Privacy Policy

Who is responsible for your data

The controller responsible for processing your personal data under the General Data Protection Regulation (GDPR) is:

You can reach us at hi@stegen.app.

What information we collect

We collect:

• Your name and email address when you create an account, either directly or via sign-in with Google or Microsoft
• Your profile picture (if you choose to add one)
• Content you create in the app, such as results, comments, images and team memberships
• Billing details for organizations with a paid plan (handled by our payment provider)
• Technical data that is needed to run the service securely, such as IP address, browser type and time of access
• Anonymous usage statistics to improve our service

Why we use your information and on what legal basis

• To provide Stegen: your account, competitions, rankings and achievements (Art. 6(1)(b) GDPR – performance of a contract)
• To automatically connect you with organizations that share your email domain (Art. 6(1)(b) GDPR)
• To handle subscriptions and invoicing (Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR – legal accounting obligations)
• To post results to Slack or Microsoft Teams when an organization has activated this (Art. 6(1)(b) GDPR)
• To understand how Stegen is used and improve it, using anonymous statistics (Art. 6(1)(f) GDPR – legitimate interest)
• To keep the service secure and prevent abuse (Art. 6(1)(f) GDPR – legitimate interest)

Who we share data with

We use carefully selected service providers who process data on our behalf under data processing agreements:

• Hosting and storage providers that run our servers, database and uploaded images
• Stripe, our payment provider, for paid subscriptions
• Google and Microsoft, if you choose to sign in with them
• Slack and Microsoft Teams, if your organization connects them
• Umami, a privacy-friendly analytics tool that works without cookies and does not store IP addresses

We don't sell or rent your personal information to anyone.

Transfers outside the EU

Some of our providers (for example Stripe, Google, Microsoft and Slack) may process data in the USA. Such transfers are based on the EU–U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.

Payment information

All payments are handled securely by our payment provider Stripe. We never see or store your card details.

How long we keep your data

• We keep your data for as long as you have an account. You can delete your account and all your data at any time in the app
• If you don't use the app for one year, we automatically delete your account and data
• Records that we must keep for accounting purposes are kept as long as Swedish law requires (currently seven years)
• Technical log data is only kept as long as needed for security and troubleshooting

Cookies

We only use cookies that are strictly necessary for the app to work: one to keep you signed in and one to remember your language. We don't use cookies for tracking or advertising, so no consent is needed.

Your rights

Under the GDPR you have the right to:

• Get access to the personal data we hold about you
• Have incorrect data corrected
• Have your data deleted
• Have the processing of your data restricted
• Receive your data in a structured, machine-readable format
• Object to processing that is based on our legitimate interest

To exercise your rights, contact us at hi@stegen.app.

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work. Our lead supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

Data security

We take reasonable steps to protect your information from unauthorized access, but no internet service is 100% secure.

Changes to this policy

We may update this privacy policy from time to time. We'll notify you of any significant changes.

Contact us

If you have questions about this privacy policy, contact us at hi@stegen.app.