Legal
Privacy policy
Effective 20 October 2026
Summary
- Our website uses no cookies, analytics or trackers. The free project scorecard runs entirely in your browser; your answers are never sent to us.
- The Taktstone Claude Code plugin runs on your computer under your own Claude account. We do not receive your projects, prompts or files.
- If your organisation uses our hosted workbench (https://app.taktstone.com), we store only what is needed to sign you in and keep your team's projects: your email, name and role, short-lived hashed sign-in codes, a session cookie, and a security audit log.
- We do not sell personal information and do not use it for advertising.
1. Who we are
Scandic Cloud Solutions AS (organisation number 918 786 791, VAT NO 918 786 791 MVA), Oslo, Norway ("Taktstone", "we", "us") is the data controller for the personal data described in sections 3.1–3.3 and 3.5. Contact: privacy@taktstone.com.
For project content that customers store in the hosted workbench (section 3.4), the customer organisation is the controller and we act as its processor under our terms and, where required, a data processing agreement.
2. Where data is stored
The hosted workbench runs on servers operated by OVHcloud in Canada (OVHcloud, Beauharnois, Québec). The European Commission has recognised Canada as providing an adequate level of data protection for commercial organisations, so data from the EU/EEA (including Norway) may be stored there without additional transfer safeguards. Organisations may request a dedicated instance in another region.
3. What we collect and why
3.1 Website visitors (https://taktstone.com)
We do not set cookies or run analytics. Our hosting provider (Vercel or Cloudflare) processes technical data such as IP address and browser type in server logs to deliver the site and protect it from abuse. Legal basis: our legitimate interest in operating a secure website (GDPR Art. 6(1)(f)).
3.2 When you contact us
If you email us (for example to book a demo, request a licence or join a partner programme), we use your name, email, company and message to respond and manage the relationship. Legal basis: steps prior to a contract or our legitimate interest in replying (Art. 6(1)(b)/(f)). We keep this correspondence for up to 3 years after our last contact unless a longer period is required by law (e.g. accounting records).
3.3 Hosted workbench accounts
| Data | Purpose | Retention |
|---|---|---|
| Email address, name, organisation membership and role, date added, last sign-in | Account and access control | Until your administrator removes you |
| One-time sign-in codes (stored only as a salted hash) | Passwordless sign-in | Deleted on use, after 10 minutes, or after 5 failed attempts |
| Session cookie (strictly necessary) and the session's IP address and browser type | Keep you signed in; detect misuse | 12 hours, or until you sign out |
| Audit log: sign-ins, failed attempts, saves, approvals, user changes, with email and IP address | Security, accountability and tollgate sign-off evidence | Up to 2 years |
Legal basis: performance of the contract with your organisation and our legitimate interest in securing the service (Art. 6(1)(b)/(f)). The session cookie is strictly necessary and does not require consent.
3.4 Project content in the hosted workbench
Your organisation decides what it stores (for example process data, team member names, approvals). We process it only to provide the service: storing it, keeping version history and backups, and showing it to your authorised users. Private notes a user writes under "My notes" are stored separately for that user and are not shown to other members. Approvals (tollgate sign-offs) are recorded with the approver's email and date and cannot be edited afterwards. Deleted projects and previous versions are kept in backups for up to 30 days and nightly server backups for 14 days, plus our provider's automated backups.
3.5 Purchases
When you buy a licence, our payment provider (merchant of record) processes your payment and billing details as an independent controller under its own privacy policy. We receive your name, email, company, country and order details to deliver and support your licence, and keep invoices as required by Norwegian accounting law (currently 5 years).
3.6 The Claude Code plugin
The plugin's skills, agents and workbench run on your device. Content you ask Claude to read or produce is processed by Anthropic under your own Claude plan and Anthropic's terms, not by us. The plugin contacts our servers only if you configure it to sync with a hosted workbench (using an API token you create).
4. Service providers (sub-processors)
| Provider | Purpose | Location |
|---|---|---|
| OVHcloud | Hosting the workbench and its backups | Canada (OVHcloud, Beauharnois, Québec) |
| Resend | Sending sign-in code emails (your email address and the code) | United States — transfers under the EU Standard Contractual Clauses or another lawful mechanism |
| Vercel or Cloudflare | Hosting the public website | Global edge network |
| Payment provider (merchant of record) | Checkout, invoicing and tax | As stated in its own policy |
We will update this list before adding a provider that processes customer data.
5. Security
HTTPS everywhere; sign-in codes, session tokens and API tokens are stored only as cryptographic hashes; rate limiting and lock-outs on sign-in; each customer organisation's projects, members and audit log are stored and served separately, and every request is checked against the signed-in user's organisation; our platform staff manage organisations but do not open your projects unless you invite them; role-based access (admin, editor, viewer); strict browser security policies; encrypted transport to our email provider; access to servers restricted to authorised personnel using SSH keys.
6. Your rights
Under the GDPR (as applied in Norway and the EU/EEA) you can ask for access to, correction or deletion of your personal data, restriction of or objection to processing, and a portable copy. For data in your organisation's hosted workbench, please contact your organisation's administrator first; we will assist them. Email privacy@taktstone.com; we respond within one month. You may also complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) or your local authority.
US residents: we do not sell or share personal information for cross-context behavioural advertising. You may request access to or deletion of your personal information at the address above.
7. Children
Taktstone is a business tool and is not intended for children under 16.
8. Changes
We will post updates here and change the effective date. For material changes affecting hosted-workbench customers we will notify account administrators by email in advance.