Privacy notice

This notice explains what the OpenSteward licensing service (this site) stores about you, why, and for how long. The data controller is Falco Consulting AB, Sweden [legal review: confirm legal name, organization number and address].

What we store

• Your account: your email address, when you accepted the license terms (and which version), when you verified your address and when you last signed in.
• Your organization: its name and who its members and admins are.
• Licenses: each license's id, label, plan, features, limits and dates. A license contains your organization's name and the label you chose; it contains no email address or person's name.
• Technical contacts: extra email addresses an admin adds to receive license emails. A contact receives nothing until it confirms by clicking the link we send.
• Email delivery events: whether our emails to an address were delivered, bounced or reported as spam, so we stop writing to addresses that cannot receive mail.
• Security records: sign-in sessions, single-use sign-in links (stored only as a one-way hash) and an audit log of license and account actions (which account did what, never an email address).

Why

To provide the service you signed up for (the contract): issuing, renewing and delivering your licenses and telling the right people when a license needs attention. Security records are kept for our legitimate interest in protecting the service and your licenses.

How long

• Your account: until you delete it.
• Inactive accounts: after 24 months without a sign-in, and only when none of your organizations holds an active license, we email a warning and delete the account 30 days later unless you sign in.
• Sign-ups that were never confirmed: deleted after 7 days.
• Email delivery events: 90 days. Technical contacts: until an admin removes them or the organization is deleted; an unconfirmed contact is deleted 7 days after its confirmation link expired.
• Sign-in sessions: 30 days after their last use. Used or expired sign-in links and invitations: 7 days.

Who processes data for us

• Stripe handles billing as our data processor: the customer name, billing email, VAT ID and payment details. Stripe sends invoices and receipts. We have signed Stripe's data processing agreement [legal review: confirm the DPA is signed].
• Amazon Web Services hosts this service and its database in the EU (Stockholm, eu-north-1) and sends our emails (Amazon SES).

Deleting your data

You can download everything we store about your account, and delete your account, on your account page. Deleting your account also deletes organizations where you are the only member, with their contacts and license records. Their Stripe customer is deleted too, unless it has paid invoices: Swedish bookkeeping law requires us to keep those for 7 years. Licenses already issued contain no personal data and keep working until they expire.

Contact

Questions or requests about your data: support@opensteward.dev. You may also complain to the Swedish Authority for Privacy Protection (IMY).