1. Who is responsible
The controller is Beornwic AB, company registration number 559602-9453, Sweden. Contact for data protection matters: hej@zkrinet.com.
2. What we store and for how long
| Data | Why | How long |
|---|---|---|
| The queue: email, language choice, time | To tell you when your spot opens | Until your spot has opened, or until you ask us to remove you |
| Guard against repeated sign-ups: a one-way hash of IP address and date | Stop automated sign-ups. The IP address itself is never stored. | 7 days |
| Account: email, name, account type (individual, association, company), organisation and VAT numbers, address, and the time you confirmed that you are at least 18 or authorised to represent the organisation | Login, alerts, receipts | For as long as the account exists. Billing records for 7 years under Swedish bookkeeping law. |
| Login log: time, event (e.g. logged in, code sent) and IP address | Detecting and stopping intrusions into your account | 30 days |
| Payment events: plan, amount, status. Never card numbers. | Subscription and bookkeeping | 7 years under Swedish bookkeeping law |
| Operational data about your projects: plan, storage level, status | Running the projects and sending alerts | For as long as the project exists |
| Questions to Zkrinet AI: the question, the answer and which pages the answer was based on. Never IP address. | See what is missing from our documentation and improve it | 30 days |
| Notices of illegal content: the reporter's name and email, addresses, reasoning, our decision | Handle the notice under the EU Digital Services Act and be able to show how it was handled | 3 years |
| Support tickets: the question, your email and our reply | Reply to you. Resolved questions may, without name or email, be added to our documentation. | Until you ask us to delete them |
Apart from the login log above, we do not log IP addresses in our own systems. We do not profile, sell data or show ads.
3. Where data is processed
- Our own servers in Sweden: your projects, their databases, files and snapshots.
| Provider | Country | What they do and see | Transfer basis |
|---|---|---|---|
| Supabase | EU, Stockholm (US company) | The queue, accounts and operational data | Standard contractual clauses |
| Cloudflare | USA, with nodes in the EU | Domain names and relaying of traffic to your projects. Sees visitors' IP addresses and the content of requests as they pass through Cloudflare's node. | EU–US Data Privacy Framework, standard contractual clauses as fallback |
| Hostup | Sweden | Network hub relaying our server's traffic to the internet. Sees encrypted tunnel traffic, no content. | Within the EU |
| Vercel | USA | Serves zkrinet.com and the status page. Sees visitors' IP addresses in its operational logs. | Standard contractual clauses |
| Stripe | Ireland and USA | Payments. Through Stripe Managed Payments, Stripe (Link) is the seller to you and handles VAT and receipts. Receives name, email, address, any VAT number and card details. The card number never reaches us. | EU–US Data Privacy Framework, standard contractual clauses as fallback |
| Anthropic | USA | AI tooling we use to develop and operate the service. During troubleshooting, data in our systems, such as your email or a project's name, may pass through the tool. | Standard contractual clauses |
| ImprovMX and Google Gmail | USA | Email to zkrinet.com addresses is forwarded via ImprovMX to a Gmail mailbox; alerts and receipts are sent the same way. | EU–US Data Privacy Framework (Google), standard contractual clauses (ImprovMX) |
For providers based in the USA we use the European Commission's standard contractual clauses and, where the provider is certified, the EU–US Data Privacy Framework. We use no providers or nodes in countries outside the EU that lack such protection.
4. Your projects
Data you store in your projects, such as data about your own users, we process only on your behalf, as a processor. This is governed by the data processing agreement, which is part of the terms. We do not look inside your projects, except when needed to solve an operational problem you asked for help with, or to handle a report of illegal content.
5. Legal basis
- The agreement with you: account, operation, alerts, payment. The queue counts here as a step you requested before entering an agreement.
- Legal obligation: Swedish bookkeeping law for payments and billing records.
- Legitimate interest: the guard against repeated sign-ups, which protects the service from abuse.
6. Your rights
You have the right to know what data we hold about you, to have it corrected or deleted, to receive it in a machine-readable format, to restrict processing, and to object to processing based on legitimate interest. Contact us at the address in section 1. We respond within one month.
If you are unhappy with how we handle your data you can complain to the Swedish Authority for Privacy Protection (IMY), imy.se, or to the data protection authority in your EU country.
7. Cookies and local storage
Zkrinet.com uses no cookies. Your browser stores your language choice (Swedish or English) in its local storage. If you log in to your account, the login is stored there too, so you don't have to log in on every visit; it is removed when you log out. None of it is used for tracking. Fonts are served from our own domain, so your IP address is not sent to any font service.
8. Security
Projects are encrypted at rest and isolated from each other. Traffic is encrypted in transit. If we discover an incident affecting your data we notify you by email without undue delay, at the latest within 24 hours of establishing it, and report it to IMY within 72 hours when the law requires.
9. Changes
If this policy changes in a way that affects you, you are notified by email. The current version and its date are always shown at the top of this page.