Privacy Policy

1. Who We Are

Quaterio is operated by Triple Down AB, org. nr 559333-6091, VAT SE559333609101, Skeppargatan 55, 114 59 Stockholm, Sweden. We are the data controller for the personal data processed through our Service. You can reach us at our contact page or by email at hello@quaterio.com.

2. What We Collect

We collect the following categories of personal data:

• Account information: name, email address and authentication credentials when you create an account
• Billing information: payment details processed securely through Stripe. We never store or have access to your full card number
• Usage data: anonymized, cookieless analytics collected via our self hosted Umami instance (page views, feature usage, Core Web Vitals). This data cannot be used to identify individual users, so it runs on the legitimate interest legal basis without requiring Measurement consent
• Session recordings: a sampled subset of visits (around 25%) is recorded via rrweb, hosted on our self hosted Umami instance. Recordings capture page interactions (clicks, scroll, navigation) with text inputs and form fields masked by default. Recordings are retained for 30 days and used only to identify usability issues. Only collected if you grant Measurement consent
• Content: documents, templates and media you create or upload to the Service
• Technical data: IP address, browser type and device information for security, error tracking and performance purposes
• Contact and lead data: email address and selected preferences when you submit our contact form or sign up for guides

3. How We Use Your Data

We use your data to:

• Provide, maintain and improve the Service
• Process payments and manage subscriptions
• Send service updates, security notices and transactional emails
• Respond to support and contact requests
• Detect and prevent abuse, fraud and security incidents
• Comply with legal obligations

We do not use your data for advertising. We do not build advertising profiles. We do not sell your data.

4. Legal Basis (GDPR)

We process your data based on:

• Contract: processing necessary to provide the Service you signed up for
• Legitimate interest: improving the Service, preventing abuse and ensuring security
• Legal obligation: tax, accounting and regulatory requirements under Swedish and EU law
• Consent: optional communications such as product guides, which you can opt out of at any time

5. Data Sharing and Sub-processors

We do not sell your personal data. We share data only with service providers (sub-processors) who help us operate the Service:

We engage each sub-processor under a data processing agreement, and where data is transferred outside the EU we rely on Standard Contractual Clauses or an equivalent safeguard. What each provider receives, and a link to its own privacy policy, is listed on our sub-processors page.

6. AI Features

When you import a document you can ask us to format it with AI. If you do, the text of that document is sent to Google Gemini, which returns structured content. This is the only time your document content leaves our infrastructure for a purpose other than rendering it.

It is your choice every time. Skip AI formatting and nothing is sent, and we skip it automatically for files that are already structured. We do not use your documents to train any model, and we do not send them anywhere for that purpose.

7. International Data Transfers

Some of our sub-processors are based in the United States. Where personal data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place, including EU Standard Contractual Clauses and the sub-processor's own compliance certifications.

8. Data Retention

We retain your account data for as long as your account is active. After account deletion, we retain data for 30 days before permanent removal to allow for recovery. Billing records are retained for 7 years as required by Swedish accounting law. Anonymized analytics data is retained indefinitely as it cannot be linked to any individual. Session recordings are retained for 30 days, then automatically deleted.

9. Your Rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data (right to be forgotten)
• Port your data to another service in a machine readable format
• Object to or restrict certain processing
• Withdraw consent at any time for consent based processing

To exercise these rights, contact us at our contact page. We will respond within 30 days. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) at imy.se.

10. Cookies and Consent

We use a minimal set of essential cookies. We do not use advertising or tracking cookies. Cookieless analytics (page views, screen size, Core Web Vitals) runs on the legitimate interest legal basis and does not require consent. Optional session recording runs only after you grant Measurement consent through our consent banner. You can change or withdraw that consent at any time. See our Cookie Policy for details.

11. Security

We use industry standard security measures including encrypted data transmission (TLS), hashed credentials (bcrypt), hashed API tokens (SHA-256), role based access controls and row level security at the database layer. We conduct regular security reviews and promptly address vulnerabilities.

12. Children

The Service is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will delete it promptly.

13. Changes

We may update this policy from time to time. We will notify you of material changes via email or through the Service at least 30 days before they take effect. The “last updated” date at the top of this page reflects the most recent revision.

14. Contact

For privacy related questions or to exercise your rights, contact us at our contact page or by email at hello@quaterio.com.