Privacy Policy

Account Information

Name, email address, username, profile information (authentication via passwordless methods: passkey, OAuth, or email verification)

Service Configuration Data

Application configurations, service instances, deployment settings, API tokens

Usage Data

Service usage metrics, resource consumption, access logs, analytics data (collected via Umami Analytics - privacy-focused, GDPR-compliant)

Support & Communication

Support tickets, chat logs, email correspondence (via Freescout)

Billing Information

Payment data processed by Stripe (we do not store credit card details directly)

AI Assistant and MCP Server Data

Records of tool calls made through our MCP server, and the content of your conversations with the OSC assistant. See section 15.

Contract Performance: Processing necessary to provide services you have requested

Consent: For marketing communications and optional analytics

Legitimate Interests: Fraud prevention, security, service improvement, and the operational audit logging of platform and MCP tool calls described in section 15

Legal Obligation: Compliance with tax, accounting, and regulatory requirements

Elastx

Purpose: Hosting, infrastructure, storage
Role: Data Processor
Data Residency: Sweden (EU/EEA)
Safeguards: EU/EEA-resident; no Chapter V transfer arises

Stripe

Purpose: Payment processing
Role: Independent Data Controller
Note: When you make a payment, Stripe processes your payment data under its own privacy policy and as an independent data controller. We do not receive or store your full payment details.
Safeguards: Standard Contractual Clauses (SCCs), PCI DSS Level 1 certified
Stripe Privacy Policy

GitHub

Purpose: OAuth authentication, repository integration
Role: Data Processor (for OAuth authentication); Independent Data Controller (for any data processed under GitHub's own terms)
Safeguards: Standard Contractual Clauses (SCCs)
GitHub Privacy Statement

Umami Analytics

Purpose: Privacy-focused website analytics
Role: Data Processor
Data Residency: Hosted on OSC platform (Stockholm, Sweden - EU)
Note: Umami does not use cookies, does not track individuals across sites, and does not collect personal data. Analytics data is anonymised by design.

Freescout

Purpose: Customer support ticket management
Role: Data Processor
Data Residency: Hosted on OSC platform (Stockholm, Sweden - EU)
Safeguards: GDPR-compliant Data Processing Agreement (DPA) in place

Sub-processors

A current list of our sub-processors, including each one's purpose, location and transfer safeguards, is published at www.osaas.io/subprocessors, which is the canonical version, and is also available on request by contacting privacy@eyevinn.se. We will notify enterprise customers of any intended changes to our sub-processors in accordance with their Data Processing Agreements.

International Transfers

Your personal data is primarily stored within the EU (Sweden). Some of the sub-processors we engage are located in the United States. Where personal data is transferred outside the EU/EEA, we rely on the European Commission's Standard Contractual Clauses (SCCs, Decision 2021/914) under Article 46 GDPR, including Module Three (processor-to-processor) for the AI features. This is the safeguard we rely on for Google and Apple (optional sign-in methods), for Anthropic and OpenAI (the AI features), and for GitHub. For Stripe, its Data Processing Agreement and Standard Contractual Clauses apply where applicable, as stated in the register. We do not rely on the EU-US Data Privacy Framework adequacy decision under Article 45 as the basis for any of these transfers, whether or not the recipient holds a Framework certification. Where a transfer impact assessment and supplementary measures also apply, that is stated for the recipient concerned at www.osaas.io/subprocessors, which remains the canonical statement of the safeguard we rely on for each. Separately from the Services, this public website and our documentation are published using a United States storage and content-delivery provider, which processes visitors' request metadata including IP addresses; for those transfers we rely on that provider's data processing addendum, which incorporates the European Commission's Standard Contractual Clauses and applies automatically under its service terms. A copy is available on request from privacy@eyevinn.se.

Right of Access (Article 15): Request a copy of your personal data

Right to Rectification (Article 16): Correct inaccurate data

Right to Erasure (Article 17): Request deletion of your data ("right to be forgotten")

Right to Data Portability (Article 20): Receive your data in a structured, machine-readable format

Right to Object (Article 21): Object to certain processing activities

Right to Restriction (Article 18): Request restriction of processing

Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

Active Accounts: Data retained while your account is active

Closed Accounts: Personal data deleted within 90 days of account closure, except security and audit records, which are kept as described under MCP Operational Audit Log below

Legal Requirements: Billing and transaction records retained for 7 years (Swedish accounting law)

Analytics: Anonymized usage statistics may be retained indefinitely

AI Assistant Conversations: Deleted automatically 7 days after the conversation is started

MCP Operational Audit Log: Retained for as long as it is needed to keep the platform secure, to investigate incidents and abuse, and for the establishment, exercise or defence of legal claims. Audit-log entries are exempt from the 90-day deletion window that applies to other personal data on account closure, because we rely on Article 17(3) GDPR (retention necessary for the establishment, exercise or defence of legal claims and for reasons of public interest in the area of security). The same event is also written to the service's standard output and collected by our platform logging infrastructure, where it is retained and deleted under our general logging practices

Strictly Necessary Cookies

These cookies are essential for the platform to function and cannot be switched off. No consent is required for these cookies.

Analytics (Umami)

We use Umami Analytics to understand how our platform is used. Umami is privacy-focused: it does not use cookies, does not track you across other websites, and does not collect personal data. Because no cookies or personal data are involved, your consent is not required for this analytics tool.

Your Cookie Choices

We currently use only the strictly necessary cookies listed above, together with our cookieless analytics (Umami). We do not place any non-essential, advertising, or cross-site tracking cookies, so no cookie consent banner is shown. Should we introduce non-essential cookies in the future, we will ask for your prior consent before placing them, in line with the Electronic Communications Act (LEK) and the EU ePrivacy Directive. You can review our cookie policy via the "Cookie Settings" link in the footer, and you can control or block cookies at any time through your browser settings.

Contact Us

For privacy-related inquiries, data subject requests, or security concerns:
Privacy contact: privacy@eyevinn.se
General inquiries: info@eyevinn.se
Address: Eyevinn Technology AB, Vasagatan 52, 111 20 Stockholm, Sweden

Data Protection Officer

Under GDPR Article 37, Eyevinn Technology AB is not required to appoint a Data Protection Officer given the nature and scale of our data processing activities. For all privacy-related inquiries, please contact us at privacy@eyevinn.se.

Lodge a Complaint with Supervisory Authority

If you believe we have violated your data protection rights, you have the right to lodge a complaint with:

Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten - IMY)
Website: www.imy.se
Email: imy@imy.se

Operational audit logging, which is always on

Every call made through our MCP server is written to an operational audit log. This happens on every call and it is not optional, because it is how we keep a shared platform secure, investigate incidents and abuse, and show what happened in an account. Each entry records the time of the call, your user and tenant identifiers, the tool that was called and the action and resource it addressed, whether the call succeeded, how long it took, and the operational context of that call. Operational context means the parameters you passed to the tool, such as the name of a service, application, bucket, domain or parameter store, and for a failed call the error text the tool returned. A small number of tools pass through text you wrote yourself, such as a question put to our architecture assistant or a description of a project you asked us to set up, and where you invite someone to your workspace the invitation email address is recorded. When your client first connects we also record which client software it is. This log is a record of the calls made to us rather than a record of your conversation: the conversation you have with your AI client is not sent to us for this purpose, so it is not what this log holds. What it does hold is the calls themselves, which means that where you yourself placed text in a tool parameter, that text is recorded, as described above. The entry is written to our database and the same entry is also written to the service's standard output, from where it is collected by our platform logging infrastructure.

Why we may do this (legal basis)

We rely on our legitimate interests under Article 6(1)(f) GDPR: keeping a multi-tenant platform secure, detecting and investigating abuse, diagnosing faults, and being able to establish what happened in an account. Recital 49 GDPR recognises processing that is strictly necessary and proportionate for network and information security as a legitimate interest. We have weighed that interest against your rights and reached the view that it does not override them: the log records administrative actions you deliberately took on your own account rather than the substance of your work, it is limited to what identifies the actor, the action and its outcome, access to it is restricted to platform administrators, and anyone using a cloud platform can reasonably expect their actions on it to be logged. We do not rely on your consent for this log, and we want to be plain about why: consent under the GDPR must be freely given and as easy to withdraw as it was to give, and a log that cannot be switched off could not honestly be described that way. Because we rely on legitimate interests, you have the right to object under Article 21 GDPR. We will stop unless we can demonstrate compelling legitimate grounds that override your interests, which for a security log will often be the case, and we will tell you which it is.

Your conversations with the assistant

When you use the OSC assistant, we store the conversation so that the assistant can follow the thread and so that you can return to it. The legal basis is Article 6(1)(b) GDPR, performance of the contract, because keeping the thread is how the feature works rather than something additional we do with it. You can switch conversation storage off for your tenant under AI Preferences on your profile page in the OSC dashboard, and if you do we do not store it at all. Retention is set out in section 8.

Consent to analysis is a separate and much narrower thing

We may ask whether we may analyse your conversations to improve the service. That is optional, it is off unless you actively opt in, its legal basis is your consent under Article 6(1)(a) GDPR, and you can withdraw it at any time. It governs one thing only: whether the content of your conversations may be used for that analysis. It does not govern the operational audit log described above, which runs whatever you answer. It does not govern whether your conversation is stored in the first place, which is the separate setting described in the paragraph above. These three are easy to confuse and they are genuinely different, so in short: the audit log is always on, conversation storage is on unless you turn it off, and analysis is off unless you turn it on.

Your rights in relation to these records

Your rights under section 5 apply here, with two practical points we would rather state than leave you to discover. If you ask us to erase your data, we will normally keep the operational audit log for as long as section 8 allows, because Article 17(3)(e) GDPR permits retention where it is necessary for the establishment, exercise or defence of legal claims, and a security log is exactly that. If you ask us to restrict processing, Article 18(2) GDPR allows us to continue storing the data while we stop using it for anything else, and that is what we will do. Conversation content is not subject to either point, because it is deleted automatically on the schedule in section 8 in any case.