Privacy notice

Kantaja is operated by Axel Adlercreutz, who is the data controller for the personal data described here.

What we collect and why

• Account data: email address and login credentials, or your Google account identity if you sign in with Google. Used to create and secure your account. Legal basis: performance of the contract.
• Workbook content and attached files: the spreadsheets you save to the cloud and files you attach to a workbook's knowledge base. Used to provide the service: storing, syncing, and answering AI requests grounded in your data. Legal basis: performance of the contract.
• AI prompts and outputs: messages to the assistant, formula prompts, and =AI() inputs, together with the model responses. Used to run the AI features and cache results. Legal basis: performance of the contract.
• Usage data: AI credit usage, token counts, model names, and timestamps. Used for billing, budget enforcement, abuse prevention, and product improvement. Legal basis: performance of the contract and legitimate interests.
• Technical data: IP address and device information in server logs. Used for security and fraud prevention. Legal basis: legitimate interests.

Who we share data with

• Service providers: hosting, database and storage providers that run the service, and AI model providers that process your prompts and the workbook data you reference in order to generate responses.
• Observability tooling: receives usage metrics such as token counts and costs for AI calls; it does not receive your file contents.
• Paddle: our Merchant of Record, for the sale of subscriptions, payment processing, subscription management, tax compliance and invoicing.
• Professional advisers and authorities: legal or accounting advisers where needed, and public authorities where the law requires it.

Some providers process data outside the EU/EEA. Where that happens, transfers rely on safeguards such as the European Commission's standard contractual clauses or adequacy decisions.

Retention

Account data and workbook content are kept while your account exists and deleted or anonymized when no longer needed after you delete your account. Cached =AI() results expire automatically after about 60 days. Usage records are kept as long as needed for billing and legal obligations.

Your rights

Under the GDPR you can request access, rectification, erasure, restriction of processing, data portability, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it at any time. We respond within one month. You also have the right to complain to a supervisory authority; in Sweden that is the Swedish Authority for Privacy Protection (IMY).

Security

Data is protected with appropriate technical and organizational measures, including encryption in transit, access controls, and per-user isolation of stored workbooks and files.

Cookies and local storage

Kantaja uses only essential browser storage: your login session and preferences such as the theme are kept in local storage so the app works. There are no analytics or marketing cookies.