Privacy Policy

1. Who we are and scope

Yopass AB, Norrhällby Haga 39, 754 73 Uppsala, Sweden, company registration number 559603-4727 and VAT registration number SE559603472701, is the controller of personal data used to operate yopass.se, administer Business Licenses, handle billing, and provide support. Contact [email protected] with privacy questions or requests.

This policy does not cover personal data processed by customers in their self-hosted deployments. Each customer is responsible for that processing and its own privacy information. The public demo at share.yopass.se is a separate service; consult its privacy notice before using it.

2. Information we process

Business and billing information: company name, contact name and email, country, billing address, tax identification number, purchase and subscription records, and payment status. Information entered into our purchase form is sent to our licensing service before you proceed to Stripe Checkout. Stripe collects payment details; we do not receive or store your full payment card details.

License information: company name, contact email, subscription status, acceptance of terms, and license records. License keys include a company identifier and expiry date. Verification in your self-hosted deployment takes place locally.

Support correspondence: information you send when requesting help. Do not include secrets, credentials, or unnecessary personal data.

Technical information: IP address and request information processed by our hosting and licensing infrastructure to deliver requests, diagnose errors, and prevent abuse.

3. Purposes and legal bases

For license and support administration, we rely on our legitimate interest in supplying and supporting software for business customers and communicating with their representatives. Where you are personally a party to the contract, such as a sole trader, processing necessary to supply the license or take steps at your request is based on that contract.

Accounting and tax processing is based on our legal obligations. Security and abuse prevention rely on our legitimate interest in protecting our services and customers. Processing to establish, exercise, or defend legal claims relies on our legitimate interest in protecting our legal rights.

Contact and billing information requested for an order is needed to administer the purchase; without it we may be unable to supply a license. We do not use your data for decisions that produce legal or similarly significant effects based solely on automated processing.

4. Recipients and international transfers

Customer and subscription records are held in Stripe, with the records needed for accounting also kept in our bookkeeping records. Authorized people administering Yopass AB may access those records to manage licenses, billing, and support. Our licensing service receives the information submitted through the purchase form. Cloudflare hosts this website and processes technical request information to deliver and secure it. Support correspondence is processed when you contact us. Data may also be disclosed to accounting service providers, professional advisers, or authorities where needed for bookkeeping, legal obligations, or legal claims.

Stripe acts as our processor for some activities and as an independent controller for others, including its own fraud prevention and legal compliance. See Stripe's Privacy Policy and Cloudflare's Privacy Policy for their processing.

Providers may process personal data outside the European Economic Area. Such transfers require an applicable safeguard, such as an adequacy decision or the European Commission's standard contractual clauses and any necessary supplementary measures. Contact us for information about the safeguards applicable to your data or a copy of them.

5. Retention

We retain accounting records until the end of the seventh year after the calendar year in which the financial year ended, as required by Swedish accounting law. This does not require us to retain all support data for that period.

Other license and contact records are retained while needed to administer the customer relationship and any outstanding obligations or legal claims. Support correspondence is retained as needed to resolve the request and related claims. Technical logs are retained only as needed for security and troubleshooting. We delete or anonymize information when the relevant purpose no longer requires it. Providers acting as independent controllers set their own retention periods.

6. Cookies and analytics

We do not load Google Analytics or set analytics or advertising cookies on this website. Our infrastructure and Stripe's checkout may use technologies necessary to deliver or secure the service you request. Stripe provides its own information about technologies used on its hosted checkout. Any future use of non-essential cookies will require your prior consent, with a way to withdraw it.

7. Your rights

Under applicable data protection law, you may request access, correction, erasure, restriction, and, where applicable, portability of your personal data. You may object to processing based on legitimate interests. These rights are subject to legal conditions; for example, accounting obligations may prevent immediate deletion of invoice records. If processing is based on consent, you may withdraw it at any time without affecting earlier lawful processing.

Contact [email protected] to exercise your rights. You may complain to Integritetsskyddsmyndigheten (IMY), Sweden's supervisory authority, or another competent supervisory authority.

8. Changes and the company transition

We will update this notice when our processing changes and provide additional notice where required. A privacy notice explains processing; continued use of the website is not consent. Publishing this policy does not itself transfer existing customer contracts or records from Johan Haals to Yopass AB. A transfer of existing customer data requires an appropriate legal basis and information to the affected individuals. Records retained by the former business to meet its own legal obligations remain that business's responsibility.