Privacy policy

1. Data controller

Sophia Fyrst (sole proprietorship trading as Stilnote), Danish business registration no. (CVR) 45863166, Kaløvej 81, 8543 Hornslet, Denmark, is the data controller for the processing of your personal data. You can contact us at info@stilnote.com.

2. What data we collect

• Email address (when you create an account via Google login or magic link)
• Name and company name
• Logo (if you upload one)
• Product data (names, prices, images, supplier URLs)
• Project data (projects, rooms, price lists, moodboards)
• Team and sharing data (email addresses of colleagues you invite, and which projects you share)
• Referral data (your referral code and who referred you)
• Subscription status and Stripe customer ID — never card details
• Integrations: a hash of your SketchUp keys (the key itself is not stored) and the AI assistants you have granted access
• Client pages: number of views and last view — without IP address or any other information about who viewed the page
• Support requests you send us by email

3. Purpose and legal basis

We process your data for the following purposes — with the stated legal basis under Article 6 of the GDPR:

• Providing the Service (account, library, projects, client pages) — necessary for our contract with you (Art. 6(1)(b))
• Payment and subscription via Stripe — necessary for the contract (point b) and bookkeeping obligations (point c)
• Service emails (login links, account notices, receipts) — necessary for the contract (point b)
• Newsletter and marketing — only with your consent (point a); you can unsubscribe at any time
• Usage statistics and session recordings (PostHog, EU servers) — only with your cookie consent (point a). Recordings show how you use the app and may therefore also show what is on screen, such as project names and client details. If you withdraw consent, no further recording takes place
• Team collaboration and referral programme (invitations, project sharing, Pro months for referrals) — necessary for the contract (point b)
• AI assistants you connect yourself (Claude, ChatGPT and others) — on your instruction as part of the contract (point b); see section 6
• Error logging and security (Sentry, rate limiting) — our legitimate interest in a stable and secure service (point f)
• Brand fonts on the Company page and on client pages are loaded from Google Fonts and Fontshare so the studio's own typeface can be shown — our and your legitimate interest (point f); your IP address is sent to the font provider when the page loads

We make no automated decisions with legal effect for you and do not profile you.

4. Storage

Your data is stored with Supabase in the EU (Frankfurt, Germany). We retain your data for as long as you have an active account. When your account is deleted, all data is permanently erased — including your Stripe customer and your contact at Loops.so.

Exceptions to immediate deletion:

• Invoices and payment records are kept with Stripe for 5 years after the end of the financial year (Danish Bookkeeping Act)
• Error logs at Sentry are deleted automatically after 90 days
• Database backups at Supabase are overwritten within 7 days
• Emails you have sent us are kept while the matter is open and deleted afterwards

5. Third parties

We use the following data processors and third parties to provide the Service:

• Supabase — database, authentication and file storage (EU, Frankfurt)
• Vercel — hosting of the web application (US/EU)
• Stripe — subscription payment processing; your card details are handled exclusively by Stripe and are never stored with us
• Google — OAuth login (if you choose Google login)
• Anthropic — AI-based product extraction from URLs, image analysis (for product recognition and background removal) and web search (for price checks and source URL lookups). Your data is not used to train AI models
• SerpApi — image search (Google Lens), only when you actively use "find products from image"; the uploaded image is shared with SerpApi for the search
• PostHog — usage statistics and session recordings (EU servers), only if you have accepted analytics cookies
• Sentry — error logging so we can fix bugs; configured without personally identifiable information
• Resend — sending service emails (e.g. invitation confirmations)
• Loops.so — service emails about your account and the newsletter (US)
• Google Fonts and Fontshare — delivery of the studio's chosen brand fonts on the Company page and client pages; the app's own fonts are hosted by us

Several providers (Anthropic, SerpApi, Resend, Loops.so, Vercel and Sentry) process data in the United States. These transfers are protected by the European Commission's Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework.

When you create your account, we create a contact with Loops.so so we can send you essential service emails about your account. You are not automatically subscribed to the newsletter — that requires actively signing up. You can always unsubscribe from the newsletter via the link at the bottom of every email.

6. AI assistants (Claude, ChatGPT and others)

Under Settings you can connect an AI assistant to your account. The assistant then gains access — only for as long as you allow it — to search your library, read your projects and save products for you. What the assistant reads is sent to its provider (for example Anthropic or OpenAI), which is an independent data controller for that processing; the provider's own privacy policy applies.

We never share your data with an assistant you have not connected yourself. You can view and remove connected assistants under Settings → AI assistants; their access stops working afterwards.

7. Cookies

We use necessary cookies for authentication and — only with your consent — analytics cookies for usage statistics. Read more in our cookie policy.

8. Your rights (GDPR)

You have the right to:

• Access your data
• Rectification of inaccurate information
• Erasure of your data
• Data portability
• Restriction of processing
• Objection to processing
• Withdrawal of consent (cookies, newsletter) — without affecting the lawfulness of earlier processing

How to: You correct your details and delete your account yourself under Settings. Projects can be downloaded as PDF and Excel, images as files. If you want access to, or a complete export of, all your data in a machine-readable format, write to us — we reply within 30 days and free of charge.

You can lodge a complaint with the Danish Data Protection Agency (Datatilsynet) if you believe we process your data in breach of the rules.

9. Contact

Questions about data protection may be directed to info@stilnote.com.