Privacy Policy

The controller is Tony Forsman (enskild firma), a Swedish sole trader that runs the service under the name Obsidius. For anything about personal data, write to kontakt@obsidius.se.

• Account data – name, email address, organisation, role and a password stored only as a one-way hash. Purpose: to give you access and run the service. Legal basis: contract (GDPR art. 6.1 b), or our legitimate interest in providing the service to the organisation you work for (art. 6.1 f).
• Usage and security data – sign-in events, IP address, browser details, error logs and an audit trail of important changes in an account. Purpose: to keep the service secure, investigate problems and prevent misuse. Legal basis: legitimate interest (art. 6.1 f).
• Enquiries and access requests – what you send us when you contact us or ask for access: usually name, email, company and your message. Purpose: to answer you. Legal basis: legitimate interest (art. 6.1 f).
• Billing data – the organisation's billing contact, invoices and payment status. Card details are handled by our payment provider and never reach our servers. Legal basis: contract (art. 6.1 b) and legal obligation, for bookkeeping (art. 6.1 c).
• Service emails – we send emails that are part of the service, such as invitations, password and security messages and notifications you have turned on. We do not send marketing emails without your consent.

Customers decide what they store in Obsidius. Typically that is data about consultants and candidates (contact details, CVs, skills, availability, rates, notes), contacts at client companies, and assignments and contracts. We only use this data to provide the service to that customer, as described in the Data Processing Agreement. We never sell it, never use it for advertising and never use one customer's data for another.

Matching consultants to assignments runs on our own servers with an open-source language model. When you upload a CV, an AI model in our own Microsoft Azure account in Sweden (Azure OpenAI) reads it to fill in the profile and write a presentation. That data stays in Sweden, is not stored by the model and is never used to train it. Customer data is not sent to any other AI service.

We use a small number of suppliers (sub-processors), each bound by a data processing agreement:

• Microsoft Ireland Operations Ltd (Microsoft Azure) – hosting, database, file storage and the AI model that reads uploaded CVs (Azure OpenAI), in the Sweden Central region. All service data is stored and processed in Sweden.
• STRATO GmbH (Germany) – sending email from obsidius.se, and our own mailboxes.
• Stripe Payments Europe Ltd (Ireland) – payments and subscriptions, once paid plans are active.

Microsoft and Stripe belong to US groups. Where data could be accessed from outside the EU/EEA, the transfer is covered by the EU–US Data Privacy Framework and/or the EU Commission's standard contractual clauses. We may also disclose data when the law requires it, for example to authorities.

• Account data: for as long as the account is active, and deleted within 90 days after it is closed.
• Customer data: until the customer deletes it or the agreement ends; then deleted within 30 days, and from backups within a further 14 days.
• Security logs and audit trail: up to 12 months.
• Enquiries and access requests: up to 12 months after our last contact.
• Invoices and bookkeeping records: 7 years, as Swedish bookkeeping law requires.

We only use what is needed for the service to work. There are no advertising or tracking cookies.

• obsidius_auth – keeps you signed in. Set when you sign in; expires after 7 days or when you sign out. Strictly necessary.
• Local storage in your browser – remembers your light/dark theme and dashboard layout. It stays on your device and is not sent to us.

Because these are strictly necessary, we don't ask for consent for them.

We protect data with encryption in transit and at rest, strict separation between customer accounts, hashed passwords and limited access. Read more on our Security page.

Under the GDPR you have the right to:

• get a copy of the personal data we hold about you (access);
• have incorrect data corrected;
• have data deleted when it is no longer needed or we have no legal basis to keep it;
• have processing restricted while a complaint is looked into;
• get your data in a machine-readable format (portability);
• object to processing based on our legitimate interest.

Write to kontakt@obsidius.se. We answer within one month. If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (IMY), imy.se.

If we change this policy in a way that matters, we tell account owners by email before the change takes effect. The date at the top always shows the latest version.