Privacy Policy

1. Data Controller

Yonas Valentin Kristensen, Callisensvej 20, 2900 Hellerup, Denmark ("we", "us", "our") is the data controller responsible for your personal data under the EU General Data Protection Regulation (GDPR) and Danish Data Protection Act.

2. Personal Data We Collect

We collect and process the following categories of personal data:

• Account information: Clerk user ID, name, email address and profile image. Clerk manages sign-in credentials.
• Workspace content: Diagrams, documents, brainstorms, sprints, presentations and related membership information.
• Technical and activity data: Browser information, page visits and editing events. Application analytics records a hashed IP value rather than the raw address.
• Payments: This deployment does not collect payment card details or process subscription payments.
• Communication Data: Support messages, feedback, and correspondence

3. Legal Basis for Processing

We process your personal data based on:

• Contract Performance (GDPR Art. 6(1)(b)): To provide our services
• Consent (GDPR Art. 6(1)(a)): For marketing communications (you can withdraw anytime)
• Legitimate Interest (GDPR Art. 6(1)(f)): For analytics, security, and service improvement
• Legal Obligation (GDPR Art. 6(1)(c)): For tax and accounting requirements

4. Data Retention

Workspace and account data is retained to provide the service. Contact us to request access, correction or deletion. Backup copies may retain earlier data until those backups are replaced.

5. Data Sharing and Third Parties

Clerk provides authentication. Workspace content is stored in PostgreSQL on a self-hosted server controlled by the operator. Cloudflare provides HTTPS traffic routing. Analytics may use Umami when configured. We do not sell personal data.

6. Your Rights Under GDPR

You have the following rights:

• Right to Access (Art. 15): Request a copy of your data
• Right to Rectification (Art. 16): Correct inaccurate data
• Right to Erasure (Art. 17): Delete your data ('right to be forgotten')
• Right to Restriction (Art. 18): Limit how we use your data
• Right to Data Portability (Art. 20): Receive your data in a structured format
• Right to Object (Art. 21): Object to processing based on legitimate interest
• Right to Withdraw Consent: Unsubscribe from marketing anytime

7. Cookies and Tracking

Authentication uses session cookies and related browser storage. The application records activity events for usage statistics. Umami page analytics runs only when configured. Browser settings can restrict cookies, which may affect sign-in.

8. Data Security

The public service uses HTTPS. Authentication and workspace roles restrict access to stored content. Access to the self-hosted database and backups is controlled by the operator.

9. International Transfers

Workspace content is stored on the operator-controlled server. Authentication and traffic delivery involve Clerk and Cloudflare and may involve processing outside your country. Contact us for details about the configured providers.

10. Children's Privacy

Our service is not intended for children under 16. We do not knowingly collect data from children. If we discover this, we will delete it immediately.

11. Changes to This Policy

We may update this policy. Material changes will be notified via email 30 days before taking effect.

12. Complaints

You have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet): www.datatilsynet.dk, [email protected], +45 33 19 32 00.