Privacy Policy

Last updated 30 October 2026 (rev. 8)

This policy explains how ComputingSphere processes personal data when you visit computingsphere.com, create or use an account, or contact us. It applies to ComputingSphere DNP3, ComputingSphere SCADA and the rest of the platform (the “Services”).

1. Who is responsible

The controller is ComputingSphere OT (org. no. 891120-9131, VAT SE891120913101) registered in Sweden with its seat in Ludvika. Contact for anything about personal data: contact@computingsphere.com.

For data that customers upload into the Services (captures, models, measurements, screens and similar “Customer Data”), the customer organization is the controller and we process that data on its behalf, as described in the Terms of Service. Questions about personal data inside Customer Data should go to that organization first.

2. What we collect and why

Data	Purpose	Legal basis (GDPR)
Account: email, name, phone number, job title, password (stored only as a one-way hash), profile picture if you add one	Create and run your account, sign you in, contact you about the Services	Contract (Art. 6(1)(b))
Organization: name, billing address, members and their roles and access	Run the organization’s account, invoicing	Contract
Terms acceptance: version accepted, time and IP address	Evidence of the agreement	Legitimate interest (Art. 6(1)(f)) in being able to prove the agreement
Billing: plan, subscription status, invoices, VAT number; card details are entered at Stripe and never reach us	Take payment, keep accounting records, apply VAT	Contract; legal obligation (Art. 6(1)(c)) for bookkeeping and tax
Security and usage records: sign-in attempts (username, IP address, time, result), actions in the organization’s audit log, the last time you were active and the days you used the Services	Protect accounts and the Services, investigate incidents, show admins their organization’s activity, enforce plan limits	Legitimate interest in security and in running the Services
Server logs: IP address, time, requested page (without query strings), browser identification	Operate, secure and troubleshoot the Services	Legitimate interest
Messages you send us (the contact form, signed in or on the Contact page, or email), and for each one sent through the form a support ticket: its number, your email, your name if you gave it, the subject, the page you wrote from, your organization if you were signed in, and the time	Answer you and follow up on your request	Legitimate interest; contract where it concerns your account
Bot check on the signup, demo and public contact forms (Cloudflare Turnstile)	Keep automated abuse out of the forms	Legitimate interest
Visit statistics: page visited, referring page or campaign, browser, operating system, screen size and country (no IP address, no cookie, no identifier)	Know which pages and campaigns bring visitors and fix what does not work	Legitimate interest
Marketing cookies (Google Ads), only when we run ad campaigns and only if you accept them	Measure which of our ads led to a signup	Your consent (Art. 6(1)(a) and the ePrivacy rules); you can withdraw it at any time

We do not sell personal data, we do not use it for advertising profiles, and the website counts visits with our own statistics tool, which sets no cookies and stores no IP address (table above and section 3). By default it has no advertising trackers; the only optional cookies are the marketing cookies described in section 3, and they are set only if you accept them.

3. Cookies and local storage

We only use what the Services need to work:

• authelia_session: keeps you signed in across computingsphere.com services. It ends after 1 hour of inactivity or 8 hours, or after 1 month if you tick “remember me”.
• computingsphere_lang: remembers the language you chose.
• computingsphere_consent: remembers your cookie choice, for 6 months.

Because these are strictly necessary, they do not require consent. Cloudflare Turnstile, used on the signup and demo forms, processes technical information about your browser to tell people from bots; see Cloudflare’s privacy policy.

Visit statistics. We count visits with GoatCounter, an open-source tool that we run ourselves on our servers in Sweden. It sets no cookies and uses no local storage, and it does not store your IP address: for a short time it tells one visitor from another with a hash that cannot be turned back into the address and is not kept, so no one can be followed from one day to the next. Because nothing is stored on your device, it needs no consent.

Optional marketing cookies. When we run Google Ads campaigns, the site shows a cookie banner. Marketing cookies from Google (such as _gcl_*) measure which of our ads led to a signup. They are off by default and are set only if you accept them: until then your browser sends nothing to Google. “Reject optional” has the same weight as “Accept all”, and closing the banner is not a choice. You can change or withdraw your choice at any time with “Cookie settings” in the footer; withdrawing clears those cookies.

4. Who receives the data

We use these providers, each only for its part of the Services and under a data processing agreement or as an independent controller for its own legal duties:

• Hostup AB (Sweden): servers that host the Services and their databases. All our servers are in Sweden.
• Zoho Corporation (EU data centre): sending account and support emails (confirmation, password reset, support tickets) and our mailbox.
• Stripe Payments Europe Ltd (Ireland): payment processing and invoicing. Stripe is also an independent controller for its own legal obligations, such as fraud prevention.
• Cloudflare, Inc.: the Turnstile bot check on the signup, demo and public contact forms.
• Google Ireland Limited: conversion measurement for our ad campaigns, only if you accept marketing cookies.

We may also disclose data where the law requires it, for example to tax authorities or by court order.

5. Transfers outside the EU/EEA

We store data in Sweden. Stripe, Cloudflare and Google are part of groups based in the United States, so some data may be accessed from there. Those transfers rely on the EU–US Data Privacy Framework and/or the European Commission’s standard contractual clauses.

6. How long we keep data

• Account and organization data: while the account exists. An organization with only free plans in which no member has signed in for 90 days may be closed, after an email to its administrators at least 30 days before (Terms, section 8). A closed organization is unreachable at once; its data is kept for 30 days, so a mistaken closure can be undone or the data exported, and then deleted. A final backup is kept 7 more days and then deleted too. If that backup cannot be made, the data is deleted without it only on a recorded decision of our administrator.
• When you are no longer in any organization: your sign-in details are deleted at once, and the rest of your profile (name, picture, job title, activity) 30 days later. If that is because your organization was closed, a copy of your sign-in details (including the hash of your password, never the password itself) is kept with the organization's data until it is deleted, and in its final backup, so a mistaken closure can be undone. Your email stays only in the activity history of organizations that still exist, and goes with them.
• Accounting records (invoices, payments, VAT data): 7 years, as required by Swedish bookkeeping law.
• Terms acceptances, and the record of each organization deletion (name, dates, who closed it, what was backed up or who decided otherwise): as long as needed to show the agreement and the deletion, at most 10 years.
• Sign-in history: 90 days.
• Days you were active: 13 months.
• Server logs: at most 31 days.
• Signup form details: deleted within a day of the confirmation link expiring (it is valid for 30 minutes), or 30 days after the account was created from them.
• Support tickets and the messages about them: 2 years after the ticket was opened, then deleted. A ticket of an organization that is deleted goes with it.
• Backups: kept on a separate backup server, also in Sweden, reachable only from our own servers over a private network. SCADA instance backups follow the schedule and number of copies set for each organization (by default one a day, keeping the last 7), and end with the instance. Platform databases are backed up daily and each copy is deleted after 30 days, so deleted data leaves the backups within 30 days. Final backups of closed organizations are deleted after 7 days. When a DNP3 Enterprise instance is removed, a final backup of it is kept for 60 days and then deleted. An archive of a SCADA instance, made before the instance is removed, is deleted after 7 days.

7. Your rights

You have the right to access your personal data, to have it corrected or erased, to restrict or object to processing based on legitimate interest, and to receive the data you gave us in a portable format. Write to contact@computingsphere.com; we answer within one month. You can edit most account details yourself on your Account page.

You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, imy.se) or to the authority where you live.

8. Security

Traffic is encrypted with TLS; passwords are stored only as Argon2id hashes; access to the servers is limited to key-based administration; the servers talk to each other over a private network; and secrets are kept out of the code and readable only by the services that need them. No system is perfectly secure; if a breach affects your data, we will inform you and the supervisory authority as the law requires.

9. Children

The Services are for businesses and are not directed at anyone under 18.

10. Changes

We will publish any change on this page with a new date and, for a substantial change, inform account holders by email or in the Services.