Privacy Policy

1. Introduction

This Privacy Policy explains how Rukkor AB (“Rukkor”, “we”, “us”, “our”) collects, uses, stores and shares personal data across all our services. Rukkor AB, Besökaregränd 2D, 271 42 Ystad, Sweden (org. no. 556864-9635, VAT SE556864963501) is the controller for the personal data described here, except where we act as a processor on a business customer’s behalf (see Section 3). Contact: support@rukkor.com, +46 411 23 66 90. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable national law.

2. How this policy is organised

Our services handle data differently, so this policy is organised by context. Sections 3–5 describe each service; Sections 6 onwards set out the rules that apply across all of them.

• The Rukkor product (Section 3) — our sovereign collaboration and social platform, operated without tracking inside the product.

• Geometra (Section 4) — our takeoff and estimation product for business customers.

• Website and marketing (Section 5) — rukkor.com and our commercial activities, which use analytics and advertising.

3. The Rukkor product — the sovereign core

Where your content lives. All content inside the Rukkor product is hosted exclusively on servers operated by Hetzner Online GmbH, located in Germany within the European Union. Rukkor runs its own EU pipeline on this infrastructure. No United States–owned cloud provider hosts or has access to Rukkor product content.

No surveillance inside the product. Inside the Rukkor product we do not profile you, run behavioural tracking, use advertising or ad-tech technologies, sell or share your content, or use your content to train AI models for Rukkor or any third party. You are not the product. The analytics and advertising technologies described in the Website and marketing section of our Privacy Policy never operate on content inside the Rukkor product.

Vault. Content you store in Vault is end-to-end encrypted and is not accessible to Rukkor, our infrastructure providers, or any third party. Because it is encrypted for your access only, Vault content cannot be shared with other users through the Services. Because we cannot read Vault content, you are responsible for retaining your Vault access credentials; if lost, the content cannot be recovered.

AI features. AI-powered features in Rukkor are optional and operate only when you switch them on. When used, submitted content may be processed by Berget AI AB, a Swedish company that hosts open-weight models on EU/EEA infrastructure, to generate a response; all such processing takes place within the EU/EEA. We have a data processing agreement with Berget AI. Berget does not store your prompts or the AI outputs, and does not use your content to train AI models.

Our role. For content you and your collaborators create inside Rukkor, you are in control; where you use Rukkor as a business, we act as your data processor under our Data Processing Agreement. For the account and identity data we need to run the service (login, subscription status), we are the controller.

4. Geometra

Geometra is our digital takeoff and estimation product, offered to business customers. Customer data and content within Geometra is hosted on servers within the European Union (Hetzner, Germany). For personal data contained in customer-uploaded content we act as your data processor under our Data Processing Agreement; you are the controller. Geometra does not include any AI-powered features. The Geometra product and its marketing use the analytics and advertising technologies described in Section 5 — these do not apply to the Rukkor product.

5. Website and marketing

Our public website rukkor.com, our marketing and sales, and the commercial layer of Geometra process personal data with us as controller.

Data we collect. Data you provide (name, email, phone, company, correspondence, billing details), data collected automatically (IP, device and browser, pages viewed, session data), and business-contact data from public sources for sales prospecting (notified under Art. 14 GDPR).

Cookies, analytics and advertising. With your consent, we use Google Analytics and Google Tag Manager for analytics, and Google Ads, Meta (Facebook) Pixel and LinkedIn Insight Tag for advertising and remarketing, which may track activity across sites. You manage these in the cookie preference centre. The Rukkor product uses none of these.

6. Purposes and legal bases

We process personal data only on a valid legal basis under Article 6 GDPR:

• Providing the Rukkor and Geometra products to you — Art. 6(1)(b) – contract.

• Account administration and customer support — Art. 6(1)(b) – contract.

• Accounting, tax and other legal obligations — Art. 6(1)(c) – legal obligation.

• Securing and improving our services (analytics) — Art. 6(1)(f) – legitimate interest.

• Direct marketing to existing customers — Art. 6(1)(f) – legitimate interest.

• Newsletters, advertising cookies, targeted online ads — Art. 6(1)(a) – consent.

7. Sub-processors and recipients

We use sub-processors to provide our services. For the Rukkor product, content stays in the EU (Hetzner; Berget AI when you enable AI) and other providers handle only billing or transport metadata; Geometra and our commercial activities use a broader set, some US-owned under EU Standard Contractual Clauses (SCC). The full, current list — grouped by service, with each provider’s purpose, location and transfer mechanism — is published at www.rukkor.com/legal/sub-processors.

Internal AI and operational tools

Our staff use AI tools from Anthropic, OpenAI, Google (Gemini) and Berget AI for internal work such as drafting and research. We are careful not to submit identifiable customer data to these tools; where personal data may be involved (e.g. handling a support case) we rely on our legitimate interest in running our business efficiently (Art. 6(1)(f)) and require staff to follow internal data-handling rules. We also use Lynes (telephony, calls not recorded) for internal operations. None of these process the content inside the Rukkor product. In addition, we use our own Rukkor platform internally; that internal use relies on the Rukkor product sub-processors described above.

8. International transfers

Personal data in the Rukkor product is hosted exclusively in the EU and is not transferred to any US-owned cloud provider. Where any provider is located outside the EEA (see Section 7), transfers rely on EU Standard Contractual Clauses or another Chapter V GDPR mechanism; for the Rukkor product such transfers are limited to billing or transport metadata, never content. You can request copies of the applicable SCCs by contacting us.

9. Retention

We keep personal data only as long as necessary for the purposes it was collected for, unless a longer period is required or permitted by law. When data is no longer needed it is securely deleted or anonymised.

• Account and service data — Term of the subscription + up to 3 years (for reactivation/export), unless deletion is requested earlier.

• Trial data — Up to 3 years after the trial ends, unless deletion is requested earlier.

• Billing and financial records — 7 years (Swedish Accounting Act).

• Marketing-consent data — Until consent is withdrawn, or 3 years from the last interaction, whichever is first.

• Prospect data (legitimate interest) — Up to 2 years, or until you object.

• Support correspondence — 3 years from closing the case.

• Cookie and behavioural data — Per the relevant provider (typically 13–26 months).

10. Your rights

Under the GDPR you have the rights of access, rectification, erasure, restriction, portability, and objection, and the right to withdraw consent at any time. Exercise them at support@rukkor.com; we respond within one month. There is no fee, though we may charge a reasonable fee or refuse requests that are manifestly unfounded or excessive. Provision of certain data is necessary to provide the services; without it we may be unable to deliver them.

How to request account deletion. Email support@rukkor.com with the subject line “Account deletion request”, and include your first name, last name, and the email address linked to the account. We process the request promptly and confirm deletion within 30 days of receipt to the email address provided. Some data may be retained where the law requires it (e.g. billing records for 7 years under the Swedish Accounting Act).

11. Automated decision-making

We do not make decisions that produce legal effects concerning you, or similarly significantly affect you, based solely on automated processing. We use analytics that may create aggregated audience profiles for marketing, but we do not make individual automated decisions on that basis.

12. Security

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls and multi-factor authentication for administrative access, and regular testing and review of those measures. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Our current measures are described in our Trust Center.

13. Personal data breaches

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify you and the competent supervisory authority without undue delay, in line with Articles 33 and 34 GDPR.

14. Children

How a child’s data is handled depends on the service. In the Rukkor consumer service, a child’s account or profile is set up and administered by a parent or legal guardian, who provides (and can withdraw) consent to the processing of the child’s personal data and who exercises the child’s data-protection rights; where the child is below the digital age of consent in their country (13 in Sweden, up to 16 in some countries) they may use Rukkor only as a supervised profile under the parent’s or guardian’s account, and additional protections apply. When the child turns 18, the account and the associated data rights pass to them. Where a business customer gives access to Authorized Users who are under 18 (for example, young or seasonal employees), that business customer is responsible for the lawful basis and any required consents and acts as controller for those users’ data. We do not knowingly allow children to use our services outside these arrangements; if you believe a child has, contact us at support@rukkor.com.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal obligations, or data practices. Material changes will be notified by email or a prominent notice on our website or within the service, and where a change requires your consent we will obtain it first. The current version is always available at www.rukkor.com/legal/privacy-policy, with the revision date shown at the top.

16. Complaints and contact

If you have questions or are unhappy with how we handle your data, contact us at support@rukkor.com or +46 411 23 66 90. You also have the right to lodge a complaint with the Swedish supervisory authority Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, imy.se, or with the supervisory authority in your country of residence or work.