Privacy policy

This is an English translation of our Swedish privacy policy (Integritetspolicy). If the two versions differ, the Swedish version prevails. This does not limit your rights under data protection law or as a consumer.

1. Who is responsible for your data?

The controller is:

NYTERIO AB
Swedish company registration number: 559596-9790
Email: privacy@nyterio.se
Website: nyterio.se

The service is aimed at organisations in the EU/EEA.

2. Overview: the services and their data regimes

We want you to know clearly what happens to your data depending on which part of NYTERIO you use.

3. Processkollen and the templates: what do we collect?

3.1 Uploaded flowcharts (the file)

When you upload a flowchart, the file is processed in the server's memory. If the file is larger than 1 MB, the web server buffers it during the upload itself through a temporary file on the server's disk. That file has no file name, is removed the moment it is created and can therefore not be opened by any other program, and the space is freed when the upload is complete, that is after a second or so. After that the file exists only in the server's memory. The file is sent to our AI provider Nordalster AB (Swedish company reg. no. 559279-8002) for processing. The provider processes the file in RAM/VRAM and stores no data after the session. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).

The file remains in the server's memory for no more than 30 minutes after the upload. The reason is that during that time you can ask to have your flow redrawn to the NYTERIO standard, which requires the original to still exist. The file is deleted the moment the redrawing is done, immediately if the file was not a flowchart, and at the latest when the 30 minutes have passed, whether or not you have asked for anything. It is never stored permanently by us and it is never included in any backup.

3.2 Analysis results (tied to the session)

The full analysis result (score, deviations, recommendations) is held in the server's memory for no more than 24 hours to allow PDF download and sharing through a unique UUID link. After 24 hours the result is deleted automatically and the report cannot be recreated. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).

3.3 Anonymous review statistics (permanent)

We store aggregated, anonymised statistics about each completed review in a local database. This includes: the score per standard, the type of diagram reviewed (BPMN 2.0 or Basic Flowchart) and a timestamp. These statistics store no data that can be linked to you as a person: no name, email address, IP address, file content or file name. The statistics record contains no ID that points to contact details under §3.4, and we do not combine or cross-reference the two. Legal basis: legitimate interests in improving and developing the service (GDPR Art. 6(1)(f)). In practice this data is not personal data, but it is documented here for transparency.

3.4 Contact details when you order the report

The score and the summary are shown directly on screen without you leaving any details. If you want the full report, you can ask us to email it. We then store your email address, name and any organisation, together with the report's score, process name and time, in a local database in Sweden.

The same details are also registered as a contact in our own customer register, so that we know who we have been in contact with and do not get in touch twice about the same thing. The register is a system we run ourselves, on a server at Hostup AB in Sweden, see the list of processors in §5. The details therefore never leave Sweden. If you have your details deleted, they are deleted in both places.

The details are used for two things: to send the report you asked for, and so that we can get in touch once afterwards to ask whether it was useful. We send no newsletters, run no automated email sequences and never sell or share the details. If you do not want to be contacted, it is enough to say so in your reply to the report email.

The details are stored separately from the NYTERIO app's database. Ordering a report creates no account, gives no login and does not link you to any organisation in the service. An account can only be created through an invitation under §4.1.

We keep the details for no more than 24 months from when you ordered the report, after which they are deleted. You can ask for earlier deletion at any time by emailing privacy@nyterio.se, and the request is carried out without us asking why.

Legal basis: steps taken at the request of the data subject (GDPR Art. 6(1)(b)) to send the report, and legitimate interests in following up an interest shown in the service (GDPR Art. 6(1)(f)) for the single follow-up message. You can object to the follow-up under §7.

3.5 Contact details when you download a template

On some of our article pages (in Swedish) you can download a template, for example the RACI matrix at nyterio.se/raci-matris-mall/. We then store your email address and, if you fill it in, your name, together with which template it was and the time, in the same local database in Sweden that §3.4 describes.

The details are used for two things: to email the template you asked for, and so that we can get in touch once afterwards to ask whether it was useful. We send no newsletters, run no automated email sequences and never sell or share the details. If you do not want to be contacted, it is enough to say so in your reply to the template email.

Downloading a template creates no account and does not link you to any organisation in the service. The template downloads directly in the browser, so you get the file even if the email does not arrive.

We keep the details for no more than 24 months from the download, after which they are deleted. You can ask for earlier deletion at any time by emailing privacy@nyterio.se, and the request is carried out without us asking why.

Legal basis: steps taken at the request of the data subject (GDPR Art. 6(1)(b)) to send the template, and legitimate interests in following up an interest shown in the service (GDPR Art. 6(1)(f)) for the single follow-up message. You can object to the follow-up under §7.

4. The NYTERIO app: what do we collect?

To deliver a process library that can be edited, shared and versioned over time, we need to store both your account and the library's content. The app's data is stored at Hostup AB in Sweden (PostgreSQL). Email and meeting bookings (§4.9, §4.13) are handled by Zoho, see §5.

4.1 User account

For logged-in users we store: email address, hashed password, role in the organisation, organisation membership. The account is created through an invitation from an organisation admin. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).

4.2 Uploaded documents and flowcharts

Library Builder. When an organisation admin uploads a ZIP file with documentation, it is unpacked on our server, and Nordalster AB analyses the content to propose a process hierarchy. Nordalster stores nothing after the analysis. The documents in the ZIP file are stored as part of the organisation's process library, at Hostup AB in Sweden, and linked to the processes they describe so that the procedure is shown next to the process. The ZIP file itself is deleted when the analysis is complete. The extracted process proposal (text, process names, roles, inputs and outputs) is also stored in the organisation's database.

Documents on a process. A document that a user uploads directly on a process is stored in the same way. A link to a document in your own system is stored only as a link; the document itself is never fetched here.

Uploaded flowcharts. When an existing flowchart is uploaded as an image or PDF to be redrawn, the original file is stored together with the redrawn chart, so that colleagues can compare with the original. The original is deleted when the chart is deleted.

Controlled documents. The procedures, instructions, policies and forms that your organisation controls in NYTERIO are stored with all their versions. For each version we store the file, who uploaded it, who reviewed and approved it and when, and what has changed. Comments made during review and periodic review are stored in the audit log, see §4.4. An approved version is never replaced. A change becomes a new version, and the previous one remains in the history. Documents that are already in NYTERIO, for example from Library Builder, can be brought into the register, and the same file is then used. If you bring in documents that were already approved in your previous system, we also store what you write about who approved them there and roughly when. Everyone with an account in the organisation can read and download the version in force. Only editors and administrators can see drafts and earlier versions.

Retention and deletion. Uploaded files are kept until the organisation's administrator deletes them, under Administration, Documents (Administration, Dokument in the Swedish app), or until the agreement ends. For Word and Excel files, a PDF copy for viewing is created on the server. It is deleted together with the original. A file that is a version of a controlled document cannot be deleted there; it follows the document. A controlled document that has never been approved or transferred from a previous system can be deleted by the administrator under Documents (Dokument) in the menu. A document that has been in force cannot be deleted in the app, only withdrawn, so that it is possible to show which version applied on a given date. If you want such a document deleted entirely, email privacy@nyterio.se. We then delete the document with all its versions and files and its links to the processes. You delete any copies of the same file that remain under Administration, Documents yourselves. The rows in the audit log remain, see §4.4. When the agreement ends, everything is deleted in accordance with the data processing agreement, together with the rest of the organisation's data. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).

Personal data in the documents: Names, job titles and work contact details of the people responsible may appear in controlled documents. Upload the template, not completed forms. No personnel files, CVs, private phone numbers, identity numbers (such as personal identity or National Insurance numbers) or health data. NYTERIO is designed for process documentation, not for personnel files or customer registers. For the content of the documents, the customer is the controller and NYTERIO AB the processor, in accordance with the data processing agreement.

4.3 Process library (snapshot)

The reviewed library, that is the process hierarchy, descriptions, roles and inputs and outputs, is stored permanently in the organisation's snapshot until it is edited or deleted. This is the working material that all of the app's functionality is built on. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).

4.4 Audit log

Every time a user finalises a library, or locks or unlocks the process map, the event is logged with a timestamp, user ID and action. The log is kept per organisation and is used for internal audit and ISO-related traceability. Legal basis: legitimate interests in being able to trace changes to process documentation (GDPR Art. 6(1)(f)).

For controlled documents every step is logged: when a document is created or brought in, gets a new version, is sent for review or sent back, is approved, is reviewed periodically, has its details changed, is withdrawn, reinstated or deleted. The row holds the time, who did it, the document's number and what was written in that step, for example the file name, what has changed, a comment or a reason, the reviewer's and the owner's email addresses and, for transferred documents, who approved them in the previous system. When a document is deleted on request, these rows remain, and one more row shows that the document was deleted. They are deleted with the rest of the organisation's data when the agreement ends.

4.5 Transactional emails

When an analysis completes or fails, an automatic email is sent to the user who started the job. For controlled documents, an email goes to the person who is to review a version, and to the person who submitted the version when it is sent back or approved by someone else. The owner gets a reminder when it is time to review the document. If the review is overdue, the document has no owner or the owner's account is disabled, the reminder also goes to the organisation's administrators. The email contains the document's number and title, who it is from and, when a version is sent back, the reviewer's comment. No emails are sent if your organisation has turned emails off, and each person can turn off their own. Email is handled by Zoho Corporation (Amsterdam, EU). Legal basis: performance of a contract (GDPR Art. 6(1)(b)).

4.6 Billing details

The organisation's billing details (company name, company registration number, billing address and contact person) are registered so that we can invoice for the service. The app is paid for against invoice, and we do not handle card details; NYTERIO Pocket is paid for by card at Stripe, see §4.10. Legal basis: performance of a contract (GDPR Art. 6(1)(b)). Invoices and other accounting records are kept until the end of the seventh year after the end of the calendar year in which the financial year ended, as required by the Swedish Bookkeeping Act. For that storage the legal basis is a legal obligation (GDPR Art. 6(1)(c)).

4.7 Technical logs

The web server (Nginx) generates standard access logs containing the IP address, a timestamp and the requested URL. These logs are rotated automatically. Logs from the application may contain user IDs and organisation IDs to make troubleshooting possible, but never document content or file names. Legal basis: legitimate interests (operational reliability and security monitoring, GDPR Art. 6(1)(f)).

4.8 Account invitations (email address)

To give an organisation access to the NYTERIO app, we store the email address an invitation is sent to. When an organisation admin invites a colleague, we also store which role the colleague is to have and who sent the invitation. The colleague receives an email with a link and chooses the password themselves; the account is created only then. An invitation is stored for no more than 14 days and is deleted automatically when it is used, or at the latest seven days after it has expired or been withdrawn. Legal basis: legitimate interests in administering controlled access (GDPR Art. 6(1)(f)).

4.9 Booking a meeting

If you book a meeting with us, you provide your name, email address and the time you choose. The booking is handled by Zoho Bookings and the meeting is held in Zoho Meeting, both within the EU (Amsterdam). The calendar is shown embedded on our website, but it only loads when you click the booking button, not when you visit the page. If you choose not to book, the booking service is never contacted. Legal basis: steps taken at the request of the data subject prior to entering into a contract (GDPR Art. 6(1)(b)).

4.10 NYTERIO Pocket

Pocket is the same app with its own registration and card payment, and what §4 says applies here too. This is what differs:

• Registration and account. You provide your name, company, company registration number and email address. The email address is your login. Before payment we send a six-digit code to the address, which you enter on the page; if the address already has an account, you get an email about that instead. We also store the time you accepted the licence terms, together with a hashed IP address and the browser's user agent string, as proof of acceptance. A registration that is started but not paid for is deleted after 48 hours. Legal basis: contract (GDPR Art. 6(1)(b)), and for the proof of acceptance our legitimate interests in being able to show that the agreement was entered into (Art. 6(1)(f)).
• Payment. Card payment takes place at Stripe. The card details are entered on Stripe's page and never pass through NYTERIO's servers. We store Stripe's customer and subscription numbers, the chosen tier and the subscription status, so that we can open the customer portal and know whether the account is paid. You get receipts in Stripe's customer portal. See §5.
• Photos of whiteboards. The photo is processed in the server's memory to be redrawn as a flowchart and is deleted as soon as the chart is ready. It is stored neither by us nor by the AI provider. The text on the sticky notes becomes text in the chart, and that chart lives until the assignment is deleted. Write roles on the sticky notes, not names.
• Assignments. The day's charts and boards are collected in one assignment per client. The assignment is deleted 30 days after the last activity, or at the latest after 90 days if you have extended it. A record that the deletion took place, with the time and number, is kept for twelve months; the client's name is removed from it after 365 days.
• Email. A welcome email is sent when the payment has been confirmed, with a link where you choose your password. The link expires after 48 hours. The email is sent via Zoho, see §5.
• Your client's data. The content on a board may concern your client's business and employees. For that data you are the controller and NYTERIO AB is the processor, under the data processing agreement included in the licence.

4.11 Documents sent before the start

When a new customer is getting started, NYTERIO may send a private link where the customer uploads their documentation, preferably as a ZIP file. The link requires no account, is valid for 14 days and can be closed by us at any time. The files are stored at Hostup AB in Sweden, separate from the process library, and are never unpacked or run on the server.

We review the documents manually before the process library is built, to judge which ones are suitable and to adjust the main process map. For the review they are downloaded to NYTERIO's work computer, which has an encrypted disk, and are deleted there when the review is complete. Documents that are then used in Library Builder are stored under §4.2.

Retention: the files are deleted automatically from the server 30 days after the upload, or earlier if the customer or we delete them. They are not included in the daily backup. Legal basis: performance of a contract (GDPR Art. 6(1)(b)). For the content of the documents, the customer is the controller and NYTERIO AB the processor, under the data processing agreement.

4.12 The help box in the app

When you ask a question in the help box (Fråga hjälpen in the Swedish app), the question is sent, together with the help's previous answers in the same conversation, to our AI provider Nordalster AB (Swedish company reg. no. 559279-8002) in Sweden, which produces the answer from our help articles. The provider processes the text in RAM/VRAM and stores no data after the session.

What we store: not the question and not the answer, unless you send them to us yourself (see below). The conversation stays in your browser and disappears when you close the tab or choose to start a new question (Börja ny fråga). The server log stores a checksum of the question, which cannot be read as text. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).

If you press "Did not help" (Hjälpte inte): below an answer you can send the question and the answer to us, with a comment if you like. Nothing is sent unless you press Send (Skicka). What is stored is the question, the answer, the comment, your role in the app (for example Editor, Redigerare in the Swedish app), which view you were in, which day it was and how the help chose its answer. It is stored without your name, without your email address and without your organisation, and we store the day but not the time. We use it to correct and complete the help articles. Legal basis: legitimate interests in improving the help (GDPR Art. 6(1)(f)).

Retention: what you have sent is deleted automatically after 30 days. It may remain in the daily backup of the database for up to 14 more days. If you want something you have sent removed earlier, email info@nyterio.se and tell us which day you sent it and roughly what you wrote. Since it is stored without a name, we need that to find the right record.

What we remove from the text: email addresses, Swedish personal identity numbers and phone numbers are replaced before the text is stored. Names, addresses and other details in running text cannot be recognised, so they remain if you write them.

Personal data in the question: do not write names, email addresses or identity numbers (such as personal identity or National Insurance numbers) in the help box, and nothing internal about your business. It is meant for questions about how NYTERIO works. If the question concerns a specific person, email info@nyterio.se instead.

4.13 The contact form and the interest form on the website

If you write to us through the contact form on nyterio.se, you provide your name, email address and message, and your organisation if you wish. If you register your interest with the "I'm interested" button on the home page, you provide only your email address. The details are sent as an email to our mailbox at Zoho Corporation (Amsterdam, EU), see §5, and kept there. They are not stored in any database of ours and are not registered in our customer register.

From Processkollen. If the message is sent from Processkollen because an uploaded file could not be assessed, we also store your name, email address and organisation, the type of file according to the assessment, and the time, in our local database and in our customer register, see §3.4. These details are kept for the same period as set out in §3.4, no more than 24 months, and are used to reply to you and to get in touch once afterwards. The message itself exists only in the mailbox. Legal basis: legitimate interests (GDPR Art. 6(1)(f)).

We use the details only to reply to you and for the further contact your question or registration leads to. We send no newsletters and never sell or share the details.

Retention: the email is kept in the mailbox for as long as the contact is ongoing and is deleted no later than 24 months after the last message in the same matter. You can ask for earlier deletion at any time by emailing privacy@nyterio.se, and the request is carried out without us asking why. If the contact leads to an agreement, we keep the emails needed for the agreement and the accounts for as long as the law requires, see §4.6.

As with every visit, the web server records your IP address in its technical logs when you send the form, see §4.7.

Legal basis: legitimate interests in being able to answer questions put to us (GDPR Art. 6(1)(f)). You can object to the processing under §7.

5. Service providers that process data on our behalf

We use the following processors to deliver the service. Where we are ourselves a processor for a customer (§4.10, §4.11), they are our sub-processors.

We enter into written data processing agreements with all processors in accordance with GDPR Art. 28.

6. What do we not store?

Whatever the service, we never store:

• Processkollen's file after no more than 30 minutes, see §3.1. In the app, on the other hand, uploaded documents, with their file names, and the originals of redrawn flowcharts are stored as part of the library (§4.2), and documents sent before the start for no more than 30 days (§4.11)
• The photo of the board in NYTERIO Pocket after the chart has been drawn, see §4.10
• Library Builder's ZIP file after the analysis is complete; the documents in it are stored, with their file names, under §4.2
• IP addresses linked to review statistics
• Tracking cookies or marketing pixels
• Card details. The app is paid for against invoice, and NYTERIO Pocket is paid for by card at Stripe without the card details reaching us, see §4.10

7. Your rights

As a data subject in the EU/EEA, you have the right under the GDPR to:

• Request access to the personal data we process about you
• Request rectification of inaccurate data
• Request erasure ("the right to be forgotten"). Contact us and we will delete your account, your work content and related logs
• Request restriction of processing
• Object to processing when it is based on legitimate interests
• Request data portability. We export libraries and process maps as JSON, PDF or HTML. The administrator can download controlled documents themselves, with all versions and the history, as a ZIP file under Documents, All documents (Dokument, Alla dokument in the Swedish app)

For Processkollen, most erasure requests are met automatically: the file is gone within 30 minutes and the report within 24 hours. What may remain after that is contact details you provided yourself, for a report, a template or a message (§3.4, §3.5, §4.13). We delete those on request, including from the mailbox. For the NYTERIO app, we carry out erasure manually on request. Contact us at privacy@nyterio.se.

You also have the right to lodge a complaint with the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY), imy.se, or with the supervisory authority in the EU/EEA country where you live or work or where the alleged infringement took place.

8. Cookies and tracking

We use no tracking cookies. For anonymous visitor statistics on our public website, we use a self-hosted Umami instance on the same Swedish server as NYTERIO. Umami uses no cookies, links no IP addresses to an individual user and does not track anyone across pages. Technical session and login cookies are used to keep your session active. They contain no personal information beyond what is needed to verify your login. If you choose a language with the language button, or with the "På svenska" link in the footer of the English home page or About page, your choice is stored in a cookie (__Host-nyterio_sprak) for 180 days, so that the site is shown in the same language next time. It contains only sv or en and is used for nothing else. If you have not chosen a language, the language of the home page and the About page is decided by your browser's language setting when you visit them. That is not stored. Simply visiting the English pages sets no cookie. We do not use Google Analytics, Facebook Pixel or similar third-party services. There is one exception to the statistics being fully anonymous: when you arrive via a link in an email from us, see §8.1.

8.1 Links in our outgoing emails

When we email a company, the link may contain a short code, for example ?ref=examplecompany. The code tells us which company we sent it to, never who is reading, and it is used only so that we can see whether the email was relevant enough to be opened. This is our legitimate interests in following up our own marketing, Article 6(1)(f) of the GDPR.

The code is not stored on your computer. It is not sent as a cookie, nothing is stored in the browser, and it disappears from the address bar as soon as the page opens. This also means it does not follow along if you copy the address from your browser and send it to a colleague. We can see that someone at the company opened the page, not which of you it was.

If you want us to stop using codes for your company, just tell us at privacy@nyterio.se and we will remove it. You can also remove ?ref= from the address before you open the link.

9. Security

We protect the service with:

• HTTPS (TLS) for all communication
• Passwords stored only in hashed form (bcrypt)
• Login based on short-lived JWT tokens
• Unpredictable UUIDs as identifiers for reports and libraries
• Rate limiting on all public endpoints
• Server-side file validation (type and size)
• Processkollen's file is never stored permanently, and it is processed in the server's memory (see §3.1). Documents in the app are stored as described in §4.2
• fail2ban and automatic security patches on the server side

10. Children

The service is aimed at working professionals and is not intended for people under 18. We do not knowingly collect data from minors.

11. Changes to this policy

We may update this privacy policy when needed. Material changes are announced through a clear notice on the website and, for logged-in users, by email. The date of the latest update is always given at the top of the document.

12. Contact

Questions about how we handle your personal data are answered at:
privacy@nyterio.se