Privacy Policy

1. Controller

Entrest AB, org. no. 559496-8892, Hermans Backe 19, 136 48 Handen, is the controller for the processing described here. You can reach us at support@entrest.se.

For personal data that a customer itself enters into its projects (for example names of the customer's own staff or subcontractors), the customer is the controller and Entrest the processor. That processing is governed by the customer's instructions and our data processing agreement, not by this policy.

2. What data we process

Depending on how you use Entrest, we process the following categories of data:

• Account data: name, e-mail address, password (stored only as a cryptographic hash), optional profile picture, language and settings, role in the company and the time at which the terms were accepted.
• Company data: company name, organisation number, number of licences, subscription status and billing details.
• Usage and log data: login and verification timestamps, IP address, browser type, technical error logs and which features are used — for security, troubleshooting and to understand how the service is used.
• Payment data: handled by Stripe. We receive payment status, amounts and the last digits of the card number but never store full card details.
• Support cases: the content of e-mails and other messages you send us, and the details we need to help you.
• Project content you choose to send to the AI assistant, to the extent it contains personal data.
• Data from contact and interest forms on the website: name, e-mail, phone, company and your message.

3. Purposes and legal bases

We process the data for the following purposes and on the following legal bases:

• Providing the service: creating and managing accounts, signing in, storing projects, sending verification and reset e-mails and service notices. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Billing and payment: managing subscriptions, receipts and bookkeeping. Legal basis: performance of a contract and legal obligation under the Swedish Bookkeeping Act (Art. 6(1)(b) and (c)).
• Security and abuse prevention: bot protection at signup, rate limiting, login logging and troubleshooting. Legal basis: legitimate interest in keeping the service secure (Art. 6(1)(f)).
• Improving the service: aggregated analysis of how features are used. Legal basis: legitimate interest (Art. 6(1)(f)).
• Communication during the trial and about the account: reminders that the trial is ending, information about important changes. Legal basis: legitimate interest and performance of a contract (Art. 6(1)(b) and (f)). You can unsubscribe from reminders at any time via the link in the e-mail.
• Marketing by e-mail: news and offers. Legal basis: consent (Art. 6(1)(a)), which you can withdraw at any time.
• Support and customer contact: answering questions and cases. Legal basis: legitimate interest or performance of a contract.
• The AI assistant: the project content you ask the assistant about is sent to our AI provider to generate answers. Legal basis: performance of a contract (Art. 6(1)(b)); for personal data in the customer's projects we act on the customer's instructions.

4. Retention

We keep personal data for as long as needed for the purpose and thereafter according to the following guidelines:

• Account data and project content: during the term and in read-only mode thereafter. Accounts with no login for 12 months are deleted after prior notice, see the terms of service.
• Billing and accounting records: seven (7) years after the end of the financial year, under the Swedish Bookkeeping Act.
• Technical and security logs: 12 months.
• Support cases: 24 months after the case was closed.
• Contact form data: 12 months from the last contact if no customer relationship arises.
• Marketing consent: until you withdraw it.

5. Sub-processors and recipients

We never sell personal data. We share data with the following providers who process it on our behalf under data processing agreements:

In addition, data may be disclosed to authorities where required by law, to auditors and legal advisers under confidentiality, and to an acquirer in the event of a transfer of the business.

6. Transfers outside the EU/EEA

Several of our providers have parent companies or servers in the USA, which means personal data may be transferred outside the EU/EEA. Such transfers rely on the European Commission's Standard Contractual Clauses (SCCs) supplemented by technical and organisational safeguards, or on recipients certified under the EU–US Data Privacy Framework. A copy of the safeguards can be requested via support@entrest.se.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we process about you,
• have inaccurate data rectified,
• have data erased when it is no longer needed or the processing lacks a legal basis,
• have processing restricted in certain cases,
• receive the data you have provided in a machine-readable format and transfer it to another party (data portability),
• object to processing based on legitimate interest, and always to direct marketing,
• withdraw a consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

Contact support@entrest.se to exercise your rights. We respond within one month. If you are unhappy with how we process your data, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, SE-104 20 Stockholm, imy@imy.se, www.imy.se.

8. Cookies and similar technologies

Entrest uses only essential cookies and a few cookie-free measurement techniques:

• Session cookie (login): an encrypted cookie that keeps you signed in. Necessary for the service and requires no consent.
• Language and interface settings: stored locally in your browser to remember choices you have made.
• Cloudflare Turnstile: runs on the signup page to tell humans from bots and may set a technical cookie during the check.
• Vercel Web Analytics and Speed Insights: collect aggregated statistics about page views and load times without cookies and without identifying individual visitors.
• Stripe: sets cookies on its own payment pages for fraud prevention when you complete a purchase.

We use no cookies for advertising or cross-site tracking. Should that change, we will update this policy and ask for consent first.

9. Security

All traffic is encrypted (TLS). Passwords are stored only as salted hashes. Access to production data is limited to a few people who need it, and data is isolated per customer in the application. We take regular backups. If you suspect a security incident, contact us immediately at support@entrest.se.

10. Changes to this policy

We may update this policy when the service or legislation changes. Material changes are communicated by e-mail to the account administrator or in the service. The current version and date are stated at the top of the page.

11. Contact

Entrest AB, org. no. 559496-8892, Hermans Backe 19, 136 48 Handen. Data protection enquiries: support@entrest.se.