Privacy policy
Effective and last updated October 16, 2026
1. Who we are
Templates by State (templatesbystate.com) is operated by SEOS Design AB, a company registered in Sweden (registration number 559356-7745), Kungsholmsgatan 11, 112 27 Stockholm. This is our registered address for post and legal notices, not a location you can visit. We are the controller of the personal data described here. Contact: privacy@templatesbystate.com. We have not appointed a data protection officer; write to the same address.
2. The short version
We don't use cookies, local storage, analytics scripts or advertising on this site. The templates are created in your own browser, and anything you type into a fillable PDF stays on your device. It is never sent to us.
3. What we process and why
When you visit. Our hosting provider processes technical data to deliver the site and protect it against abuse: your IP address, your browser type, the page requested and the time. Legal basis under the GDPR: our legitimate interest in delivering the site, keeping it secure and stopping abuse (art. 6(1)(f)). These server logs are kept for 1 day.
When you email us. We process your email address, your name if you give it, and your message, to reply. Legal basis: our legitimate interest in answering you (art. 6(1)(f)), and for privacy requests our legal obligation (art. 6(1)(c)). We keep correspondence for up to 24 months, then delete it, unless we need it longer to complete a request.
We collect only what these purposes need, and we don't sell or share any of it (section 5). Your browser has to send its IP address to load any website, so a visit is not possible without it. Beyond that, no law or contract requires you to give us personal data: the templates need no account and no email address. If you don't email us, we can't reply to you.
4. Categories of personal information (US state laws)
Using the categories in California law, these are the only categories of personal information collected through this site, and the only ones collected in the past 12 months:
- Identifiers: IP address; email address and name if you write to us.
- Internet or other electronic network activity information: the pages requested and your browser type, in server logs.
- Geolocation data: only the city and country that our hosting provider derives from the IP address for its own purposes (section 6).
They come from you and your browser. We use them for the purposes in section 3 and keep them for the periods in sections 3 and 6. We disclose them only to our hosting provider and our email provider, who process them to host the site and deliver email. Vercel, our hosting provider, also processes some of the traffic data as its own controller (section 6). We don't collect sensitive personal information.
5. No sale, sharing, targeted advertising or profiling
We do not sell personal information, and we have not sold or shared any in the past 12 months. We don't share it for cross-context behavioral advertising, use it for targeted advertising, or use it for profiling or automated decisions that produce legal or similarly significant effects. Because we don't sell or share anyone's personal information, we don't sell or share the personal information of consumers under 16. We do not collect, use or sell personal data to train large language models.
6. Service providers and transfers
Hosting. Vercel Inc. (United States) hosts the site and processes the server logs on our behalf under its data processing addendum. The logs are kept for 1 day on our hosting plan. Vercel also processes some traffic data for its own purposes, as a separate controller, under its own privacy notice: the IP address and the city and country derived from it. How long Vercel keeps that data is set by its privacy notice, which states criteria but no fixed period.
Email. Our email provider stores and delivers the messages sent to us, under data processing terms that bind it to act on our instructions.
Transfers outside the EU/EEA. Vercel Inc. participates in the EU-U.S. Data Privacy Framework, so transfers to it are covered by the European Commission's adequacy decision (Implementing Decision (EU) 2023/1795). Vercel's data processing addendum also includes the EU Standard Contractual Clauses (Decision (EU) 2021/914). If our email provider processes data outside the EU/EEA, the transfer rests on an adequacy decision or on the Standard Contractual Clauses in its terms. Email us for a copy of these safeguards.
7. Your rights
You can ask us to confirm whether we process your personal data, and to access, correct or delete it, to give you a copy in a portable format, and to restrict our processing. You can also opt out of sale, sharing, targeted advertising and profiling (section 8), and ask for a list of third parties we sold your data to (we don't do any of those, so there is nothing to switch off or list). Requests are free, and we won't treat you differently for using your rights.
How to make a request
Email privacy@templatesbystate.com or write to SEOS Design AB, Kungsholmsgatan 11, 112 27 Stockholm, Sweden. You don't need an account. If we have a reasonable doubt about who is asking, we may ask for information to confirm your identity, such as a reply from the email address the request concerns, and we use it only for that. For server logs we would need your IP address and the time of your visit, and they are kept for only 1 day. An authorized agent can make a request for you with your signed permission; we may confirm your identity with you directly. A parent or legal guardian can make a request for a child.
Your right to object
We rely on our legitimate interests for the processing in section 3. You have the right to object to it at any time, on grounds relating to your particular situation. We will then stop, unless we have compelling legitimate grounds that override your interests, or we need the data to establish, exercise or defend legal claims.
Our answer, appeals and complaints
We answer within one month, and never later than 45 days. If we decline a request, we tell you why and how to appeal within the same time. To appeal, reply to our answer. We decide appeals in writing, with our reasons, within 60 days, and if we deny an appeal we tell you how to submit a complaint to your state attorney general.
Wherever you live, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se). In the EU/EEA you can also complain to the data protection authority where you live or work. You can also go to court.
8. Your privacy choices
Opting out. To opt out of the sale or sharing of your personal information, targeted advertising and profiling, email privacy@templatesbystate.com with “opt out”, or have an authorized agent do it for you. We honor the request for all of these. We do none of them today, so there is nothing on the site to switch off, but we keep your request and will honor it if that ever changes.
Global Privacy Control. We treat a Global Privacy Control signal from your browser as a valid request to opt out of sale, sharing and targeted advertising for that browser and device. Because we do none of those, there is nothing on the site for the signal to switch off.
Do Not Track. We don't collect information about your activities over time and across other websites, so a Do Not Track signal doesn't change how the site works. No advertising, analytics or social media company collects information through this site; our hosting provider receives the technical data in sections 3 and 6. If that changes, we will update this policy first.
9. Children
This site is for adults. It is not directed to children under 13, and we do not knowingly collect personal information from them. If we learn that a child under 13 has emailed us, we reply at most once and then delete the message and the email address.
10. Changes
We review this policy at least once every 12 months. We will update it before we add advertising, analytics or anything else that changes what we process, and we will change the date at the top. If a change affects personal data we already hold, we will tell the people it affects by email where we have their address, and ask for their consent where the law requires it.