Skip to content
← All legal documents

Data Processing Overview

Effective date: 15 July 2026 Last updated: 13 October 2026

This page explains, in plain language, which service providers (subprocessors) receive data when you use algosweden.se and AlgoSweden Studio (app.algosweden.se), what they receive, and why.

AlgoSweden Studio is in development and not yet available. Today only the public website runs: a static site on Cloudflare Pages, with no forms and no cookies set by us. The Studio rows below describe the providers Studio will use when it opens.

This is an overview, not a contract. It is provided for transparency and is not a signed Data Processing Agreement (DPA). Before using Studio to process personal data on your organisation's behalf, contact [email protected] to confirm the contractual terms required for that use case. Do not treat this page as an Article 28 agreement.

What data flows where

Provider What it receives Why Region and transfer basis
Cloudflare (website hosting) Website requests, IP addresses, standard request logs Serves the static website algosweden.se US-headquartered provider with a global network; a request may be served from a location outside the EU/EEA. Cloudflare's current data-processing terms describe the available transfer safeguards
Convex (database and backend) Account profile data, projects, prompts, generated code, application state Stores and serves the data that makes Studio work Verified EU deployment (eu-west-1). Convex is US-headquartered; its current data-processing terms describe the safeguards available for international transfers
Clerk (authentication) Name, email, authentication identifiers, session data Sign-up, sign-in, and session management for Studio US-headquartered provider. Clerk's published data-processing terms describe the available transfer safeguards; the applicable account-level contractual basis must be confirmed
Stripe (payments) Name, email, billing details, payment card data (entered directly with Stripe — we never see full card numbers), transaction history Subscription billing, invoicing, fraud prevention Stripe uses European and international entities and service providers. The applicable entity and safeguards depend on the customer location and Stripe's current privacy and data-processing terms
Anthropic Managed Agents (AI and execution) Your prompts, relevant project source and files, agent/tool activity, generated code, build output and temporary session files Produces AI generations and runs the isolated build session Anthropic is US-headquartered. EU residency for Managed Agent cloud sandboxes has not been contractually verified; the applicable commercial terms, DPA, retention, deletion and transfer safeguards must be confirmed before regulated or sensitive use
Resend (email delivery) Studio service email addressing, once Studio opens Delivers Studio service emails US-headquartered provider. Resend's current privacy and data-processing terms govern any international transfer

Points worth knowing

  • We do not sell personal data, and no data goes to advertising networks.
  • Prompts leave the platform. To generate code, your prompts and relevant project context are sent to the AI model provider used for that feature. Do not put secrets or other people's personal data in prompts.
  • Managed Agents is stateful, not zero-retention. Anthropic's current API documentation says Managed Agent session transcripts persist until the session is deleted and uploaded Files API objects persist until explicitly deleted. The feature is not eligible for Anthropic's zero-data-retention or HIPAA-ready arrangements. Content subject to trust-and-safety flags or legal holds may be retained longer under Anthropic's terms.
  • AlgoSweden does not train on your content. We do not use your prompts, projects, or generated code to train models. Production uses commercial provider APIs; provider handling is governed by the terms and account settings in force for those APIs (see the Studio Licence Terms, section 2).
  • EU data residency where verified. Application data (Convex) runs in an EU region. The website is served from Cloudflare's global network. AI generation and execution use Anthropic Managed Agents; no EU residency claim is made for those cloud sessions until it is contractually verified. Website delivery, authentication, payments and email delivery also involve US-based providers under the safeguards above.
  • Transfers outside the EU/EEA: providers publish safeguards such as the European Commission's Standard Contractual Clauses (SCCs) and, where a provider is certified, the EU–US Data Privacy Framework. The mechanism that actually applies depends on the provider and the account-level terms. Contact us for the current contractual position before submitting regulated or sensitive personal data.
  • Subprocessor changes: we update this page before adding or replacing a subprocessor and, for business customers with a DPA, provide the notice the DPA requires.

Related documents

Questions: [email protected].