Privacy Policy

1.1 The controller is Sting Studio AB, a Swedish limited company with organization number 559179-6775 and VAT number SE559179677501, with its registered office in Stockholm, Sweden ("Sting", "we", "us").

1.2 Write to privacy@sting.studio for anything to do with data protection: questions about this Policy, requests to exercise your rights, and complaints. Write to legal@sting.studio for contract notices under the Terms, reports of illegal content, and reports of a security problem.

1.3 We have not appointed a data protection officer. We are not required to appoint one.

1.4 Our lead supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, Sweden, imy@imy.se, https://www.imy.se.

1.5 This Policy is written in US English. That English text controls over any translation.

2.1 This Policy applies to personal data we process as controller in connection with:

• visits to sting.studio, including the teaser and any landing page;
• a waitlist or beta-request submission;
• creating or administering a private-beta studio account, including magic-link sign-in;
• opening a handover link or signing in to the client portal, including the session cookie we set and the access log we write;
• security, abuse-prevention, and service logs;
• support and other correspondence you send us;
• signing up for our email newsletter and choosing what to receive; and
• cookies and similar technologies on our sites.

2.2 Sting the product is job-record and closeout software for small creative studios. During the private beta it is an evaluation environment, described in the Terms at sting.studio/terms.

2.3 We are a processor, not a controller, for personal data contained in Customer Content: job and client records, names and emails a studio types in, handover text, deliverable files, CSV imports, approve or needs-changes comments, and similar material the studio puts into the product. That processing is governed by Annex A to the Terms, not by this Policy. If you are a client or other individual whose data a studio entered, contact that studio. Section 11.4 explains what we do with a request that reaches us instead.

2.4 The session cookie we set on a portal visitor's device, and the connection and security metadata we write when a handover link or portal session is used — the time, the IP address, the user-agent, and which link or tenant was accessed — are a separate matter. We decide to keep those to run and secure the service, so we are controller for them and this Policy describes them. The studio's own record of what happened with the handover — whether and when it was opened, approved, or marked as needing changes, together with the recipient's email address — is different. The studio asked us to keep that record, so it is Customer Content governed by Annex A to the Terms, not by this Policy.

2.5 The Beta Program is for business use by people aged 18 or over. We do not knowingly collect personal data from children. If you believe we have, write to privacy@sting.studio and we will delete it.

3.1 Waitlist and marketing-site submissions. When you join the waitlist or ask for a beta invitation we collect the information you submit. That typically includes your name, business email address, studio or company name, and any message or other field on the form. We also record that you accepted the Terms and this Policy, the time of submission, and basic technical data about the request (IP address, user-agent, and similar).

3.2 Account and studio administration. If we invite you, we collect the email you use to sign in, your studio name, membership records, timezone and similar settings, and the fact that you accepted the Terms and this Policy. There is no password. Sign-in is a single-use, time-limited magic link sent to that inbox.

3.3 Authentication, security, and usage logs. We keep hashes of magic-link tokens and session identifiers, timestamps, IP addresses, user-agent strings, requested URLs, and administrative events such as sign-in, sign-out, session revocation, and tenant actions needed to secure the service. Tokens and sessions are stored as hashes, not as the secret itself. We generate these logs for our own security and audit purposes and we decide what goes in them, so we are controller for them.

3.4 Handover and portal access. When someone opens a handover link or signs in to the client portal we set a session cookie on that device and record the time, the IP address, the user-agent, and which link or tenant was accessed. We use that to keep the session working, to let the studio revoke a link, and to investigate abuse. We do not describe here the studio's own record of whether a handover was opened, approved, or marked as needing changes: that record is Customer Content the studio asked us to keep, and it is covered by Annex A to the Terms, not by this Policy.

3.5 Correspondence. If you write to privacy@sting.studio, legal@sting.studio, or another address we publish, we keep the content of that correspondence and the metadata needed to handle it.

3.6 Site and product analytics. We use Vercel Web Analytics and Cloudflare Web Analytics on sting.studio and, where enabled, on the application. Neither tool sets an analytics cookie or uses localStorage to identify you. They collect page URL (query strings filtered or omitted where the vendor allows), referrer, approximate location derived from IP (country or region; the IP itself is not stored as an identifier), browser and device type, and page-timing metrics. Vercel identifies a visitor with a hash derived from the request that is discarded after 24 hours and is not used to recognize you across days or across sites. Cloudflare Web Analytics does not assign a persistent visitor identifier.

3.7 Email delivery metadata. Transactional mail (waitlist confirmation, invitations, magic links, security notices, and legal notices) and newsletter mail, for people who signed up for it, are sent through Resend. Resend stores message content, recipient address, delivery logs, and webhook payloads. See section 8.

3.8 What we do not collect. We do not ask for or intentionally collect government ID, payment-card data, passwords, special-category data under Article 9 GDPR, or data about criminal convictions under Article 10 GDPR. If you send us something like that in correspondence we will keep it only as long as we need it to deal with your message. We do not run advertising pixels, social-login buttons, or cross-site advertising trackers.

3.9 Sources. We collect data from you (forms, account settings, mail you send), from your device (logs and analytics), and from our vendors acting on our instructions (delivery events from Resend, platform logs from Vercel). We do not buy lists.

3.10 Whether you have to give us this data. Giving us an email address is necessary if you want to join the waitlist, receive an invitation, or sign in by magic link. It is a requirement of entering into the Terms with us. If you do not give it, we cannot put you on the list or give you beta access. The other fields on the waitlist form are optional and leaving them blank does not affect whether we invite you.

3.11 Newsletter sign-up. If you sign up for our email newsletter, we collect the email address you give us and record that you agreed to receive it, when you agreed, and which categories you chose. The newsletter has its own checkbox, separate from the box you use to accept the Terms and this Policy, so accepting the Terms and this Policy does not sign you up for it. Signing up for the newsletter is optional and is not a condition of joining the waitlist or getting beta access.

We process personal data only where Article 6 GDPR gives us a basis.

4.1 Service mail and the newsletter are different things. Confirmation that we received your request, an invitation if we send one, magic links, security notices, and notices under the Terms are service mail needed to run the Beta Program. They do not depend on consent and there is no unsubscribe link for them, because you cannot join the waitlist or use the beta without them. The newsletter is separate: we send it only to people who tick its own checkbox, you choose which categories to receive when you sign up, and every newsletter email carries a link to change that choice or unsubscribe. You can also write to privacy@sting.studio to unsubscribe or to have your newsletter sign-up deleted. Unsubscribing from the newsletter does not remove you from the waitlist and does not stop the service mail listed above.

4.2 We do not sell personal data. We do not use personal data to train, fine-tune, or evaluate a machine-learning or generative-AI model, whether our own or a third party's.

4.3 We do not make solely automated decisions that produce legal or similarly significant effects about you.

4.4 Where we rely on legitimate interests, we have balanced those interests against your rights and recorded that assessment. You may object at any time under section 11.

5.1 We generate counts, timings, and error rates from the site, the application, and our logs. These are aggregated so that they cannot identify you and cannot be reconstructed into Customer Content. Once aggregated they are no longer personal data, and we use them without restriction to run and improve the product.

6.1 The marketing site at sting.studio does not set an analytics cookie. Vercel Web Analytics and Cloudflare Web Analytics are cookieless. They do not use localStorage to identify you.

6.2 The application sets first-party, httpOnly session cookies that are strictly necessary to keep a session alive after a magic link or a portal sign-in: one cookie for studio users, and a separate cookie for the client portal. These cookies are not used for advertising. They expire when the session expires or is revoked. We also check Origin and Referer headers on state-changing requests to prevent cross-site request forgery. That check is not a cookie.

6.3 Under the ePrivacy rules that implement Directive 2002/58/EC, strictly necessary session cookies do not require consent. Our analytics tools do not store or read information on your device beyond loading a script and sending a beacon, so we consider them outside the consent rule as well. They remain personal-data processing under the GDPR and are described in sections 3.6 and 4. Browser settings that block third-party scripts will stop the beacons.

6.4 We do not respond to a "Do Not Track" signal, because there is no single agreed standard for it. US opt-out requests are handled under section 12.

7.1 We do not sell personal data and we do not share it for cross-context behavioral advertising.

7.2 We use vendors to run the site and the Beta Program. They process personal data on our instructions and under a written data processing agreement. Where the same vendors also handle Customer Content they act as subprocessors under the Terms, which is a separate arrangement with the studio.

7.3 We may also disclose personal data to professional advisers under a duty of confidence; to a successor if we transfer the Sting product, on notice to you; or if required by EU or Swedish law or a binding order. We will tell you before a legal disclosure where the law allows.

8.1 Sting Studio AB is established in Sweden. Application compute, uploaded files, and the database are in the EU, as section 7.2 states. A pinned region controls where data sits, not which law reaches the company that holds it.

8.2 Vercel, Neon, Cloudflare, and Resend are United States companies. Platform logs, analytics, vendor account metadata, support access, and, for mail, message content are processed in the United States. Traffic to our domains is also proxied through Cloudflare's network, so requests to sting.studio and the application pass through infrastructure Cloudflare operates before reaching our servers. US law may reach data those companies hold wherever it is stored.

8.3 Each transfer is made on one of: an adequacy decision under Article 45 GDPR, including the EU-U.S. Data Privacy Framework where the recipient is certified; the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914; or another lawful mechanism we identify in writing. We hold a copy of each vendor's data processing terms. A copy, or the relevant clauses, redacted where a vendor's commercial terms require it, is available on request to privacy@sting.studio.

8.4 Email is the clearest case. If you give us an address, the body of mail we send to it is stored outside the EU.

9.1 We keep personal data only as long as needed for the purposes in section 4, then delete or anonymize it, unless EU or Swedish law requires a longer period.

9.2 In practice:

• Waitlist. Kept until you ask to be removed, or until 24 months after the date you submitted the request if we never invite you. If we invite you, the record becomes account data.
• Newsletter sign-up. Kept until you unsubscribe or withdraw consent. After that we keep a short suppression record of the address so we do not re-add it by mistake, and delete the rest.
• Account and studio administration. Kept for the life of your beta access, then deleted within 30 days after that access ends.
• The record that you accepted the Terms and this Policy. Kept for as long as a claim about the agreement can be brought under Swedish law, currently ten years. This record is the acceptance itself and its timestamp, nothing more.
• Customer Content. Deleted or returned under the Terms. This Policy does not set that period.
• Authentication, security, audit, and portal access logs. 12 months.
• Encrypted backups. Overwritten on a rolling cycle of no more than 90 days. Personal data in a backup stays subject to this Policy until it is overwritten.
• Correspondence. 24 months after the last message in the thread, longer if needed for a claim or a statutory duty.
• Analytics. Held in aggregated form by the vendor. Cloudflare keeps detailed beacon data for a short window and aggregates thereafter; Vercel stores anonymized data points. We do not export analytics into our own identifiable database.
• Mail held by Resend. Subject to Resend's own retention. We will request deletion where the vendor supports it.

10.1 We implement technical and organizational measures appropriate to a non-production evaluation service under Article 32 GDPR: passwordless sign-in, expiring and revocable sessions, encryption in transit and at rest, tenant isolation, hashed handover tokens, expiring signed file URLs, administrative access limited to named people with multi-factor authentication, and an incident process with a named owner. A fuller description is available on request to privacy@sting.studio.

10.2 No method of transmission or storage is perfectly secure.

11.1 Subject to the conditions and exceptions in the GDPR (and the UK GDPR or Swiss FADP where those apply to our processing), you have the right to:

• access your personal data and obtain a copy;
• have inaccurate data corrected and incomplete data completed;
• have data erased in the cases Article 17 lists;
• restrict processing in the cases Article 18 lists;
• receive data you provided to us in a structured, commonly used, machine-readable format, and transmit it to another controller where Article 20 applies;
• object at any time to processing based on legitimate interests;
• withdraw consent where we ever rely on it, without affecting processing before the withdrawal; and
• lodge a complaint with a supervisory authority.

11.2 To exercise a right, write to privacy@sting.studio. We may need to confirm it is you. We will respond without undue delay and in any event within one month, extendable by two further months for complex or numerous requests, in which case we will tell you why.

11.3 An objection to analytics needs one caveat. Analytics events are not linked to a name, an account, or a persistent identifier, so we cannot find your past events in order to isolate or delete them, and we will tell you so rather than pretend otherwise. Blocking the script in your browser stops new beacons, as section 6.3 explains.

11.4 If your request concerns Customer Content that a studio controls and we only host, we will not answer on the studio's behalf. We will pass the request to the studio without undue delay and in any event within five business days, and tell you that we have done so.

11.5 You may complain to IMY (section 1.4). If you are in another EEA state you may instead complain to your local authority. If you are in the United Kingdom you may complain to the Information Commissioner's Office (https://ico.org.uk). If you are in Switzerland you may complain to the Federal Data Protection and Information Commissioner.

12.1 Sting does not offer the Beta Program to consumers for personal or household use. This section is for individuals in California and in other US states with similar privacy laws (including Colorado, Connecticut, Virginia, and Utah) whose personal data we nonetheless process as controller.

12.2 In the last 12 months we have collected the categories of personal information described in section 3: identifiers (name, email, IP address); commercial-style information about a waitlist or beta request; internet or electronic-network activity (logs and analytics events); and geolocation at country or region level derived from IP. We collect them from the sources and for the purposes in sections 3 and 4. We do not collect sensitive personal information as that term is used in the CCPA/CPRA for controller processing under this Policy.

12.3 We do not sell personal information and we do not share it for cross-context behavioral advertising. We have no knowledge of selling or sharing the personal information of anyone under 16. We do not use or disclose sensitive personal information for purposes that require a right to limit under the CPRA.

12.4 We disclose personal information to the vendors in section 7 for the operational purposes described there. Retention is described in section 9.

12.5 Subject to the exceptions in applicable state law, you may request that we disclose the personal information we hold about you, delete it, or correct inaccuracies. Authorized agents may submit a request if state law allows, with proof of authority. We will verify the request and will not discriminate against you for exercising a right. Write to privacy@sting.studio. If we refuse, and state law gives you an appeal, reply to our decision and we will handle the appeal.

12.6 We do not currently honor a universal opt-out preference signal, including the Global Privacy Control, as an opt-out of sale or sharing, because we do not sell or share personal information as those statutes define those terms. If that changes, we will update this section.

13.1 We may update this Policy. We will post the new version on sting.studio with a new effective date, and the version on sting.studio is always the current one. If a change materially affects how we use data we already hold about you, we will email the address we hold for you at least 14 days before it takes effect.

13.2 Annex A to the Terms is not part of this Policy and changes under the Terms.