How we look after your data

AterAvis HB (org. no. 969803-9691), Sweden, runs Belaywork and is the data controller for the personal data described here. Questions, requests and complaints go to privacy@belaywork.com, and we answer within a month. How the service itself works is in our Terms.

• No AI. Nothing you write or upload is read by an AI service or used to train one.
• No service reads your content. Notes, files and briefs are stored and shown to the people allowed to see them, never sent off to be analysed or converted.
• No ads, no selling or renting your data, and no profiles about you for anyone else.
• Nothing from another company loads in your browser: no trackers, analytics services, font services or embeds.
• No automated decisions about you: nothing in Belaywork decides anything about you on its own, and no profile of you is built.

What you and the people you work with add to a project is stored so you can work on it together (contract). Who sees it follows the project: its members, and, if the project is open to the space, the space's members, never its guests. A space's Owners and Admins don't see inside a private project unless they're in it.

• Projects, parts, tasks, comments, reviews and issues, with who did what and when, and your notifications in the Inbox.
• When you last opened each project, so the Overview can show what changed since. Only you see it.
• Notes are stored in our database as Markdown and shown without any raw HTML, so nothing in a note can run in someone's browser.
• Files are checked for malware with ClamAV on our own servers before anyone can open them, stored privately, and reached only through links that expire after 5 minutes. Previews are drawn in your browser; nothing goes to a conversion service.
• Sources and their citations are stored as you enter them.
• Links to Google Docs, Figma, GitHub and the like are stored as addresses. We never fetch them or connect to those services.
• A brief you paste or pick is read in your browser, not on our servers. It's kept as a note, or as the file you picked, in the project's library.
• Your calendar feed is a private link to your tasks, parts and deadlines. Anyone with the link can see them, so you can replace it or turn it off in Account at any time.
• If a space allows it, a project's Lead can make a read-only share link: a summary (the goal, the parts with their status and dates, the checkpoints and the Timeline) for someone without an account, for 7, 14 or 30 days. It never shows names, files, comments or the Library, and it isn't indexed by search engines. Only a fingerprint of the link is stored; the Lead sees how many times it was opened and when last. We don't store a visitor's IP address: to stop a link being opened thousands of times, we keep a keyed fingerprint of it for at most an hour (legitimate interest).
• If a project's Lead connects Discord, short messages go to that channel when a part moves, a review is asked for or a deadline is 48 hours away: the part's or task's title, its status and a link back, never anyone's name or a file's contents. Discord is a US service that gets those messages under its own terms; nothing goes there unless a Lead connects it. The webhook address is stored encrypted.

• We count events such as “a project was created from a kit”, “an invitation was accepted” or “a task was done”, to see whether Belaywork works and where people get stuck.
• Never content, titles, names or file contents. No third-party analytics, tracking cookies or fingerprinting.
• The events are kept in a separate part of our own database that the app can only add to.
• It's on by default, under our legitimate interest. Switch it off in Account and nothing more is recorded, and what was recorded about you before is deleted at once.
• Kept 13 months, then deleted. It's in your data download and deleted at once with your account.

Only these, in your language. No newsletters or marketing.

• Sign-in links, when you ask for one. Each works once, for 10 minutes.
• Invitations, sent to the address the person inviting you typed. The link works for 7 days. If you haven't got an account, we keep your address with the invitation until 30 days after it expires or is accepted, under our and the inviter's legitimate interest in letting them invite you; the email says who sends it and links here.
• The morning email, only when something needs you, at most once a day, on your working days and outside your quiet hours. Turn it off in Account, or with the one-click link in every morning email.
• A warning two weeks before an archived project is deleted, to its Lead, or to the space's Owners if it has none.

Everything is stored in the EU, with the providers below. Each works under its standard data processing agreement, handles data only on our instructions, and reads none of your content.

• Hostup (Sweden): the server that runs Belaywork, with its database, files and malware checks.
• Lettermint (the Netherlands): sends sign-in links, invitations, the morning email and retention warnings, so it handles your email address and the email's text.
• Hetzner (EU): keeps the encrypted backups, taken every 6 hours, in a second location. It can't read them, and keeps its own copies of them for a week.

Discord and your calendar app aren't our providers: they get something only when you or a Lead connect them, under their own terms.

• Your account: until you delete it.
• Archived projects: deleted after the period the space has set, 12 months unless its settings say otherwise. The Lead, or the space's Owners if there's no Lead, get an email two weeks before. Restoring the project stops it.
• What you or a Lead deletes goes at once. Backups that still hold it expire within 45 days. If we ever have to restore a backup, what was deleted after it is deleted again: for that we keep only the ids of deleted accounts, projects and spaces, for 60 days.
• Usage data: 13 months.
• Sessions, with their IP address, end 7 days after you last used them, or when you sign out, and are deleted within a day of ending.
• Sign-in counters (per IP address or email address, against guessing and spam): a day after the last attempt.
• Invitations: 30 days after they expire or are accepted.
• The server's access log (IP address, time and page of each request, never a link's secret): 14 days, under our legitimate interest in keeping Belaywork secure.
• The audit log of changes to spaces and projects (who did what): as long as the space exists, under our legitimate interest in showing what happened; your name goes from it with your account.
• The operator's access log (every look at account details, and why): 12 months, under our legitimate interest in keeping that access accountable.
• Addresses that bounced or complained, so we stop emailing them: 12 months for a bounce, 24 for a complaint, or until the account goes, under our legitimate interest in sending only wanted email.
• Emails waiting to be sent: their text is removed once they're sent or can't be; the record that one was sent is kept 30 days (90 if it failed).
• Feedback you send: until you delete your account, under our legitimate interest in improving Belaywork.
• When you delete your account, your profile, settings, memberships, notifications, feedback and usage data go at once. Files, sources and history you added stay in their projects, without your name. Spaces where you're the only member go with you.

• See and download your data: Account, then Download your data. One file with what's stored about you and what you've added, which another service can read too.
• Correct it: change your name, profile and settings in Account at any time.
• Delete it: Account, then Delete account.
• Withdraw consent: remove an optional field and we stop using it.
• Object or ask us to limit what we do: switch usage data off in Account, or write to privacy@belaywork.com about anything else.
• Complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se.

You need to be 13 or older to make an account. That is the age from which Swedish law lets you agree yourself to how an online service uses your personal data. If you're under 18, use Belaywork with a parent's or guardian's knowledge.

Only the cookies Belaywork needs, all our own. No analytics, advertising or third-party cookies, so there's nothing to accept.

• Your session (bw.session_token): keeps you signed in, for 7 days after you last used it.
• Sign-in confirmation (bw.signin_confirm): set when you open a sign-in link, so only our own “Sign in” button can use it. It lasts an hour.
• Language (NEXT_LOCALE): only when you pick a language on the website or in Account.
• Theme (theme): only when you pick light, dark or the system's.
• Views (plan_view, plan_board_group, library_view): how you last looked at a plan and a library, once you switch.
• Your browser also keeps a few things for what you asked for: unsaved drafts (sessionStorage), your recent searches and the offers you dismissed (localStorage), things you captured while offline (IndexedDB) and, in the app, its two font files (the service worker's cache). They stay on your device. What's yours is cleared when you sign out; the font files hold nothing about you.

• Encrypted connections, and every table in the database limited to the people allowed to see each row, enforced by the database itself.
• No passwords to leak: sign-in links work once and expire after 10 minutes.
• Uploads wait in quarantine until the malware check passes. Files are never public.
• Secrets such as Discord webhook addresses are stored encrypted.
• Strict rules on what the website may load, so nothing from another company runs on it.
• The operator can see account details and totals, never your content. Every access is logged and kept 12 months.

When we change how we handle your data, we update this page and the date at the top. If a change affects what we collect or why, we'll tell you in Belaywork before it applies.

Text is set in Inter and Inter Display by Rasmus Andersson and the Inter Project Authors, under the SIL Open Font License 1.1 (the licence), and served from our own server. Documents are shown with PDF.js (Mozilla, Apache License 2.0), docx-preview (Apache License 2.0) and JSZip (MIT). Every open-source package Belaywork is built on, with its licence: third-party licences.