Privacy policy

1. Data controller

Stilnote ApS is the data controller for the processing of your personal data. You can contact us at info@stilnote.com.

2. What data we collect

• Email address (when you create an account via Google login or magic link)
• Name and company name
• Logo (if you upload one)
• Product data (names, prices, images, supplier URLs)
• Project data (projects, rooms, price lists)

3. Purpose and legal basis

We process your data for the following purposes — with the stated legal basis under Article 6 of the GDPR:

• Providing the Service (account, library, projects, client pages) — necessary for our contract with you (Art. 6(1)(b))
• Payment and subscription via Stripe — necessary for the contract (point b) and bookkeeping obligations (point c)
• Service emails (login links, account notices, receipts) — necessary for the contract (point b)
• Newsletter and marketing — only with your consent (point a); you can unsubscribe at any time
• Usage statistics (PostHog) — only with your cookie consent (point a)
• Error logging and security (Sentry, rate limiting) — our legitimate interest in a stable and secure service (point f)

4. Storage

Your data is stored with Supabase in the EU (Frankfurt, Germany). We retain your data for as long as you have an active account. When your account is deleted, all data is permanently erased.

5. Third parties

We use the following data processors and third parties to provide the Service:

• Supabase — database, authentication and file storage (EU, Frankfurt)
• Vercel — hosting of the web application
• Stripe — subscription payment processing; your card details are handled exclusively by Stripe and are never stored with us
• Google — OAuth login (if you choose Google login)
• Anthropic — AI-based product extraction from URLs, image analysis (for product recognition and background removal) and web search (for price checks and source URL lookups). Your data is not used to train AI models
• SerpApi — image search (Google Lens), only when you actively use "find products from image"; the uploaded image is shared with SerpApi for the search
• PostHog — anonymised usage statistics (EU servers), only if you have accepted analytics cookies
• Sentry — error logging so we can fix bugs; configured without personally identifiable information
• Resend — sending service emails (e.g. invitation confirmations)
• Loops.so — service emails about your account and the newsletter

A few providers (Anthropic, SerpApi, Resend) process data in the United States. These transfers are protected by the European Commission's Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework.

When you create your account, we create a contact with Loops.so so we can send you essential service emails about your account. You are not automatically subscribed to the newsletter — that requires actively signing up. You can always unsubscribe from the newsletter via the link at the bottom of every email.

6. Cookies

We use necessary cookies for authentication and — only with your consent — analytics cookies for usage statistics. Read more in our cookie policy.

7. Your rights (GDPR)

You have the right to:

• Access your data
• Rectification of inaccurate information
• Erasure of your data
• Data portability
• Restriction of processing
• Objection to processing

You can lodge a complaint with the Danish Data Protection Agency (Datatilsynet) if you believe we process your data in breach of the rules.

8. Contact

Questions about data protection may be directed to info@stilnote.com.