Wise Prediction Privacy Policy

Last updated: October 21, 2026

1. Who we are

This policy covers the Wise Prediction website at wiseprediction.com. The website is run by Loheden AI Solutions AB, a company registered in Sweden, which decides what is done with the personal data described here (the data controller). You can reach us at [email protected], or by post at Loheden AI Solutions AB, Vretavägen 26, 71993 Vintrosa, Sweden.

2. What we process, and why

The website has no accounts and no sign-in, and it asks you for nothing. You can read every page without telling us who you are.

2.1 Visiting the website

When your browser asks for a page, the request goes through Cloudflare, which serves the website for us, to our server. Like any request on the web, it carries your IP address, the page asked for and technical details such as the type of browser. Cloudflare uses them to deliver the page and to protect the website from attack, and it counts the visits in its own traffic statistics, which show us how many people visit and from which countries. Our server keeps no log of visitors' addresses. No analytics script runs on any page, and nothing is stored on your device to count you.

Our server counts visits itself: by day, by country as Cloudflare reports it, by the kind of device (computer, phone or tablet) as your browser reports it, and by the website that brought the visit and the first page it opened. In the same way, it counts how many visits go on to another page and how many reach an app page, and when you click a button to the App Store or Google Play it records that click with the app, the store and the page it was on, together with the same details of the visit. Where a visit came from travels from page to page in the addresses of our own links, so nothing is stored on your device for it. Nothing we keep is made from your IP address or identifies you, and what your browser says about itself is read when you open a page and not kept.

Legal basis: our legitimate interest in delivering the website and keeping it safe (Article 6(1)(f) GDPR).

2.2 Blocking attacks

Some requests ask for pages that only attack tools look for, such as WordPress login pages or configuration files. Our server notes the address that sent one, with the pages it asked for, and deletes that note 30 days after the last such request. An address that sends three, or that we block by hand for attacking the website, is blocked from the whole website for 30 days. To stop a blocked address before it reaches our server, Cloudflare keeps the address itself on a block list for at most 30 days at a time while the block lasts. The list also protects our other websites, so an address blocked on one may be refused by the others for that time.

A failed attempt to sign in to the website's administration pages is recorded with the address and the browser it came from, so that repeated guessing can be locked out for an hour. The record is deleted within a day after that hour has passed.

Legal basis: our legitimate interest in protecting the website, our other websites and their users from attack (Article 6(1)(f) GDPR).

2.3 Writing to us

If you email us, we use your address and what you write to answer you, and we keep the conversation for as long as we need it to help you and to follow up. Our email is hosted by Google.

Legal basis: our legitimate interest in answering you (Article 6(1)(f) GDPR).

2.4 Purchases made on this website in the past

Until 16 September 2026, access to the predictions could be bought on this website, with an account created through Google Sign-In. Both have ended, and every access bought here has run out.

Stripe, which took those payments for us, holds the record of each purchase: who paid, for what, when and how much. We keep these records for the seven years Swedish bookkeeping law requires, counted from the end of the financial year the purchase falls in.

The accounts of that time, with what Google gave us at sign-in (your name, email address and Google account ID), are no longer used by the website and are not on its servers. Their last copy is in the database of our former hosting provider, DigitalOcean, on servers in Germany, where nobody reads or changes it. It is deleted when we close that database.

Legal basis: our legal obligation to keep accounting records (Article 6(1)(c) GDPR).

3. Who handles it for us

These service providers process personal data on our behalf, each under a data processing agreement:

• Cloudflare, which serves and protects the website, keeps its traffic statistics and the block list (section 2.2), and stores our backups in its storage in the European Union
• Hetzner, which hosts our server and its database in Finland, inside the European Union
• Google, which hosts our email. Google's Firebase also holds the prediction data the website shows, which contains no personal data
• Stripe, which holds the records of past purchases (section 2.4)
• DigitalOcean, which holds the old account database until we close it (section 2.4)

Cloudflare and Google are companies based in the United States. Where your data leaves the European Economic Area with them, the transfer is covered by the EU and US Data Privacy Framework or by the European Commission's standard contractual clauses.

We may also disclose information where the law requires it, for example to a court or a public authority.

4. Cookies

This website sets no cookies and stores nothing on your device, which is why it shows no cookie banner. The only exception is its administration pages, which only the people who run the website use.

5. How long we keep it

• Notes of addresses that probed for attack pages, and blocks: deleted 30 days after the last such request, and the block list entry at Cloudflare after at most 30 days (section 2.2)
• Failed sign-in attempts at the administration pages: deleted within a day after their one-hour lockout (section 2.2)
• Email you send us: for as long as we need it to help you and to follow up
• Records of past purchases: seven years from the end of the financial year of the purchase (section 2.4)
• The old account database: until we close it (section 2.4)
• Backup copies of our database: deleted within seven days

6. Your rights

Under the GDPR you have the right to ask what personal data we hold about you and to get a copy, to have it corrected, to have it deleted, to have its use restricted, and to object to processing we base on our legitimate interests. Where it applies, you also have the right to receive your data in a structured, machine readable format.

To use any of these rights, write to [email protected]. We may need to confirm who you are before we act, and we answer within one month.

If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se), or to the data protection authority where you live or work.

We make no decision about you by automated means.

7. Security

We protect the data we hold against loss and misuse. If a breach of personal data puts your rights at risk, we tell the supervisory authority, and you where the law requires it.

8. Children

The website is not meant for anyone under 18, and we do not knowingly process personal data of children.

9. Changes to this policy

When we change this policy, we publish the new version on this page with a new date at the top.

10. Contact

For any question about this policy or about your data, write to [email protected].