Laster katalogen …
Laster katalogen …
Dette dokumentet er kun publisert på engelsk.
Last updated 12 October 2026 · Effective 15 October 2026
Stav.ai AS (org. no. 937 371 853), Bekkelagsterrassen 9D, 1177 Oslo, Norway, is the controller for the personal data described in this policy. Contact us at support@stav.ai.
This policy covers our website, sign-up and application, workspaces, billing and communication. It does not cover the content of requests that customers send through the Service. For that content, Stav acts as a processor on behalf of the customer under our Data Processing Agreement, and the customer's own privacy policy applies.
The Service is for people aged 18 or over. We do not knowingly collect personal data about children.
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Sign-up and application | Name, email, company, role, company size, intended use, compliance requirements, country, timeline, notes | Steps before a contract and legitimate interest in reviewing applications (Art. 6(1)(b) and (f)) | Deleted with the account |
| Running your account and workspace | Name, email, sign-in data (through Auth0), workspace membership, API key metadata | Contract (Art. 6(1)(b)) | As long as the account exists. We delete accounts that have had no activity for 12 months, after notice |
| Billing | Organisation name, name on invoice, address, country, VAT number, purchase history. Card details are handled by Stripe and not stored by us | Contract and legal obligation under the Norwegian Bookkeeping Act (Art. 6(1)(b) and (c)) | As long as the law requires |
| Request log | User or API key, time, model, Inference Provider, Provider Endpoint, compute country, policy applied, token counts, cost, outcome | Contract and legitimate interest in billing, security and audit evidence (Art. 6(1)(b) and (f)) | 90 days |
| Audit log | Who changed what in your workspace, when and from where | Legitimate interest in security and accountability (Art. 6(1)(f)) | 24 months |
| Support | Messages to support and our record of contact with you | Legitimate interest (Art. 6(1)(f)) | 3 years after the case is closed |
| Product news | Email address | Consent (Art. 6(1)(a)); withdraw at any time | Until you unsubscribe |
| Bot check at sign-up | Data Cloudflare Turnstile collects to tell people from bots | Legitimate interest in preventing abuse (Art. 6(1)(f)) | Set by Cloudflare |
| Cookie choice | A random consent id, your choices, a coarse browser type. Never your IP address | Legal obligation to record consent (Art. 6(1)(c)) | 12 months |
| Website analytics and browser error reports | Page views (Plausible) and browser errors (Sentry), only after you allow analytics | Consent (Art. 6(1)(a)) | See the Cookie Policy |
We do not make decisions about you by automated means with legal or similarly significant effects, and we do not sell personal data.
What you must give us. To open an account you must give your name and email address. To buy credits you must give the billing details listed above, because we need them for the contract and the Bookkeeping Act. Without them we cannot provide the Service. Everything else is optional.
The companies that process data for Stav are listed in one place, the sub-processor list at stav.ai/compliance#sub-processors: the platform vendors (hosting, storage, sign-in, payments, email, error reports, DNS and bot check, analytics) and every Inference Provider we route to, with where each processes. That list is the current one. This policy does not repeat it.
We may also disclose data to public authorities when Norwegian law requires it, and to advisers such as our auditor and lawyers.
Our own platform runs in Norway, in the EEA. Some of our platform vendors are US-owned: Auth0 (Okta, Inc.) for sign-in, Stripe, LLC for payments, Sentry (Functional Software Inc.) for error reports, and Cloudflare, Inc. for DNS and the bot check. They process account, payment and technical data under the EU-U.S. Data Privacy Framework, with Standard Contractual Clauses as a fallback. Your prompts reach a US-owned Inference Provider only when your workspace policy allows that provider. Such a provider processes under the Standard Contractual Clauses in its Data Processing Agreement. You can get a copy of the safeguards for any transfer by writing to us at the address in section 1.
You have the right to access, rectify and erase your personal data, to restrict or object to processing, to data portability, and to withdraw consent at any time. Write to support@stav.ai. We answer within one month.
Your right to object. Where we process your data on the basis of our legitimate interests (see the table in section 2), you can object at any time on grounds relating to your particular situation. We will then stop, unless we have compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend legal claims.
If your data is in content that a customer sent through the Service, contact that customer first. We will help them.
You can complain to the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no), or to the supervisory authority where you live.
Our platform, database and logs run on UpCloud in Stavanger, Norway. Data is encrypted in transit. Provider API keys are encrypted at rest. Captured prompt content is encrypted per object and stored at Jottacloud in Norway. Access is limited to the people who need it, and changes in a workspace are recorded in its audit log.
Every cookie and browser-storage key we set is listed, with its purpose, owner and lifetime, in the Cookie Policy at stav.ai/legal/cookies. Nothing outside the necessary category runs before you allow it in the cookie banner, and you can change your choice from the footer of every page.
We update this policy when our processing changes, and state the date of the current version at the top. Account holders are told about material changes by email.