Privacy Policy
Last updated: October 2026
enabledat collects and processes personal data only to the extent necessary to provide the service. This page explains what we collect, why we collect it, and your rights under GDPR.
Plain-language summary
enabledat collects only the information needed to provide the service, manage access, support users, and improve the product where consent allows. Customer data is not used to train AI models.
What we collect
Required information
- Email address
- Name and role (required for beta testers requesting access)
Optional information
- Name and profile information you choose to provide
- Session content and artifacts you create while using enabledat
- Usage data such as activity levels, completion rates, and aggregated statistics used for security, operations, and product improvement
- Consent records, including the timestamp and version of accepted terms and policies
Why we are allowed to process it
Three lawful bases, under Article 6 of the GDPR:
- Contract: your account, your sessions, and the outputs they produce — everything needed to provide the service you signed up for.
- Legitimate interests: aggregate usage monitoring, for security, abuse prevention, and product improvement.
- Consent: the optional consents below. You can withdraw them at any time, and withdrawal does not affect anything done beforehand.
Consent
Acceptance of our Terms of Service is required to use enabledat.
Consents related to product improvement, product updates, case studies, and similar activities are optional and can be changed at any time in Settings.
Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.
How long we keep it
- Your profile, sessions, and generated outputs stay in your account until you delete them.
- Consent records — what you agreed to and when — exist for as long as your account does, and are deleted with it.
- Sign-in records are held by our authentication provider for a limited period for security monitoring. We keep no separate audit archive beyond what is listed here.
- Anthropic retains prompts and responses for up to 30 days before permanent deletion.
- Deleting your account deactivates it immediately and erases it permanently seven days later.
Who processes it, and where
Three sub-processors, all with published security certifications:
- Supabase: database and authentication. EU region (Dublin). SOC 2 Type 2 certified.
- Vercel: application hosting and serverless functions (Stockholm). SOC 2 Type 2 certified, ISO 27001.
- Anthropic: the language model that generates reasoning. Does not train on API traffic.
Anthropic processes session content in the United States. That is a transfer outside the EEA, and it relies on the European Commission's standard contractual clauses, which form part of our data processing agreement with Anthropic. Session content sent to the model is never used to train it and is deleted after 30 days.
What we do not collect
- We do not use third-party advertising trackers.
- We do not collect data to train AI models.
- We do not collect phone numbers.
- We do not process payment information directly. Payments are handled by our payment provider.
Your rights
Under GDPR, you have the right to:
- Access your personal data
- Correct inaccurate information
- Export your data
- Delete your data
- Withdraw optional consents
- Complain to a data protection supervisory authority
These rights can be exercised directly within the application.
If you believe we have handled your data incorrectly, tell us first and we will put it right. You also have the right to lodge a complaint with a data protection supervisory authority — in Sweden the Swedish Authority for Privacy Protection (IMY, imy.se), or the authority where you live or work.
For more information, please see our Security & Trust page.
Who is responsible
enabledat is the data controller for personal data processed through the service.
Contact
If you have questions about privacy or would like to exercise any of your rights, please contact us using the contact form.
We typically acknowledge requests within 24 hours.