Privacy
What we hold
The name and e-mail address of the people who sign in. The questionnaires you upload and the answers you write. The documents you add as evidence. An incident log, if you use the incident module. We do not store IP addresses — only a hash of them with a secret salt, used to limit abuse and nothing else.
Where it lives
In the EU. The database runs in eu-central-1 and the files sit beside it.
Who else sees it
- Cloudflare (US/EU) — runs the application itself.
- Supabase (EU) — database and file storage.
- Sendinblue SAS, 9-17 rue Salneuve, 75017 Paris (Brevo) — sends the e-mail.
- PostHog EU (Germany) — usage statistics, with no content from your answers.
Transfers outside the EEA rely on the European Commission's standard contractual clauses.
What we do not do
We do not pass your evidence to anyone. We do not send the content of your answers to a language model. We do not report incidents to an authority on your behalf — the module writes a draft and you send it yourself.
Deletion
You can delete the whole organisation from Settings. That removes the rows in the database and the files in storage. Take the export first if you want a copy.
Complaints
The supervisory authority is Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby — not the ICO.