Privacy Policy
How Styrra processes personal data, when we are controller and when processor, and what rights you have.
1. Who is responsible for what
Styrra AB, reg. no. [organisationsnummer], [adress, postnummer, ort], is the controller for data about users of Styrra (account, sign-in, billing, support and product usage) and for website visitors.
For data in the Customer's accounting system and documents (suppliers, customers, employees in payroll bookkeeping, invoices, receipts), the Customer is controller and Styrra is processor. We then process the data only on the Customer's instructions and under the Data Processing Agreement (DPA). Please contact the company whose data it concerns first.
Data protection questions: dataskydd@styrra.se.
2. What we process and why
- Account data: name, email, sign-in method, role and organization. Purpose: provide the service. Legal basis: contract (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f)) when the user acts for the Customer.
- Billing data via Stripe: contact person, address, payment history. Card data is stored by Stripe, not by us. Legal basis: contract and legal obligation (Bookkeeping Act).
- Usage and log data: IP address, device, timestamps, actions in the service, approvals and acknowledgements (audit log). Purpose: security, troubleshooting, evidence of what was approved, preventing abuse. Legal basis: legitimate interest and, for the audit log, contract.
- Acceptance of terms: version, time, user and technical metadata (IP address, browser). Purpose: to be able to show that the terms were accepted. Legal basis: legitimate interest.
- Support cases and communication with us. Legal basis: contract and legitimate interest.
- Customer Data processed as processor: see the DPA.
3. AI processing
To answer questions and prepare proposals, relevant excerpts of Customer Data (for example vouchers, invoice text and the question you ask) are sent to language models through our AI gateway. The model providers are sub-processors and may not use the data to train their models; we configure and contract for that.
We do not make decisions with legal effects on individuals solely by automated processing. Every proposal that changes the books is approved by a human at the Customer before it is executed.
Do not send data about health, union membership, criminal convictions or other special categories of personal data (Arts. 9 and 10), or national identity numbers, to Styrra unless necessary for the bookkeeping.
4. Recipients and sub-processors
We share data with the providers needed for the service, as listed in Annex 3 of the DPA: cloud infrastructure and database, hosting, payments, AI models via gateway, and the accounting systems the Customer itself connects. We do not sell personal data and do not use it for third-party advertising.
Authorities and others receive data only where the law requires.
5. Transfers outside the EU/EEA
Some sub-processors, in particular AI model providers and cloud services, may process data in the United States or another third country. Transfers rely on an adequacy decision (for example the EU–US Data Privacy Framework) or the European Commission's standard contractual clauses, supplemented by safeguards such as encryption and data minimization. A copy of the applicable safeguards can be requested by email.
6. How long we keep data
- Account and usage data: while the account exists and then at most 12 months, unless longer is required for legal claims.
- Billing records: seven years after the end of the financial year (Bookkeeping Act).
- Audit log and acceptance records: while the agreement runs and then up to ten years to defend legal claims. The log is immutable and so cannot be deleted in part; personal data in the log is limited to user ID and email address.
- Customer Data: deleted in accordance with the DPA, normally within 30 days after the export period ends.
7. Your rights
You have the right to request access to, rectification and erasure of your data, restriction of processing, to object to processing based on legitimate interest and to receive your data in a machine-readable format (portability). Contact dataskydd@styrra.se. We respond within one month. If the data concerns the Customer's accounting system we will refer you to the Customer.
You have the right to complain to the Swedish Authority for Privacy Protection (IMY), www.imy.se.
8. Security and incidents
We protect data with, among other things, encryption in transit and at rest, per-organization access control (row-level security), least privilege, an immutable audit log and regular vulnerability management. In a personal data breach we notify affected customers without undue delay. No service is perfectly secure and we cannot guarantee that incidents never occur.
10. Changes
We may update this policy. Material changes are announced in the service or by email. See the version date on the page.