Privacy Policy
Last updated 21 September 2026
The short version. This site shows no advertising and sets no cookies of its own. The only personal information we hold is what you type into the contact form, which is protected by a spam check run by Cloudflare. Everything else we see is anonymous, aggregated visitor counts. We do not sell information about you to anyone.
1. Who we are
Small Cider is a trading name of Brown Hat AB, a company registered in Sweden. Brown Hat AB is the data controller for the information described in this notice.
- Brown Hat AB (org. nr 559530-4931), trading as Small Cider
- Styrbjörnsgatan 5, 753 34 Uppsala, Sweden
- Email: brent@smallcider.com
2. What this notice covers
This notice covers the website at www.smallcider.com.
It does not cover other websites we link to. Flaivy, Systembolaget, Etsy, Instagram, our apple growers and the other sites we point you towards each handle your information under their own privacy notices. Once you follow a link, you are on their site and their rules apply.
3. Information you give us
The contact form is the only place on this site where you can enter personal information. It asks for:
- your first name and last name
- your email address
- the message you write
When you send the form, that information is emailed to us so we can read it and reply. That is all we do with it. Sending the form does not create an account and does not add you to a mailing list.
To keep automated spam out, the form uses Cloudflare Turnstile, a check that normally runs in the background without asking you to do anything; occasionally it asks you to tick a box. While it runs, Cloudflare receives your IP address and technical details about your browser and device, and it may store a small amount of data in your browser for the duration of the check. Cloudflare uses this only to decide whether the submission comes from a person, not to identify you or to follow you across other websites. Cloudflare's Turnstile privacy notice describes its handling in detail. The form also contains a hidden field that automated spam tools fill in and people never see; if it is filled in, we discard the submission.
4. Information collected automatically
Visitor statistics
We use Vercel Web Analytics to count visits and see which pages people read. It does not use cookies, it does not follow you across other websites, and it is not used to identify you. For each page view it records the date and time, the page address, the site you arrived from, an approximate location worked out from your IP address (country, region and city), your device type, operating system and browser.
Visitors are counted using a temporary value derived from the request, which is discarded after 24 hours. Your IP address is not stored against these statistics. We only ever see totals, never a record of an individual person's visit.
Server logs
Our hosting provider keeps standard technical logs of requests to the site, which include IP addresses. These exist so the site can be kept running and protected against abuse. We do not use them to build a picture of individual visitors.
5. Cookies and storage on your device
This site sets no cookies of its own, with one exception: the Cloudflare Turnstile spam check on the contact form may store a small amount of data in your browser, as cookies or local storage, while it decides whether a submission comes from a person. That storage is strictly necessary for the form to work, is not used for advertising or to follow you across websites, and is described in section 3.
One further piece of information is stored in your browser by us. When you confirm that you are 20 or older, we save an entry called ageVerified in your browser's local storage so that you are not asked again on every page. It never leaves your device, it is never sent to us, and you can remove it by clearing site data in your browser settings.
If you visited smallcider.com before September 2026, your browser may still hold a cookie set by our previous website provider. The current site does not use or read it. It will expire on its own, or you can clear it along with the rest of your site data.
6. Why we use your information, and our legal basis
Under the General Data Protection Regulation we have to tell you why we process your information and what legal basis we rely on.
| What we do | Information used | Legal basis |
| Read and answer your message | Name, email and message from the contact form | Our legitimate interest in replying to people who contact us. Where you write to us about placing an order or working together, taking steps at your request before entering a contract. |
| Keep automated spam out of the contact form | IP address and technical details of your browser and device, processed by Cloudflare Turnstile | Our legitimate interest in preventing abuse of the form and keeping it usable. |
| Understand how the site is used | Aggregated visitor statistics | Our legitimate interest in knowing whether the site works and what people read. No cookies are used and no individual is identified. |
| Keep the site running and secure | Server logs | Our legitimate interest in operating a working, secure website. |
| Remember your age confirmation | The ageVerified entry on your device | Strictly necessary to provide a feature you asked for. This is why we do not ask your permission to store it. |
7. Who else handles your information
We keep the number of companies involved as small as we reasonably can. These are all of them:
- Vercel hosts the website and provides the visitor statistics described above.
- Resend delivers the email generated by the contact form.
- Cloudflare runs the Turnstile spam check on the contact form.
- Google Workspace provides the mailbox where we read your message.
- Google Fonts serves the typeface used on this site. Because the typeface is loaded from Google's servers as the page opens, your IP address is shared with Google at that moment. This happens on every visit, whether or not you use the contact form.
Apart from the font, these companies process information on our instructions and are not permitted to use it for their own purposes. We do not sell your personal information, and we do not share it for advertising.
8. Where your information is processed
Some of the companies above are based in the United States or process information outside the European Economic Area. Where that happens, the transfer is covered by the safeguards those companies put in place, such as the European Commission's standard contractual clauses.
9. How long we keep it
We keep messages sent through the contact form for as long as we need them to answer you and to handle any business that follows from your message. We review the inbox from time to time and delete what we no longer need.
Visitor statistics are aggregated and are not tied to you. Server logs are kept by our hosting provider for a short period and then deleted.
10. Your rights
You have the right to ask us to give you a copy of the personal information we hold about you, correct it if it is wrong, delete it, restrict how we use it, or provide it in a portable form. You can also object to us processing it on the basis of our legitimate interests.
To exercise any of these rights, email brent@smallcider.com. We will reply within one month. There is no charge.
If you think we have handled your information badly, you can complain to the Swedish data protection authority, Integritetsskyddsmyndigheten (IMY), at www.imy.se. We would rather you told us first so we can put it right.
11. Age of visitors
We make and sell alcoholic drinks, so this site is intended for adults. We ask everyone to confirm they are 20 or older before entering. We do not knowingly collect personal information from children, and we do not market to them. If you believe a child has sent us personal information, email us and we will delete it.
12. Changes to this notice
If we change how the site handles your information, we will update this page and change the date at the top. If the change is significant, we will say so on the site.
13. How to contact us
Email brent@smallcider.com, or write to us at the address in section 1.