Privacy policy
This policy explains how Code F AB ("Code F", "we", "us") handles personal data on this website and in our products: CRM, AI Insights, OMS and Check-in (together, the "Services").
1. Who we are
Code F AB, org.nr 559385-6338, Metergatan 10, 507 43 Borås, Sweden. Email: info@codefab.dev. We are a small company and have not appointed a data protection officer; privacy questions go to the address above.
2. Our two roles
- Processor. For the data our customers put into the Services (for example their contacts, orders, worksites, employees' time records or connected databases), the customer is the controller and we process the data only on the customer's instructions. That processing is governed by our Data Processing Agreement. If you are a customer's contact or employee, please contact that company first.
- Controller. For our own business, such as customer accounts and users, billing, support correspondence, sales enquiries and this website, we are the controller. The rest of this policy mainly describes that processing.
3. What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| User accounts: name, work email, organisation, role, sign-in and two-factor settings | Giving access to the Services and keeping them secure | Contract; legitimate interest in security |
| Audit and security logs: who did what and when, IP address, browser | Security, troubleshooting, preventing misuse | Legitimate interest |
| Billing details: company name, contact person, invoice address, usage | Invoicing and accounting | Contract; legal obligation (bookkeeping) |
| Emails and messages you send us | Answering questions, support and sales | Legitimate interest; contract |
| Website server logs: IP address, time, page, browser | Delivering the website and protecting it from attacks | Legitimate interest |
We do not sell personal data, and we never use our customers' data, or their contacts' data, for our own marketing.
4. Cookies and tracking on this website
codefab.dev does not use analytics, advertising or tracking cookies, and does not load third-party trackers. The Services themselves use the cookies and browser storage needed to keep you signed in and remember your settings. These are strictly necessary and do not require consent.
OMS loads its typeface from Google Fonts, which means your browser connects to Google's servers when you open it.
5. Who we share data with
We use the following sub-processors to run the Services:
| Provider | Purpose | Location | Used by |
|---|---|---|---|
| Hetzner Online GmbH | Infrastructure hosting: servers, databases, file storage and backups | Germany (Nuremberg), EU | All products |
| Berget AI | AI language model that generates assistant replies, queries and summaries. Only the content needed for the request is sent | Sweden, EU | CRM (AI assistant), AI Insights |
| Amazon Web Services (Amazon SES) | Delivery of system emails such as sign-in invitations, password resets and account notifications | Sweden (Stockholm region), EU. AWS is certified under the EU–US Data Privacy Framework | All products |
| Google (Gmail) | Delivery of order and job emails sent from OMS | EU and USA (EU–US Data Privacy Framework and Standard Contractual Clauses) | OMS |
If a customer enables an integration, we send the data needed for it to the provider the customer has chosen, using the customer's own account:
| Provider | Purpose | Location | Used by |
|---|---|---|---|
| Sinch | SMS and RCS message delivery | EU region by default (a US region can be selected) | CRM |
| Your SMTP email provider | Delivery of the emails and campaigns you send | Depends on your provider | CRM |
| Twilio SendGrid | Email delivery, if chosen instead of SMTP | USA (Standard Contractual Clauses) | CRM |
| Mailchimp (Intuit) | Synchronising contacts and audiences with your Mailchimp account | USA (Standard Contractual Clauses) | CRM |
| Cloudflare Turnstile | Bot protection on public sign-up forms | Global network | CRM |
| Mapbox and geocode.maps.co | Map display and turning worksite addresses into coordinates | USA | OMS |
For our own email (info@codefab.dev) we use Forward Email for forwarding and Google (Gmail) as the mailbox. Our domain's DNS is hosted by GoDaddy, which does not receive customer data. We may also disclose data where the law requires it.
6. Where data is stored
The Services run in Hetzner's data centre in Nuremberg, Germany, and customer data is stored in the EU. If a provider processes personal data outside the EU/EEA (see the tables above), the transfer is protected by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
7. How long we keep data
- Account and customer data: for as long as the agreement runs. After it ends, the data is exported or returned on request and then deleted, normally within 30 days.
- Backups: database backups are kept for 14 days and then overwritten.
- Invoices and bookkeeping records: seven years, as required by the Swedish Accounting Act (bokföringslagen).
- Unsubscribes and suppression lists in CRM: as long as needed to keep honouring them.
- Logs: only as long as needed for operation and security; they are rotated automatically.
- Support and sales emails: as long as needed to handle the matter and follow up.
8. Your rights
Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, and to data portability. Email info@codefab.dev and we will respond within one month. If your data is in the Services as a customer's contact or employee, we will forward the request to that customer, as they decide how their data is handled.
You can also lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se.
9. Security
We protect personal data with technical and organisational measures that suit the risk, including encryption in transit, row-level isolation between customers and two-factor sign-in. See Security & GDPR for details.
10. Changes
We update this policy when our processing changes. The date at the top shows the latest version. Material changes affecting customers are announced by email.