Privacy Policy for Kolla
Last updated: September 10, 2026
This translation is provided for convenience; in case of conflict the Swedish version prevails.
This Policy describes how we process personal data when you visit kolla.media, use Kolla, open a review link, contact us, or receive email from us. It also provides information about cookies in section 8.
1. Who is responsible
Lind Studio AB, company registration number 559593-4265, with its registered office in Boden, Sweden Tråggränd 20, 961 42 Boden, Sweden Email: hello@kolla.media
We do not have a data protection officer. Send questions about personal data to the address above.
2. Our two different roles
When we are the controller, we decide why and how personal data is processed. This applies to visits to kolla.media, the waiting list, accounts and Organizations in Kolla, subscriptions, support, security, and email that we send on our own behalf. Sections 3 to 8 describe this processing.
When we are the processor, we process data on behalf of the company or person that uses Kolla (the "Customer"). This applies to everything the Customer adds to Kolla, including images, video, text, comments, approvals, and the names and email addresses of people whom the Customer invites to review material ("Reviewers"). The Customer is the controller for this processing, and we follow the Customer's instructions under the Data Processing Agreement in our General Terms.
If you have received a review link, the Customer is responsible for your personal data being in Kolla. The Customer should have told you about this. To ask what data is processed, have it corrected, or have it deleted, contact the person or company that sent the link. We help the Customer handle your request. Section 5 describes what is recorded when you use the review portal.
3. The data we process, why we process it, and our legal basis
| Situation | Data | Purpose | Legal basis |
|---|---|---|---|
| You visit kolla.media | IP address, browser, device, pages visited, referring page, and time of visit, held in temporary server logs | Deliver the website, protect it against attacks, and troubleshoot problems | Our legitimate interest in operating a secure website |
| You join the waiting list | Email address, name if provided, time, and language | Invite you when we open Kolla to more users | Our legitimate interest in managing expressions of interest. You may ask us to remove you at any time. |
| You create an account and an Organization | Name, email address, profile picture if provided, language, role, Organization name, login details held by our authentication provider, and login times | Give you access to Kolla, keep the account secure, and determine which Organization you belong to | Performance of a contract when you are the Customer. Otherwise, our legitimate interest in administering the Customer's Organization. |
| Your Organization has a trial or subscription | Organization name and billing address, billing email address, number of Users, subscription status, payment history held by Polar, trial date, and a normalized version of the email address used to ensure that each person can start only one trial | Provide the correct access, manage the subscription, and prevent trial abuse | Performance of a contract, our legitimate interest in preventing abuse, and compliance with a legal obligation for accounting |
| You contact support | Contact details, message content, screenshots, and technical information | Help you and improve the Service | Performance of a contract or our legitimate interest in providing support |
| We send email about the Service | Name, email address, event in the Service, such as a new comment, and delivery status | Send notifications about review activity and important account, contract, or security messages | Performance of a contract and our legitimate interest in providing information about the Service. Review activity notifications can be turned off in the settings. |
| We send tips and onboarding emails | Name, email address, language, trial or subscription information, and unsubscribe time | Help you get started during the trial and after purchase | Consent where required by law. Otherwise, our legitimate interest in introducing new users to the Service. Every email has an unsubscribe link, and you may always object. |
| We use analytics tools | Page views, clicks, features used, browser, device, approximate location, and identifiers. For signed-in Users, the data is linked to your account. | Understand how Kolla is used, improve it, and detect errors | Consent to analytics storage on kolla.media and in the signed-in part of Kolla, as described in section 8 |
| We protect the Service | IP address, login events, technical logs, and error reports | Detect and investigate intrusions, misuse, and errors | Our legitimate interest in protecting the Service, Customers, and ourselves |
| We comply with legal requirements or handle disputes | Contract, payment, and communication data | Maintain accounting records, respond to government authority decisions, and establish or defend legal claims | Compliance with a legal obligation and our legitimate interest in handling legal claims |
You do not have to provide us with any data, but we cannot give you an account without your name and email address.
4. Where the data comes from
The data comes from you, the company you work for or represent, a Customer that invites you as a User or Reviewer, automatically when you use kolla.media or Kolla, and from Polar in relation to subscription status.
5. The review portal
When you open a review link, Kolla records on the Customer's behalf that the link was opened, the version of the material you saw, your comments and decisions and their timestamps, and the browser and device type you used. Your IP address is stored only as a hash and is used for security. If you give feedback about the review experience, we store it with your name.
When the Customer adds you as a Reviewer, a record containing your name and email address is created with our authentication provider so that your comments and approvals can be linked to you. You do not need a password or an account.
The review portal uses only the cookies needed for the link to work, as described in section 8.
6. Who receives the data
Subprocessors. We use suppliers for hosting, storage, authentication, email, and analytics. They process data only under our instructions and agreements. Our Subprocessor List identifies them, where they process the data, and the transfer mechanism used.
Polar. Subscriptions are purchased from Polar Software, Inc., which is the seller and merchant of record. As an independent controller, Polar processes names, email addresses, billing addresses, VAT registration numbers, payment card details, and payment history to complete purchases, issue invoices, account for VAT, and prevent fraud. We never see your full payment card details. Read Polar's Privacy Policy.
Meta Platforms Ireland Limited. If you consent to cookies, we use Meta's advertising tools to measure and target our advertising on Facebook and Instagram. Meta then receives data about your visit, Meta's cookie identifier, and events recording waiting-list sign-up, account creation, and the first paid subscription. Meta processes some of this data for its own purposes under its privacy policy.
Authorities and advisers. We disclose data to authorities when required and to auditors, lawyers, and other advisers when needed.
We do not sell personal data.
7. Transfers outside the EU and EEA
Several of our suppliers are established in the United States, where the data is stored. We transfer data there under the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework where a supplier is certified under it. Other transfers rely on the European Commission's Standard Contractual Clauses, together with supplementary safeguards such as encryption and access restrictions. The Subprocessor List states the transfer mechanism used for each supplier. You can ask us for a copy of the Standard Contractual Clauses.
8. Cookies and similar technologies
A cookie is a small text file stored in your browser. We also use the browser's local storage for some settings. Under the Swedish Electronic Communications Act (2022:482), we may store and read data on your device without consent only where needed for a service that you have requested. We use other cookies only after you have consented.
8.1 Necessary cookies and storage
| Name | Location | Purpose | Duration |
|---|---|---|---|
wos-session | app.kolla.media | Keeps you signed in | Up to 400 days, renewed during use |
Next-Locale | kolla.media, app.kolla.media | Remembers your selected language | Session |
kolla-signed-in | kolla.media, app.kolla.media | Records whether you are signed in so the website can show the correct buttons | 30 days |
__ph_opt_in_out_… (local storage) | kolla.media, app.kolla.media | Stores your choice about analytics and marketing cookies so Kolla can respect it | Until you change your choice or clear the website's data in your browser |
kolla-tracking-consent | kolla.media, app.kolla.media | Stores the same choice so that it carries between kolla.media and Kolla | 12 months |
kolla_review_preview_…, kolla_review_session_… | app.kolla.media (review portal) | Gives you access to the material in a review link without signing in | Until the link expires |
theme, kolla:… (local storage) | app.kolla.media | Remembers interface settings, that you have seen an introduction, and message drafts so they are not lost | Until you clear your browser data |
8.2 Cookies that require consent
| Name | Provider | Purpose | Category | Duration |
|---|---|---|---|---|
ph_…_posthog (cookie and local storage) | PostHog, Inc. (through kolla.media and app.kolla.media) | Statistics on how the website and Kolla are used, and error reporting | Analytics | 12 months |
_fbp | Meta Platforms Ireland Limited (through kolla.media and app.kolla.media) | Measures and targets our advertising on Facebook and Instagram | Marketing | 90 days |
_fbc | Meta Platforms Ireland Limited (through kolla.media and app.kolla.media) | Links a visit to the advertisement you clicked | Marketing | 90 days |
On kolla.media and in the signed-in part of Kolla, a cookie choice is shown the first time you visit the service. You may accept or reject analytics and marketing cookies and change your choice at any time through the "Cookies" link in the footer on kolla.media or under Settings in Kolla. If you reject them, PostHog continues to collect statistics without storing analytics data on your device, and the Meta pixel does not load. The review portal does not use any cookies that require consent.
If you block necessary cookies in your browser, sign-in and review links may stop working.
9. How long we keep the data
| Data | Retention period |
|---|---|
| Account and Organization | For as long as the account or Organization exists. After a deletion request, the data is removed within 90 days, except for data that must be kept for accounting or legal claims. |
| Material, comments, and approvals in Kolla | Under the Customer's instructions and our General Terms, the data remains available for 30 days after the agreement ends and is deleted within the following 90 days. |
| Waiting list | Until you have been invited or ask us to remove you, but no longer than 12 months after the most recent contact. |
| Support | 24 months after the support case is closed. |
| Email logs containing the recipient, subject, and delivery status | 28 days in our systems and up to 30 days with the email provider. |
| Tips and onboarding emails | Records of sending and unsubscribing are kept for 12 months after the sequence ends so that we can show that we respected your choice. |
| Analytics data | No longer than 24 months. |
| Technical server and security logs | Up to 30 days, or longer if needed to investigate an incident. |
| Accounting records | 7 years under the Swedish Accounting Act. |
| Data relating to legal claims | For as long as the claim may be brought. |
10. Security
All communications with Kolla are encrypted. Data is stored with suppliers that have documented security programs. Access is controlled by Organization and role, review links use random secrets stored as hashes, and we log security events. No internet service can be guaranteed to be entirely free of risk. If an incident occurs that affects you, we inform you as required by law.
11. Your rights
When we are the controller, you have the right to:
- access your personal data,
- have inaccurate data corrected,
- have data deleted,
- restrict the processing,
- receive your data in a machine-readable format and transfer it to someone else (data portability),
- object to processing based on legitimate interests,
- object to direct marketing; if you do, we will always stop, and
- withdraw consent without affecting processing that has already taken place.
Send your request to hello@kolla.media. We may need to verify your identity and normally respond within one month. These rights are not absolute. For example, data that must be retained under the Swedish Accounting Act cannot be deleted early.
If you are dissatisfied with how we process your data, you may lodge a complaint with the Swedish Authority for Privacy Protection (IMY) at imy.se.
When we act only as processor, as described in section 2, direct your request to the Customer. We forward requests that we receive and help the Customer respond.
12. Automated decision-making and children
We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you. Kolla is not intended for children, and anyone who subscribes must be at least 18 years old.
13. Changes
We update this Policy when Kolla or our processing changes. The current version is always available on kolla.media. We tell you about material changes by email or in Kolla.
14. Contact
Lind Studio AB Company registration number: 559593-4265 Registered office: Boden, Sweden Tråggränd 20 961 42 Boden, Sweden Email: hello@kolla.media