Privacy policy

Last updated 7 October 2026

Draft translation – the Swedish version applies

This translation is a draft that has not yet been reviewed. Where they differ, the Swedish version applies.

Qrona Newsletter (newsletter.qrona.se) is provided by Qrona AB, Swedish company registration number 556675-2894. This policy describes which personal data the service processes, why and for how long.

Roles

For you as a user of the service (account, sign-in, connected mailboxes), Qrona AB is the controller. For the contacts and recipients a customer adds and sends newsletters to, the customer is the controller and Qrona AB the processor, under the customer's data processing agreement.

What we store about you as a user

Your name and email address, and which sign-in methods you have used (Microsoft, Google or Qrona ID) with the provider's id for your account.
Sessions (only a check value of the cookie), IP address and browser, for security and traceability.
An audit log of changes you make in a workspace (for example that a campaign was sent).

Connected mailbox (Microsoft 365 or Gmail)

You can choose to connect your mailbox to send test emails of a newsletter to yourself or colleagues. We then only ask for the right to send email as you (Microsoft: Mail.Send and User.Read, Google: gmail.send) and store the provider's access encrypted. We never read your inbox, your contacts or your calendar, and we send nothing other than the test emails you start yourself. You can disconnect the mailbox at any time under Settings → Mailboxes, and revoke the access with Microsoft or Google.

Qrona Newsletter's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Connection to Google Analytics

An administrator can connect the workspace to Google Analytics to see how the newsletters' recipients then use the company's website. We then only ask for read access (Google: analytics.readonly) and store the access encrypted. We read the list of Google Analytics properties the account has access to, so that the administrator can choose one, and after that only aggregated figures for the workspace's own campaigns (sessions, engaged sessions, key events and revenue) – never data about individual visitors – and we never change anything in Google Analytics. The figures are only shown to the workspace's users; the latest summary is stored so that it shows quickly, and is deleted with the connection. The connection can be removed at any time under Settings → Integrations, and the access can be revoked in the Google account. This too adheres to the Google API Services User Data Policy and the Limited Use requirements.

Recipients of newsletters

The customer decides which contacts are added and what is sent. We store the email address, name details and other fields the customer chooses, consent and unsubscriptions (with time and source), and events for each mailing: delivered, bounced, reported as spam, and — if the customer has turned it on — opened and clicked. Every newsletter has an unsubscribe link that works with one click.

Where the data is kept and which processors we use

Servers and database: DigitalOcean, within the EU.
Sending of email: an email delivery provider, with processing within the EU.
Microsoft and Google: only when you sign in with them, connect your mailbox or connect Google Analytics.

For how long

Account details are kept for as long as the account exists. Contacts and mailing history are kept for as long as the customer has them in their workspace; the customer can delete contacts at any time. A deleted contact's address stays on the suppression list so that it never receives mailings again.

Cookies

The website only uses necessary cookies for sign-in and security. We use no cookies for analytics or marketing.

A customer can choose to measure the visits to its own landing pages and forms with Google Analytics. The page then asks the visitor first, and nothing is fetched from Google and no such cookies are stored without consent. The measurement is done on the customer's behalf, in the customer's own Google Analytics account, and the customer is the controller for it.

Your rights

You have the right to know which data we hold about you, to have it corrected or erased, to object and to have it moved. If you are a recipient of a customer's newsletter, you should first turn to the sender. Contact us at support@qrona.se. You can also lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).