Privacy policy

Styrén Consultants AB (reg. no. 559095-7675), Gothenburg, Sweden, is the controller for personal data processed on the website styren.se and for the data we process about our customers and their users as our customers.

If you have questions about how we process personal data, or want to exercise your rights, contact us at roger@styren.se.

• Demo and quotation requests: name, company, e-mail address, phone number, preferred time and your message.
• Web forms our customers publish on their own websites: the details the form asks for, usually name, e-mail, phone and company. These are received on the customer's behalf (see Customer data in Project Control).
• Visitor statistics: which page was visited, which website the visit came from, approximate country, region and city, and device type. We use no cookies for the statistics. Your IP address and browser are turned into an anonymous code with a random key that changes every day; the IP address itself is never stored. If your browser sends Do Not Track or Global Privacy Control, the visit is not counted at all.
• Signing in to Project Control: e-mail address, name, time of sign-in and sign-out, and last activity. The session is kept in the browser's local storage so that you stay signed in; it is needed for the service to work.
• Customer data in Project Control: the data the customer company's users enter themselves, such as staff, timesheets, projects, contacts and documents.

For data a customer company enters in Project Control, the customer company is the controller and Styrén Consultants AB is the processor. We then process the data only on the customer's instructions and under the agreement with the customer, including the data processing agreement. To find out what is stored about you there, first contact your company or the company that entered the data.

• Answering requests and booking demos: legitimate interest in replying to those who contact us, and steps prior to entering into a possible contract.
• Delivering Project Control, managing accounts and providing support: performance of the contract with the customer company.
• Sign-in log and security: legitimate interest in protecting the service and detecting unauthorised access.
• Visitor statistics: legitimate interest in understanding how the website is used. The statistics cannot be linked to you as a person.
• Invoicing and bookkeeping: legal obligation under the Swedish Bookkeeping Act.

• Requests: until the matter is closed and then at most 24 months after the last contact, unless we enter into a contract.
• Visitor statistics: about 13 months. The daily keys are deleted continuously, so the anonymous codes cannot be recreated.
• Account and sign-in log: as long as the customer agreement applies. When a customer company leaves, its data is deleted according to the agreement.
• Invoices and accounting records: seven years under the Bookkeeping Act.
• Backups: encrypted and deleted continuously, normally after 14 days.

We never sell personal data. We use the following suppliers (sub-processors) to run the service:

• Supabase: database, sign-in and file storage, in data centres in Stockholm.
• Vercel: hosting of the website and the visitor counter.
• Resend: sending e-mail, in an EU region.
• Google (Gemini): AI features such as reading receipts, invoices and contracts. Only the material sent to each AI feature is processed, and the paid service is used so that the content is not used to train Google's models.
• GitHub: running the encrypted backup.

Some of the suppliers are US companies. Where data may be transferred outside the EU/EEA, this is based on the EU adequacy decision (EU–US Data Privacy Framework) or the European Commission's standard contractual clauses.

Data is protected by encrypted transfer, strict separation between companies, role-based permissions, logging of permission changes and a nightly encrypted backup at a separate location.

You have the right to request access to your personal data, have incorrect data corrected, have data erased or processing restricted, object to processing based on legitimate interest, and receive data you provided in a machine-readable format (data portability). Contact roger@styren.se and we will reply within one month.

If you are unhappy with how we process your personal data, you can lodge a complaint with the Swedish Authority for Privacy Protection (IMY), www.imy.se. We appreciate it if you contact us first so that we can put it right.

We may update this policy when the service or the law changes. The date at the top shows when it was last changed.