Privacy notice
Version: beta, 30 October 2026. This notice is written in plain language for the beta. It will be reviewed by counsel before any paid plan is offered.
Who we are and our roles
Artefactor at app.artefactor.cloud is run by Hidden Value AB (org. no. 559580-9608),
Sävedalen, Sweden ("we", "us").
We process personal data in two roles:
- Processor for the content and member data an organisation puts into Artefactor: its artefacts, artefact data, comments and the list of its members. The organisation is the controller and decides why that data is processed; we process it on its behalf, under our terms and, on request, a data processing agreement.
- Controller for the data we need to run accounts and keep the service secure: your account, your sign-in and session records, security logs, and your organisation's paid-plan records.
What we process and why
| Data | Why | Lawful basis |
|---|---|---|
| Your account: name, email address, and your profile picture when you sign in with Google | To create your account, sign you in and show who you are | Contract |
| Sign-in and session records, with IP address and browser | To keep your account and the service secure | Legitimate interest |
| Organisation membership and role | To give you access to your organisation's artefacts | Contract |
| Artefacts, artefact data and comments | Content you upload. It may contain personal data, which we don't inspect; we process it for your organisation | For the organisation (processor) |
| View records: who opened an artefact, and when | Shown to the artefact's owner | Contract |
| Transactional email: the recipient's address and the message | To send sign-in links and invitations | Contract |
| Your organisation's paid plan: plan, subscription status and Paddle's customer and subscription references | To run the plan | Contract; legal obligation for accounting records |
We don't sell personal data, and we don't use it for advertising or profiling.
Signing in with Google
When you sign in with Google, we receive your name, email address and profile picture, and use them only to sign you in and show who you are inside Artefactor. We request no other Google data, and we don't access your Gmail, Drive, contacts or calendar.
Artefactor's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Google is an independent controller for its own processing when you use your Google account; its privacy policy applies to that.
Cookies
Artefactor sets only strictly necessary cookies: the session cookie that keeps you signed in, plus short-lived cookies used while signing in and to remember that you unlocked a password-protected link. There are no analytics, advertising or tracking cookies, so there is no consent banner.
Sub-processors
These companies process personal data for us. Each acts only on our instructions, under a data processing agreement, except for the payment data Paddle collects itself (below the table).
| Sub-processor | Purpose | Personal data | Location |
|---|---|---|---|
| UpCloud Oy | Servers, managed Postgres database and backups | All customer data | Finland; data stored in Stockholm, Sweden (se-sto1); backups in Helsinki, Finland |
| Lettermint | Transactional email (sign-in links, invitations) | Recipient address and message | Netherlands |
| AppSignal B.V. | Error and performance monitoring, configured to receive no personal data except the browser and device type each request reports | Browser and device type (user agent); no IP addresses, account details or request contents | Netherlands; hosted in the EU |
| Paddle.com Market Limited | Checkout, payments and invoicing for paid plans | Our organisation id | United Kingdom |
Paddle is the reseller of our paid plans. Paddle is an independent controller of the payment data it collects directly from the buyer at checkout (name, email, billing address and payment details) and processes it under its own privacy notice; we receive only what we need to run your organisation's plan. Paddle processes data only once paid plans are offered, which we tell organisation owners by email at least 60 days ahead.
We announce changes to this list to organisation owners by email 30 days before they apply.
Where your data lives
All customer data is stored in the EU, on UpCloud's servers in Stockholm, with a nightly backup copy in UpCloud's Helsinki region. We don't transfer personal data outside the European Economic Area, with one exception: when someone buys a paid plan, Paddle handles the checkout from the United Kingdom, which the EU recognises as protecting personal data adequately (an adequacy decision). Paddle's own transfers are described in its privacy notice.
How long we keep it
- Account data: until your account is deleted.
- Sign-in and session records: while your account exists; they are deleted with it.
- An organisation's data (its artefacts, artefact data, comments, members and view records): deleted within 30 days after the organisation leaves.
- Paid-plan records: while the organisation exists; accounting records for 7 years, as Swedish bookkeeping law requires.
- Server logs: up to 30 days. AppSignal keeps its monitoring data, which holds no personal data except each request's browser and device type, for 5 days.
- Backups: server backups are kept for 7 days, the database service's own backups for up to 4 days, and our nightly off-site copies of the database and stored files for 30 days. Deleted data disappears from them as they age out, within 30 days.
Your rights
You have the right to access, correct and erase your personal data, to restrict or object to its processing, and to receive it in a portable format. Email us at the contact address below.
For personal data inside an organisation's content, the organisation is the controller: we pass your request to it and help it answer.
You also have the right to complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se.
Changes to this notice
We announce material changes to organisation owners by email 30 days before they apply, and update the version date above.
Contact
Hidden Value AB, Sävedalen, Sweden — privacy@hiddenvalue.se, for privacy questions and data-subject requests.