Draft – this text has not been reviewed by a lawyer yet and does not apply until approved.

Privacy policy

Version 0.1 (draft) · applies from [date]

This policy explains how [Company AS], org. no. [000 000 000] ("we") processes personal data about the people who use Sats: users of the editor and contacts at our customers. For personal data inside the documents customers produce, the customer is the controller and we are its processor; see the data processing agreement (/dpa).

What we collect and why

Data	Purpose	Legal basis	Kept
Name, e-mail, password hash, language	Account and sign-in	Contract (GDPR art. 6(1)(b))	While the account exists
Workspace membership and role	Access control	Contract	While the membership exists
Session cookie, CSRF cookie	Keeping you signed in, security	Legitimate interest (art. 6(1)(f))	12 hours of inactivity
Invoice contact and address	Invoicing	Contract, legal obligation (art. 6(1)(c))	Accounting records 5 years (Bookkeeping Act)
Technical logs: request id, IP address, time, ids of workspace and template	Security, troubleshooting	Legitimate interest	30 days

We do not use tracking cookies, advertising networks or analytics that profile you. E-mails we send have no tracking pixels.

Only the sub-processors listed at /subprocessors (hosting in the EU, e-mail delivery), each bound by a data processing agreement. We do not sell personal data.

Transfers outside the EEA

Data is stored in the EU. Where a sub-processor may access data from outside the EEA, the transfer relies on the EU standard contractual clauses or the EU–US Data Privacy Framework.

Your rights

You may ask for access, correction, deletion, restriction, portability and object to processing based on legitimate interest. Write to [privacy@example.no]. You can also complain to the Norwegian Data Protection Authority (Datatilsynet).

Security

Passwords are stored as Argon2 hashes, API keys as salted hashes, all traffic is encrypted (TLS), and rendered documents and the data sent to render them are not stored.

Contact