Privacy policy

Acta is run by Aaen Studios, organisation number 932997932, Heimdals gate 16, 2821 Gjøvik, Norway. For your account and our site analytics, we are the data controller under the GDPR.

When you use Acta in a workspace that belongs to an organisation, that organisation decides what goes into it. For that content we act as its processor and follow its instructions. Enterprise customers can sign a data processing agreement with us.

“Contract” means we need it to give you the service you signed up for (GDPR article 6(1)(b)). “Legitimate interest” means we have a good reason that doesn’t override your rights (article 6(1)(f)), and you can object to it.

We built our own analytics instead of using an outside service, so the data never leaves the providers listed below. When you open a page, we record the page, the site that sent you, any campaign tags in the link, your country, and your device type, browser and system.

To count visitors without cookies, we combine your IP address and browser details with a random value that is replaced every day, and store only a scrambled result. We can’t turn that back into your IP address, and the same visitor looks different the next day. Your IP address itself is never stored.

We record nothing on our admin pages or the sign-in links themselves.

We set one kind of cookie: the sign-in cookie that keeps you logged in. It’s only set when you sign in, only on acta.aaenz.no, and you can’t use Acta’s account features without it. Because it’s strictly necessary, we don’t need to ask first, so there’s no cookie banner.

Your browser’s local storage holds a few choices on your own device: light or dark theme, how you’ve arranged a view, and the demo board. None of it is sent to us.

We never sell personal data. These providers process it on our behalf, under contracts with us:

Some of these companies are based in the United States. Where data leaves the EU and EEA, we rely on the EU Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework.

We’ll add new providers, such as one for sending email or for Enterprise billing, to this list before we start using them.

You can ask us to:

• See the personal data we have about you, and get a copy you can take elsewhere.
• Correct it. You can change your name yourself on your account page.
• Delete it. Deleting your account from the account page removes your account and profile straight away.
• Object to or limit how we use it.

Write to elliot@aaenz.no and we’ll answer within a month. If you think we’ve handled your data wrongly, you can complain to the Norwegian Data Protection Authority, Datatilsynet, or to the authority where you live.

Acta is a tool for work and isn’t meant for children under 13. We don’t knowingly collect their data.

When we change this policy we’ll update the date at the top. If a change matters for how we use your data, we’ll tell you by email or in Acta before it takes effect.

Questions about privacy go to elliot@aaenz.no, or by post to Aaen Studios, Heimdals gate 16, 2821 Gjøvik, Norway.