Controller and contact
Fidrel AB, identified in the company details below, is the controller for website enquiries, accounts, security and its own customer relationships. For project content that a customer controls, the customer is normally the controller and Fidrel acts as its processor under a data processing agreement; contact the project owner first about that content. Fidrel AB is established in Sweden, within the European Union. You can send any question or request about your personal data to [email protected].
Data and sources
You provide your name, email address, professional role, organisation, enquiries and quotation details, and, if you buy as a private individual, your billing name and address. An administrator may invite you and assign your role. The service processes documents, versions, metadata, reviews, comments, activity, billing references and technical data such as IP addresses and error logs.
Lawful bases
We process personal data under the GDPR, together with the national data protection law that applies, such as Sweden’s Data Protection Act (2018:218) for Fidrel as a Swedish company and Ireland’s Data Protection Act 2018 where it applies to you. Our lawful bases are: contract (Article 6(1)(b)) where you are the contracting party or ask us to take steps before a contract; legitimate interests (Article 6(1)(f)) in serving organisation contacts and invited users, delivering and administering the service and protecting it against misuse; legal obligation (Article 6(1)(c)) for accounting and tax records; and consent (Article 6(1)(a)) for any optional cookies or tracking. Do not upload special category or criminal offence data to a project unless your organisation has a lawful basis and, for special category data, a condition under Article 9 of the GDPR or, for criminal offence data, an authorisation under Article 10 of the GDPR and the applicable national law.
Recipients
Authorised members access project content under the project’s rules. OVHcloud (servers in London, United Kingdom) and Cloudflare provide hosting and delivery; Supabase provides the database, authentication, document storage and authentication emails. Stripe processes payments when its checkout is used and may act as an independent controller for its own legal obligations. Authorities receive data where the law requires it. Resend sends the service’s email, such as invitations, notifications and invoices. Google provides reCAPTCHA on the website’s forms. Map images come from OpenFreeMap and Esri, and a project’s address is sent to Komoot’s address search (Photon) when the project is placed on the map. Fidrel AI is described in its own section.
International transfers
Fidrel is operated from Sweden. Our servers are in the United Kingdom. Personal data is transferred there on the basis of the European Commission’s adequacy decision for the United Kingdom under Article 45 of the GDPR; if that decision ceased to apply, we would rely on the EU standard contractual clauses instead. We do not promise EEA-only processing: providers’ operations and support may involve other countries, including the United States. Such transfers rely on an adequacy decision where one applies, for example the EU-U.S. Data Privacy Framework for a certified recipient, or on the EU standard contractual clauses with supplementary measures where required. You may ask us which recipients and safeguards apply. The database and documents are stored with Supabase in Stockholm, Sweden.
Retention
Account data is kept while the account is in use; project content and versions follow the agreed project and retention periods. The recycle bin is not immediate deletion. Enquiries are kept for as long as they need handling and for potential legal claims; accounting records follow the applicable law. Documents and folders in the recycle bin are deleted permanently after 30 days, as are schedules, unapproved estimates and supplier invoices in the bin; uploads that are never completed are moved there after one day. Fidrel AI conversations and drafts are deleted 180 days after they were last used, technical logs of AI calls after 30 days, and records of AI usage without content after 400 days. Invitations are valid for 7 days. Database backups are kept for 7 days and then overwritten.
Your rights
Under the GDPR you can ask for access to your data, rectification, erasure, restriction and, where applicable, data portability. You can object to processing based on legitimate interests and at any time to direct marketing. Withdrawing consent does not affect processing that took place before. We may need to verify your identity. We respond within one month; complex or numerous requests may be extended by up to two further months, and we will tell you why.
Sign-in with Google, Microsoft or Facebook and deleting your data
If you sign in with Google, Microsoft or Facebook, we receive your name, email address and, where available, profile picture from that service. We use them only to create and recognise your account, never post anything on your behalf and do not read your contacts. You can disconnect the service under Settings in Fidrel or remove Fidrel in the service’s own app settings. To delete your account and personal data, choose Request account closure under Settings, or email [email protected] from your account’s address with the subject “Delete my data”. We confirm the request and delete the account data without undue delay and within one month, except what the law requires us to keep, such as accounting records. Content in a customer’s project is handled under that customer’s agreement.
Fidrel AI
When you use Fidrel AI, your question, earlier messages in the same conversation, the page you are on and the project information the assistant reads to answer are sent to OpenAI, which processes them as our subprocessor. The assistant reads only what you yourself have access to, and files or images you attach. Project information may include the names of people on the project. Your name and email address are not sent; OpenAI receives a code that cannot be linked to you without our records. OpenAI does not use the information to train its models and keeps it for up to 30 days to detect abuse. OpenAI may process the information in the United States; the transfer is covered by our data processing agreement with OpenAI, including the European Commission’s standard contractual clauses. Your conversations are stored in Fidrel, visible only to you, and deleted after 180 days without activity. The project’s administrator can turn Fidrel AI off for the project. Answers can contain mistakes: check what matters. If you ask Fidrel AI to read a supplier invoice, its contents are sent in the same way.
Security and complaints
Access controls and encrypted connections protect the service, although no system can guarantee absolute security. Required account data enables sign-in, and administrators decide what goes into projects. The app does not make solely automated decisions with legal or similarly significant effects. Please raise any concern with us first at [email protected]. You also have the right to complain to a supervisory authority, in particular in the EU country where you live or work or where the alleged infringement took place. In Ireland that is the Data Protection Commission (DPC), at dataprotection.ie. Because Fidrel AB is established in Sweden, the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), at imy.se, acts as its lead supervisory authority for cross-border processing. You can still complain to the DPC, which may then handle your complaint together with IMY under the GDPR’s cooperation procedure.
Newsletters
Newsletters are planned. A subscription requires a separate, voluntary signup explaining email use and how to unsubscribe. Accepting cookies does not subscribe you.
Read the provider’s information
Data Protection Commission (DPC)Contact and company details
- Company name
- Fidrel AB
- Registration number
- 559556-3593
- VAT number (EU)
- SE559556359301
- Postal address
- Paviljongvägen 2 132 40 Stockholm
- [email protected]