The legal shelf.
Every document that governs your use of stomwerk, in one place. Written to be read, versioned by date, and kept in step with how the services actually work.
The documents.
| Document | What it covers | Status |
|---|---|---|
| Terms of Service | The agreement for the platform and apps: your licence, AI output and review obligations, fees and VAT, cancellation and refunds, consumer withdrawal rights, switching and export, liability, Swedish law. | Draft, pending legal review · 6 July 2026 |
| Acceptable Use Policy | The rules of use: lawful and honest content, no gaming of quotas or the AI allowance, no reselling or scraping, safety-critical boundaries, enforcement. | Draft, pending legal review · 6 July 2026 |
| Privacy Policy | How we handle personal data as controller: what we collect on the site and in the apps, legal bases, retention, your GDPR rights, transfers. | Published · 6 July 2026 |
| Data Processing Agreement | Controller-to-processor terms (Art 28 GDPR) for the data you manage inside the apps: Work Permit Intelligence worker data and stomwerk content customer content, EU residency, breach notice, deletion, audits. | Draft, pending legal review · 6 July 2026 |
| Subprocessor register | Every provider that processes personal data on our behalf: role, location, transfer mechanism, and the dated change log with 30 days' notice of changes. | Published · 6 July 2026 |
What we promise.
The documents above are the contract. These are the commitments beneath them, in the plain English a security or data-protection review tends to ask for. Each is stated more fully in the document it links to.
- We never train AI on your content. Nothing you write, upload or generate is used to train an AI model - not by us, and not by our AI providers, who are contractually barred from it. Anthropic retains API data for at most 30 days and does not train on it; Amazon Bedrock stores nothing and trains on nothing. This holds on every plan, free and paid alike.
- Your data is stored in the EU. Records and attachments sit in Frankfurt; stomwerk content media sits in an EU-jurisdiction Cloudflare R2 bucket. We will not tell you that nothing ever touches the US: some AI inference and a few processors run on US-parented services under Standard Contractual Clauses and, where it applies, the EU-US Data Privacy Framework. The subprocessor register names every one, what it does, and the transfer mechanism.
- AI output is disclosed as AI. Images generated in stomwerk content are labelled as AI-generated, and we are adding tamper-evident content credentials to generated media and exports - Article 50-ready output marking that discloses what a machine produced. We call it Article 50-ready because the EU transparency Code sets functional criteria and names no single standard.
- You can leave with your data. Export lives in the platform under Settings, Data & privacy, with no switching charges. The switching and exit clause sets out the rest.
- We are honest about certifications. We are a small company and are not yet ISO 27001 or SOC 2 certified. Our hosting subprocessors hold SOC 2 Type II and ISO 27001 today, and we are scoping our own path to certification, ISO 27001 first. We will publish a target date here rather than imply a badge we do not hold.
Which one do you need?
- Buying or evaluating? The Terms are the contract; the DPA is what your data protection reviewer will ask for; the subprocessor register answers the "who touches our data" questionnaire row.
- A person, not a company? Clause 10 of the Terms sets out your consumer rights, including the 14-day right of withdrawal.
- Wondering about your own data? Start with the Privacy Policy, or just write to [email protected].
- Leaving? Export lives in the platform under Settings, Data & privacy; the switching and exit clause explains the rest. No switching charges.
Documents marked as drafts are awaiting review by qualified counsel and may change before they take effect. Earlier versions of any document are available on request from [email protected].