized accounts

Authorized internal users may have name, email, profile, authentication and session information stored. This is used to operate and secure the private SpareGraph workspace. It is retained while the account is active and as reasonably required for security and administration. The browser storage used for internal sign-in is strictly necessary for that functionality.

H. Newsletters and marketing

SpareGraph does not currently operate a newsletter or marketing subscription. If one is introduced later, signup will be separate and optional, not pre-selected, and Deep Search emails will not be reused for marketing without the required legal basis or permission. A clear unsubscribe and objection mechanism will always be provided.

I. Service providers / recipients

• Lovable — application hosting, platform infrastructure and hosting-level app usage and operational analytics for the published application.
• Supabase — database and authentication infrastructure.

These providers and their subprocessors may receive data as necessary to provide and security-operate the service.

J. International transfers

Some service providers and subprocessors may process data outside the EU/EEA. Where Chapter V of the GDPR applies, transfers rely on an applicable lawful safeguard, such as an adequacy decision or appropriate safeguards (for example Standard Contractual Clauses), as applicable to the provider and transfer in question. You may contact info@sparegraph.com for more information.

K. Retention summary

L. Your rights

As applicable, you have the right to access your personal data, have it rectified or erased, restrict its processing, object to processing based on legitimate interests, and — where applicable — data portability. You also have the right to complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY). Contact info@sparegraph.com to exercise your rights. SpareGraph does not carry out automated decision-making producing legal or similarly significant effects.

For a Deep Search submitted without an email address, include the DS reference and, where possible, the private status link so the request can be located.

M. Children

SpareGraph is aimed at businesses and professionals and is not directed to children.

N. Updates

Material changes to this notice are reflected by updating the date at the top of this page.