Privacy Policy

Last Updated: September 24, 2026

Introduction

Solidafy Labs AB ("Solidafy," "we," "us," or "our"), a Swedish limited company (org. nr: 559551-4331) based in Sundbyberg, Sweden, is committed to protecting your privacy and ensuring the security of your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Swedish law.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website (solidafy.com), use our portal (portal.solidafy.com), or engage with the Solidafy Intelligence Platform ("Services").

Data Controller

The data controller for the purposes of this Privacy Policy is:

  • Company: Solidafy Labs AB
  • Org. nr: 559551-4331
  • Address: Grönlingens väg 14, 174 62 Sundbyberg, Sweden
  • Email: privacy@solidafy.com

Information We Collect

Information You Provide

We collect information you voluntarily provide to us, including:

  • Contact information (name, email address, phone number)
  • Company information (company name, job title, company size, industry)
  • Account credentials (email and password for portal access)
  • Communication preferences and feedback
  • Information submitted through contact forms and sales inquiries

Automatically Collected Information

When you visit our website, we automatically collect:

  • IP address and approximate location
  • Browser type and version
  • Pages visited and time spent on pages
  • Referring website addresses
  • Device information and screen resolution

Customer Platform Data

When you use the Solidafy Intelligence Platform (e.g., DevAnalytics), we process data from your connected integrations (GitHub, Jira, Linear, CI/CD systems). This data is processed to provide the Service and is governed by our Data Processing Agreement. We act as a data processor for this data; you remain the data controller.

Legal Basis for Processing

We process your personal data based on the following legal grounds under Article 6 of GDPR:

  • Contract performance (Art. 6(1)(b)): Processing necessary to provide our Services, manage your account, and fulfill our contractual obligations.
  • Legitimate interests (Art. 6(1)(f)): Analytics, service improvement, fraud prevention, and direct marketing to existing customers.
  • Consent (Art. 6(1)(a)): Marketing communications and non-essential cookies. You may withdraw consent at any time.
  • Legal obligation (Art. 6(1)(c)): Compliance with Swedish and EU legal requirements, including tax and accounting obligations.

How We Use Your Information

  • Provide, maintain, and improve our Services
  • Create and manage your account
  • Respond to inquiries and provide customer support
  • Send service updates, technical notices, and security alerts
  • Communicate about products, features, and offerings (with your consent)
  • Analyze usage patterns to improve our website and Services
  • Detect, prevent, and address technical issues and security threats
  • Comply with legal obligations

Data Sharing

We do not sell your personal data. We may share your information with:

Sub-processors and Other Recipients

These are two different things, and we keep them separate because they carry different rights.

Sub-processors process personal data on behalf of our customers under our Data Processing Agreement: Scaleway SAS, OVHcloud SAS and TensorX Ltd. All are within the EU/EEA, and that includes AI model inference, which runs with zero data retention where AI capabilities are enabled. Changes to this list are notified in advance with a right to object. See our Sub-processor list for what each one does and where.

Other recipients are not sub-processors of platform data. They process limited personal data for which Solidafy is itself the controller, such as the name and email of a billing contact, or correspondence with a contact at a customer or prospect: Google Workspace (business email and documents), Linear (work planning and support requests), Wint (accounting and invoicing, EU), and Scaleway Transactional Email (product and verification email, EU).

We also use providers that receive none of the personal data this policy covers, such as source code hosting, endpoint management, credential management and internal network access. They are assessed and recorded in our internal supplier register under our Supplier Security Policy, and are not listed here because they process no personal data of platform users, billing contacts or prospects.

Every sub-processor listed above is bound by a data processing agreement. Customer platform data is stored and processed within the EU/EEA, including all AI inference, and no customer platform data is transferred outside the EU/EEA.

Legal Requirements

We may disclose information if required by Swedish or EU law, or in response to valid legal processes such as court orders.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice before your data is subject to a different privacy policy.

International Data Transfers

Customer platform data is processed entirely within the EU/EEA. For website and business operations data (e.g. business email or analytics tooling), where transfers outside the EU/EEA are necessary, we rely on:

  • EU adequacy decisions
  • Standard Contractual Clauses (SCCs) approved by the European Commission
  • Binding Corporate Rules where applicable

For details on international transfers by our sub-processors, see our Sub-processor list.

Data Security

  • Encryption of data in transit (TLS 1.2+) and at rest
  • Access controls and role-based authentication
  • Regular security assessments
  • Incident response procedures
  • Employee training on data protection

Data Retention

We retain personal data only as long as necessary for the purposes described in this policy. Account data is retained for the duration of the customer relationship plus 12 months. Marketing data is retained until consent is withdrawn. We delete or anonymize data when it is no longer needed.

Your Rights Under GDPR

As a data subject, you have the following rights:

  • Access (Art. 15): Request a copy of the personal data we hold about you.
  • Rectification (Art. 16): Request correction of inaccurate or incomplete data.
  • Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten").
  • Restriction (Art. 18): Request restriction of processing in certain circumstances.
  • Portability (Art. 20): Receive your data in a structured, machine-readable format.
  • Objection (Art. 21): Object to processing based on legitimate interests or direct marketing.
  • Withdraw consent: Where processing is based on consent, you may withdraw at any time.

To exercise any of these rights, contact us at privacy@solidafy.com. We will respond within 30 days.

Cookies

We use cookies and similar technologies:

  • Essential cookies: Required for website functionality.
  • Analytics cookies: Google Analytics (G-ZW6QEF34JL) to understand website usage.
  • Marketing cookies: Google Ads and Apollo.io for advertising measurement.

You can control cookies through your browser settings.

Supervisory Authority

If you believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with:

  • Integritetsskyddsmyndigheten (IMY)
  • Swedish Authority for Privacy Protection
  • Box 8114, 104 20 Stockholm, Sweden
  • imy@imy.se

Children's Privacy

Our Services are not directed to children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, contact us immediately.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users and posted on this page with an updated "Last Updated" date.

Contact Us