Almåsa Alpin

Privacy policy

Personal data this website collects, and what the code does with it.

This text describes the website as of 22 October 2026.

Who is responsible

Föreningen Almåsabacken, a non-profit association, association number 802547-7145, Almås 314, 835 98 Offerdal, Sweden, is the controller for the processing below. Email: almasabacken@gmail.com.

Season passes

An order on the lift-pass page stores the details below. The price is calculated on the server. The price request sends only the pass type, not a name, email, or personal identity number.

  • The pass holder’s name.
  • A Swedish personal identity number or coordination number. The number is used to check age against the pass type and so the association can issue the personal lift card. Age is calculated on 1 December 2026. Youth is 8–16 years, adult is 17 or older, and a pass cannot be sold under 8. The same number cannot be used twice in one order. It is stored as YYYYMMDD-XXXX.
  • The buyer’s email address.
  • The language of the page, Swedish or English. It sets the language of the buyer’s confirmation email and of the receipt. The copy to the association is always in Swedish.
  • The order: order number, pass type, price per pass, subtotal, family discount, card fee, total, status unpaid or paid, whether the email was sent, the time, the payment time when an administrator marks the order paid, and the time a receipt was sent.
  • Payment happens in the customer’s own Swish app. The site only stores the order number as the reference. It looks like ALM- followed by six characters. The page shows the association’s Swish number, the amount, and the order number. It does not receive your Swish number, your name from Swish, or a payment confirmation from Swish. An administrator marks the order paid by hand.

The order is stored only if the box about storing the details is checked. The box itself is not stored as its own field. A hidden field named website is a spam trap. If it is filled in, the order is rejected and nothing is stored.

The confirmation on the page shows the order number, pass type, name, and price. It does not show the personal identity number. The email to the buyer contains the name, the personal identity number with the last four digits replaced by XXXX, the amounts, the Swish number, the order number, and where to collect the card. The receipt is a PDF that an administrator sends or downloads. It contains the association’s name, association number, address, the buyer’s email, the pass holders’ names, the amounts, and the VAT amount. The personal identity number is not on the receipt. A signed-in administrator can export a CSV file with the full number, and can show or copy one number at a time.

IP addresses

The address is read from the x-vercel-forwarded-for header, otherwise x-real-ip. If neither is present the stored value is unknown, and those requests share one limit. The address is cut to 64 characters.

  • On an order, the address is stored so that at most five orders can be placed in ten minutes.
  • Failed attempts to redeem the sign-in code are stored as a hash of the email and IP address, at most twenty in 24 hours. The email and IP are not stored in plain text. The code can be tried at most five times.
  • When someone requests a sign-in code, the address is stored, and a hash of the email address, so the same address or the same email cannot request more than five codes in fifteen minutes. Attempts to redeem a code also store the address, at most twenty times in fifteen minutes.
  • The admin log stores the address when an administrator shows a personal identity number, copies one, sends a receipt, or signs in with an email code. The row has the administrator’s username and the time. An email sign-in also stores the administrator’s email. The personal identity number is not in the row. The orders page shows the latest 50 rows.

Administrator sign-in

An administrator signs in with a six-digit code sent to an email address on an allowlist. The code is stored only as a hash, is valid for ten minutes, and can be tried at most five times. Failed attempts for the same email and IP address are capped for 24 hours. A successful sign-in is written to the admin audit log. The email is sent from order@send.almasaalpin.se.

Map and weather

The visitor’s browser loads map tiles directly from MapTiler, which sees the IP address. The association does not store that address for the map. OpenWeatherMap receives no visitor data. Weather is fetched by the server from OpenWeatherMap for a fixed point in Almåsa.

Theme

Light, dark, or system mode is stored in the browser’s localStorage under the key theme. It is not a cookie.

Why, and on what basis

Contract. Name, personal identity number, email, language, and the order, including the order number used as the Swish message, are used to take the order, check age against the pass type, issue the personal lift card, send the confirmation, and show the Swish details.

Legal obligation. The receipt is produced for bookkeeping. The code builds it from the stored order when an administrator sends or downloads it. The personal identity number is not part of the receipt.

Legitimate interest. The IP addresses in the limit lists are used to limit repeated orders and sign-in attempts. The admin log is used to see who retrieved a personal identity number, sent a receipt, or signed in with an email code.

Who receives the data

  • Vercel hosts the website. The code runs there and reads the IP address from Vercel’s header.
  • Neon Postgres is the database when DATABASE_URL, POSTGRES_URL, or DATABASE_URL_UNPOOLED is set. The first value that is set is used. In production on Vercel the order is refused if no such address is set. Without an address, locally and in preview, the order stays in the server’s memory until the process restarts.
  • Resend sends order emails, receipts, and sign-in codes when an API key and a sender address are set. Emails are processed by Resend under its own terms. Otherwise no email is sent, and the server then logs the order number, not the personal identity number.
  • The visitor’s browser loads map tiles directly from MapTiler, which sees the IP address.
  • Payment happens in the customer’s own Swish app. The site only stores the order number as the reference. The link to app.swish.nu can include the Swish number, amount, and order number. Name, email, and personal identity number are not included in that link.

The database and the hosting are Neon and Vercel. The region is not confirmed. The data may therefore be processed outside the EU/EEA, under the providers’ standard contractual clauses. OpenWeatherMap receives no visitor data.

How long the data stays

The limit lists for orders and sign-in codes delete rows older than 24 hours. Each cleanup removes at most 200 rows, runs at most once an hour in each running server instance, and only when that feature is used again. A row can therefore remain longer than 24 hours.

The sign-in code is valid for 10 minutes. Rows in the code table are deleted when the expiry is older than 24 hours, with the same limit of 200 rows.

Orders and receipts are kept for 7 years after the end of the financial year, because of Swedish bookkeeping law (bokföringslagen). The personal identity number is kept only as long as needed to issue and check the season pass, and is removed after the season ends at the latest.

The admin audit log and rate-limit or login data are kept for up to 12 months. Without a database the latest 200 rows of the admin log are kept in memory.

The administrator sign-in cookie lasts 12 hours. The cookie for a pending sign-in code lasts 10 minutes.

Your rights

You can ask for access, rectification, erasure, restriction, objection, and data portability. The website has no page that does this by itself. Write to almasabacken@gmail.com. An administrator can delete an order and its passes. The code does not block that deletion.

You can also complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten, imy.se.

Cookies

The website sets no analytics cookies and no language cookie. The language is in the address, /sv or /en. A first visit without a language uses the browser’s Accept-Language header to choose Swedish or English.

admin_session is set only after a sign-in to administration. It is HttpOnly, Secure, and SameSite=Lax, applies to the whole website, and lasts 12 hours. The value is a signed token with the username and the administrator’s email. It is removed on logout. Ordinary visitors do not get it.

admin_email_code is set when an administrator requests an email code. It is HttpOnly, Secure, and SameSite=Strict, lasts 10 minutes, and is set on the paths /sv/admin/login, /en/admin/login, /admin/login, and /api/admin/email-code. The value is a signed token with the email address and an expiry. It is removed after a successful code sign-in and when the code is locked after five wrong attempts. Ordinary visitors do not get it.

An unused sidebar in the code can set a cookie. No page uses that sidebar, so the website does not set it. The theme is stored in localStorage, not in a cookie.