Privacy Notice

1 Who is responsible

Up Strategy Lab AB (org. nr 559172-7218), Nordhemsgatan 56, 413 09 Göteborg, Sweden, is the controller for the personal data described here. Contact us at privacy@upstrategylab.com.

For personal data inside documents you upload, we are your processor, not the controller: the Data Processing Agreement covers that, and this notice does not.

2 What we collect, and why

• Account details — name, email, password (stored only as a salted hash), plan — to run your account. Legal basis: the contract with you.
• Payment details — handled by Stripe; we see only the plan, amount and the last digits of a card. Legal basis: the contract.
• Access requests — the email and company you give us when you ask for access. Legal basis: our legitimate interest in replying to you.
• Replies and corrections you post on public readings, with your name. Legal basis: our legitimate interest in keeping the directory accurate and giving companies a voice.
• Server logs — IP address, time and page — kept for no more than 30 days, to keep the service secure. Legal basis: legitimate interest.

Public readings are made from companies’ published legal pages. Where those pages contain personal data — typically a name or email for contact — we store it as published, as part of the reading, on the basis of our legitimate interest in describing what a company publishes.

3 Cookies

We use two cookies, both strictly necessary, and nothing else: no analytics, no advertising, no tracking across sites.

• lg_session — keeps you signed in. Expires after 30 days or when you sign out.
• lg_in — tells our public pages that this browser has signed in, so they can show a link to your workspace. It contains no identifier. Same lifetime.

4 Who we share it with

Only the providers that run Paradraw for us, listed on the sub-processors page, under contracts that let them use the data only to provide their service to us. We do not sell personal data.

Some of them are in the United States. Where data leaves the EU/EEA we rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses.

5 How long we keep it

Account data is kept while your account is open, and deleted within 30 days of closing it — the same rule as in section 10 of the Terms. Bookkeeping records are kept for seven years, because Swedish law requires it.

6 Your rights

You can ask for a copy of your data, have it corrected or deleted, object to our use of it, or ask us to restrict it. Write to privacy@upstrategylab.com; we answer within one month.

You can also complain to the Swedish Authority for Privacy Protection (IMY), imy.se.

7 Changes

Changes to this notice follow section 15 of the Terms: at least 30 days’ notice by email for anything that affects you.