Privacy notice

What SkaldVault stores about you, why, and what you can do about it.

Who is responsible

Thomas Stokke, Street, postcode and city, Norway, is responsible for the personal data in SkaldVault (the data controller). Questions and requests go to privacy@skaldvault.com.

What we store, and why

• Your email address, your name if you enter one, and your password. Needed to create your account and sign you in. The password is stored scrambled (hashed), so nobody can read it. Legal basis: the agreement with you about using the service (GDPR article 6(1)(b)).
• Two-factor details, if you turn it on. A secret shared with your authenticator app, and scrambled recovery codes. Used only to protect your account. Legal basis: the same agreement.
• Sign-in records. When you signed in, the IP address of your sessions, and a log of sign-ins, password changes and similar events. Used to keep accounts secure and to stop abuse, such as password guessing. Legal basis: our legitimate interest in a secure service (article 6(1)(f)).
• What administrators do. When an administrator changes a role, resets two-factor or deletes an account, that is written down. Legal basis: the same legitimate interest.
• Payments. When you pay, you type your card details on our payment provider's page. They never reach us. We store the provider's reference to the payment, so we can match it to what you bought and pay it back. Legal basis: the agreement with you, and the bookkeeping law.
• Licenses you have bought: the key, when it was paid, the price, and a name for each machine it is active on as the app reports it. So the app can check that your key is valid, and so you can see and free the machines it is used on.
• What you add in the app. Stored to give you the service. Legal basis: the agreement with you.

We do not sell your data, use it for advertising, or make automated decisions about you.

Cookies

We only use the cookies needed to sign you in and keep you signed in. There are no cookies for statistics, advertising or tracking, which is why you are not asked for consent.

If you press the switch between light and dark colours, a cookie remembers which you chose, for a year. It holds that one word, and is only set when you press the switch.

Who handles the data for us

We use suppliers (data processors) who may only handle the data on our instructions, under a data processing agreement:

• Supabase, for the database and for signing you in. The data is stored in the EU (Stockholm, Sweden).
• Vercel, for running the website.
• An email provider, for the emails that confirm your address or reset your password.
• Stripe, for taking payments. Stripe also uses payment data for its own purposes, such as stopping fraud, and is responsible for that itself.
• Resend, for the emails the site sends you itself, such as confirmations. The emails are sent from its servers in the EU (Ireland). Resend keeps a record of each email, with your address and what the email said, in the USA for about 30 days.
• Stripe, for taking payments. Card details never reach this site.

Like every website, these suppliers keep technical logs of requests, including IP addresses, for a short time to run and protect the service. Some of them are based in the USA. Where personal data is transferred outside the EEA, it is protected by the European Commission’s standard contractual clauses or an adequacy decision.

How long we keep it

• Your account and what belongs to it: for as long as you have the account. When you delete it, the data is removed from the service at once, and disappears from backup copies as they are overwritten.
• An account that is never finished (the email address not confirmed, or no password chosen): 7 days.
• The log of sign-ins and similar events: 90 days.
• A session, with its IP address: until you sign out, or 90 days after it was last used.
• The record of what administrators do: 1 year.
• A paid license is kept as long as the key is in use, and as a sales record afterwards.
• A purchase that was never paid is removed after 30 days.

Your rights

• See and take a copy of your data. Signed in, go to Account and choose “Download a copy of your data”.
• Have it corrected. You change your name and email address yourself under Account.
• Have it deleted. Signed in, go to Account and choose “Delete account”, or ask us.
• Object to or restrict our use of it. Write to privacy@skaldvault.com. We answer within one month.
• Complain. If you think we handle your data wrongly, you can complain to Datatilsynet.