Privacy Policy
Last updated: 28 June 2026
Your privacy is important to us. This policy explains what personal data we collect when you use Makespan (makespan.se), why we do it, how long we keep it and what rights you have under the EU General Data Protection Regulation (GDPR).
1. Data controller
Responsible for the processing of your personal data is Makespan (makespan.se). Contact for data protection matters: info@makespan.se.
2. What data we collect and why
a) When you fill in the demo form
- Data: name, work email address, company, role/title (optional), your message (optional) and a hashed (one-way encrypted) version of your IP address for spam protection.
- Purpose: to contact you about a demo and to protect the form against spam/abuse.
- Legal basis: legitimate interest (art. 6(1)(f)) — to answer your request and run our business. You can ask us to delete the data at any time.
b) When you have a user account in the service
- Data: email address, name (if provided), role and which company the account belongs to.
- Purpose: to give you access, manage permissions and provide the service.
- Legal basis: performance of a contract/pre-contractual steps (art. 6(1)(b)) and legitimate interest in secure operation.
c) Production and planning data
- Data: order data, volumes and schedules that you or your employer upload. This is generally company data, but if individuals can be identified (e.g. in logs) that data is processed too.
- Purpose: to deliver and improve the scheduling.
- Legal basis: performance of a contract (art. 6(1)(b)) — the service cannot be delivered without this data.
d) Technical data (cookies)
We use only necessary cookies (login and bot protection). We use no analytics or marketing cookies. See our cookie information.
3. We never sell your data
We do not sell or rent your personal data. We only share it with the subprocessors required to run the service (see section 5).
4. How long we keep the data
- Demo requests: kept for up to 12–24 months if you do not become a customer, then deleted. Hashed IP is kept for a shorter time only for spam protection.
- User accounts: kept as long as the account is active and deleted when it is closed.
- Production data: kept as long as the service is used and deleted on request.
5. Subprocessors that process data on our behalf
To run the service we use the following providers. Some process data outside the EU/EEA (USA); for those, the transfer takes place under the EU Standard Contractual Clauses (SCC) and/or the EU-US Data Privacy Framework as legal basis.
| Provider | Role | Location |
|---|---|---|
| Supabase | Database and login | EU (Ireland, eu-west-1) |
| Render | Server host (backend) | USA (Google Cloud, us-west1) |
| Vercel | Server host (website) | USA/EU (edge) |
| Resend (Amazon SES) | Email delivery | EU (eu-west-1) |
| Cloudflare | Bot protection (Turnstile) on forms | Global |
| Loopia | Domain, DNS and email forwarding | Sweden/EU |
6. Your rights
You have the right to:
- request access to the data we hold about you,
- request rectification of inaccurate data,
- request erasure ("the right to be forgotten"),
- request restriction of or object to the processing,
- request data portability.
Contact us at info@makespan.se to exercise your rights. You also have the right to lodge a complaint with the supervisory authority the Swedish Authority for Privacy Protection (IMY).
7. Security and incidents
We protect the data with technical and organizational measures, including encryption in transit (HTTPS), access control and authentication. No system is entirely risk-free, but we continuously work to improve security. In the event of a personal data breach that is likely to pose a risk to your rights, we report it to the Swedish Authority for Privacy Protection (IMY) within 72 hours and inform you without undue delay if the risk is high.
8. Changes to the policy
We may update this policy. The latest version is always on this page with the date of the most recent change at the top.
9. Contact
Questions about how we process your personal data? Email info@makespan.se.