Legal
Privacy policy
1. Controller
QVINTOS is the controller for account and identity data. Where the project content that you as a customer put into the service contains personal data, QVINTOS processes that personal data as a processor and you are the controller; that processing is governed by our data processing agreement (DPA). These roles concern the processing of personal data, not all technical data in the service.
2. What data we process
| Category | Examples | Purpose |
|---|---|---|
| Account | Name, email, password hash, role | Sign-in, access control |
| Project content | Uploaded documents, chat, comments, contacts | Providing the service to your organisation |
| Technical and security | IP address (temporarily, for abuse and sign-in protection), tool logs | Operations, security, abuse protection |
| Authentication log | Sign-in (successful or failed), sign-out, password, email or role change, accepted invitation, deleted account, data export - with user id, email, time and a truncated IP prefix (IPv4 /24, IPv6 /48; never the full IP address) | Security and traceability; visible to your organisation's administrators |
3. Legal basis
Contract (to deliver the service), legitimate interest (security and abuse protection) and consent (for example the waitlist). See our record of processing activities (RoPA) for details per processing activity.
4. Where data is stored and processed
All storage (database, files, search index, keys, backups) takes place in Microsoft Azure, region Sweden Central. We never sell your data, and it is never used to train AI models.
AI in QVINTOS (text, analysis, review, questions, document interpretation, meeting transcription) runs on Azure OpenAI and Azure AI services of the type Standard (processing in Sweden Central) or DataZoneStandard (processing within Microsoft's EU data zone, that is, within the EU). Microsoft's abuse monitoring is enabled, which is Microsoft's default setting: content flagged by Microsoft's automated systems may be reviewed by authorised Microsoft personnel located in the EEA, and is stored in the resource's Azure geography. Microsoft does not use the content to train models.
Optional creative image and video features in other modules (for example the image and film studio in QVINTOS Architecture: gpt-image-2, FLUX and Sora-2 via Azure) run on Microsoft's GlobalStandard deployments. For those, processing may take place in any Azure region, including outside the EU. These features are not part of QVINTOS Design, Coordinate or Assist and are only used if you start them yourself.
5. Sub-processors and recipients
Microsoft Azure (cloud, AI, and email via Azure Communication Services with data location Europe). The FLUX image models (Black Forest Labs) are reached only through Microsoft Azure AI Foundry, and only in the optional image features above. With social sign-in, name and email are exchanged with Google or Microsoft. Property look-ups (address, property boundaries, elevation and map data) are made against Lantmäteriet's open APIs in the modules that use them; the request contains property or location details, no account data. Payments are handled by Stripe. A complete list is in our supplier register (available on request). Your browser does not load scripts from third-party CDNs - everything, including the PDF viewer, is served from our own domain.
6. Retention
Account data is kept for as long as the account exists. Chat and logs are cleared automatically once a day according to our retention schedule: chat history and the authentication log 365 days, operational logs 180 days, abuse-protection counters 2 days. Project content is kept until you or your organisation delete it, or until the agreement ends.
7. Your rights
You have the right of access, rectification, erasure, data portability and to object. In the app you can export your own data (Account → Export) and delete your account. Your organisation's administrator can export a ZIP with the organisation's projects, document and model records, comments and issues, design and coordination runs, rule book, user list and sign-in log, together with the organisation's stored files. For other requests, contact us below. Deletion from the live environment happens immediately; backups rotate out within 30 days.
8. Security
Encryption in transit and at rest, strict tenant isolation (database row-level security), keyless secret handling, protection against password guessing at sign-in, revocable sessions and automated tests of the isolation in our delivery pipeline. Our information security management system is documented and designed after ISO/IEC 27001:2022 as a reference framework; QVINTOS is not certified against it.
9. Contact
Data protection questions: privacy@qvintos.com. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).