Privacy Policy
What EikHub knows about you, why, where it is kept and for how long: at eikhub.com, in EikHub's service at api.eikhub.com, and when you sign in to EikHub or let an app use EikHub for you.
In short. EikHub keeps building models as OpenEik repositories, with their versions, and the accounts that work on them. It is in testing now. It keeps your account and what is needed to run it, in a database and file store in the EU. It shows no advertising, sells no data and sets no tracking cookies. EikHub has no AI of its own: an app or assistant you allow works with your rights and no more. You can ask us for your data, and ask us to delete it.
- Who is responsible
- What we keep, and why
- Apps and AI assistants
- Who else receives data
- Outside the EU/EEA
- How it is protected
- Cookies
- Your rights
- Changes
- Contact
1. Who is responsible
EikHub is made and run by Karpa Gada AB, reg. no. 559010-3858, Simvägen 6, 312 72 Skummeslövsstrand, Sweden (“we”), which also makes Stomra. We are the controller of the personal data described in this policy.
One thing is different. What an organisation puts into its own repositories (a name in a title block, a signature on a drawing, a contact in a report) is the organisation's data. The organisation is its controller, and we handle it for the organisation as a processor. If your question is about such data, ask the organisation first.
2. What we keep, and why
We keep what EikHub needs to work and nothing for advertising or profiling. For each kind: what it is, on which legal ground, and for how long.
2.1 Your account
- What
- A random identifier, your email address and your name; how you sign in (with Google, or with your Stomra account) and whether Google has verified your email address; the organisations and repositories you belong to, and your role in them.
- Why
- To let you in and to show the people you work with who you are. Ground: our agreement with you or your organisation.
- How long
- Until you ask us to close the account; your name and email address are then deleted within 30 days. A change you made stays in its repository's record of changes under your random identifier (2.2).
2.2 Your repositories
- What
- The building models you or your organisation keep in EikHub: their versions, the settings that go with them, and a record of every change: who made it, what changed and when. A building model is seldom personal data, but a drawing or a report in it can carry names, signatures and contact details. A private repository is visible only to its members; a public one to anyone.
- Why
- This is the service. Ground: our agreement with you or your organisation; for what an organisation puts in, its instructions to us as its processor.
- How long
- As long as the repository exists. The record of changes is written once and not altered, so that a repository's history can be trusted. When an organisation asks us to delete a repository or close its account, its repositories are deleted within 30 days.
2.3 Invitations
- What
- The email addresses of people invited to an organisation or a repository, the role offered, and whether the invitation was taken up.
- Why
- To give the invited person access when they sign in. Ground: our agreement with the organisation that invites; for the person invited, our legitimate interest in delivering what was offered to them.
- How long
- Until the invitation is taken up or withdrawn.
2.4 Signing in
- What
- While you sign in, a short record of the sign-in in progress and a session on api.eikhub.com (section 7). When you let an app use EikHub for you: which app, what you allowed, when, and the tokens it was given. We keep only a fingerprint (a hash) of a refresh token or a session, never the token itself.
- Why
- To sign you in safely and to let the apps you chose work for you. Ground: our agreement with you.
- How long
- A sign-in in progress: 10 minutes. A sign-in session: 1 hour. An app's access token lasts 1 hour; its refresh token must be used within 30 days and ends at the latest 90 days after you signed in. What you allowed an app stays until you withdraw it or close your account.
2.5 Running the service
- What
- What every web server sees: your IP address, the address you asked for, your browser and the time. eikhub.com fetches its typefaces from Google Fonts, so Google sees your IP address when the page loads.
- Why
- To serve EikHub and keep it safe. Ground: our legitimate interest in a service that works and is secure.
- How long
- The request logs are kept for up to 7 days.
2.6 When you write to us
- What
- Your name, your address and what we write to each other.
- Why
- To answer you. Ground: our agreement with you, or our legitimate interest in answering a question.
- How long
- 24 months after the matter is closed.
EikHub is free of charge while it is in testing and takes no payment details. When paid plans come, the invoices and what the Swedish Bookkeeping Act makes us keep will be kept for seven years, and this policy will say so before anyone is charged.
3. Apps and AI assistants
EikHub has no AI of its own and sends your work to no AI provider. Apps can work with EikHub for you: Stomra, an analysis app, or an AI assistant you connect. The first time an app asks, EikHub shows you what it wants (read, or read and write) and you choose. From then on the app can do what you allowed, with your rights and no more. A person merges changes into a model; an app cannot give itself more rights.
What an app reads from EikHub goes to that app, and so to whoever runs it, under its own terms and privacy policy, as a controller of its own. It is not our sub-processor. If you use EikHub through Stomra, Stomra's privacy policy covers what Stomra does.
To stop an app, remove its access in the app, or write to us and we remove it. A token already given works until it expires, within an hour.
4. Who else receives data
We sell no personal data. This company handles data for us, as our sub-processor, under an agreement that binds it to our instructions:
| Company | What for | Where | Safeguard |
|---|---|---|---|
| Cloudflare | Runs eikhub.com and api.eikhub.com, and holds EikHub's database and files. | The database and the files are kept in the EU; the service runs on a worldwide network. Cloudflare, Inc. is a US company. | EU SCCs + DPF |
Others receive data because you choose to use them, each as a controller of its own:
- Google, if you sign in with Google: it tells EikHub who you are (your identifier, email address and name).
- Stomra, if you sign in with your Stomra account: Stomra tells EikHub who you are. Stomra is also made by Karpa Gada AB, under its own privacy policy.
- The apps you allow (section 3).
- Google Fonts, when you load eikhub.com (2.5).
We hand data to an authority only where the law makes us. If EikHub is sold or moved to another company, the data goes with it under this policy, and we tell you first.
5. Outside the EU/EEA
EikHub's database and files are kept in the EU. Cloudflare is a US company, and a request can be served from anywhere on its network, so some data can be handled outside the EU/EEA. Such a transfer rests on the European Commission's decision on the EU-U.S. Data Privacy Framework (DPF) or on its Standard Contractual Clauses (SCCs). Google, when you sign in with it, handles your sign-in under its own terms. Ask us if you want to know more.
6. How it is protected
- Everything travels over HTTPS, and the database and the files are encrypted where they are stored.
- Every call is checked: who you are, and what your role lets you see and change in that organisation and repository. A private repository is shown only to its members.
- EikHub's own sign-in tokens are short-lived and checked for the service they were made for. We keep only fingerprints (hashes) of refresh tokens and sessions, and a refresh token used twice ends the whole sign-in.
- With us, only those who need the data for their work can reach it, and they are bound to keep it to themselves.
If something goes wrong with personal data, we tell the people and the organisations it concerns, and the authority, as the law requires.
7. Cookies
eikhub.com sets no cookies. When you sign in, api.eikhub.com sets two cookies that are needed for signing in and are used for nothing else: __Host-eikhub-flow, which lasts at most 10 minutes while you go to Google and back, and __Host-eikhub-session, which keeps you signed in on EikHub's sign-in pages for at most 1 hour. Nothing is stored for advertising or for following you between sites.
8. Your rights
Write to us and we answer within a month. You have the right to:
- know what we hold about you and get a copy of it;
- have what is wrong put right;
- have your data deleted, where no law makes us keep it;
- have our use of it limited while a question about it is open;
- get your data in a form a computer can read, and take it elsewhere: a repository is kept as OpenEik, an open format;
- object to what we do on the ground of our legitimate interest (2.3, 2.5, 2.6).
If you think we handle your data wrongly, tell us. You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY): imy.se, imy@imy.se, Box 8114, SE-104 20 Stockholm, Sweden.
9. Changes
When EikHub changes, this policy changes with it: a new feature, a new sub-processor, a new rule. The date at the top says when it was last changed. If a change matters to how your data is handled, we tell you by email before it takes effect.
10. Contact
Questions, requests and complaints about personal data in EikHub: privacy@eikhub.com.
Karpa Gada AB · Reg. no. 559010-3858 · Simvägen 6, 312 72 Skummeslövsstrand, Sweden