Privacy Policy

Who we are

Sentrive is provided by Sebastian Mattsson, a sole trader (enskild firma) in Sweden, trading as Sentrive. In this policy, “we” and “us” mean Sentrive. You can reach us about anything here at hello@sentrive.ai.

Your data and your company’s data

Sentrive holds two kinds of personal data, and our role differs for each.

• Your account: your name, email address and how you use your account. We decide what happens to it, so for this data we are the controller, and this policy describes it.
• Your company’s data: the customers, people, subscriptions, invoices, payments, notes, tasks and conversations a company keeps in its Sentrive workspaces, from the tools it connects or from its own people. The company decides what happens to it and is the controller; we process it only on its instructions, under our Data Processing Agreement.

If your details are in a company’s workspace, for example because you are one of its customers, that company is the one to ask about them. We’ll help it answer.

What we collect, why, and on which legal basis

• Your account: your name, email address and password, which we store only as a hash we can’t turn back into the password. We need them to create your account, confirm your address and sign you in. Legal basis: the contract with you (Article 6(1)(b) GDPR).
• Your sign-ins: each signed-in browser’s session, with the IP address and browser it signed in from. They keep you signed in and let us spot misuse. Legal basis: the contract, and our legitimate interest in keeping accounts safe (Article 6(1)(f)).
• Limits on attempts: to stop password guessing, we count sign-in and similar requests by IP address and by a hash of the email address, and, for Ask Sentrive and AI apps, requests by account or connection. Legal basis: our legitimate interest in keeping accounts safe.
• Your workspaces: the workspaces you belong to, your role in each, and the invitations you send, including the email address of the person you invite, whom we email the invitation. Legal basis: the contract, and for the person invited, the inviting company’s legitimate interest in adding them.
• The audit log: who proposed, approved and made each change in a workspace, and when. Companies rely on it to know what happened in their business. Legal basis: legitimate interests in accountability and security.
• AI request records: for each request an AI makes for you, who it was for, which AI, when, which tools it used, which records it read and what it cost, but never what was asked or answered. They let your company see what AI did and keep AI spending within its limit. Legal basis: legitimate interests in accountability and in controlling costs.
• Email we send you: Amazon Web Services sends the messages that confirm your address, reset your password or invite you. Legal basis: the contract.
• Error reports: when something fails, we record the kind of error and where in the code it happened. They are built to hold no personal data: no messages, addresses, cookies or who was using Sentrive. Since they hold no personal data, no legal basis is needed for them.
• What you write to us: if you email us, we use what you send to answer you. Legal basis: our legitimate interest in replying, or the contract when you are a customer.

We don’t sell personal data, show ads, or use anyone’s data to train AI.

AI and Anthropic

Ask Sentrive answers questions about your company. To answer, it sends your question and what it reads from the workspace (only what your role lets you see) to Anthropic’s API, which runs in the United States, for both the EU and the US copy of Sentrive. Under Anthropic’s commercial terms, Anthropic doesn’t train its models on what we send it.

Some data never goes to any AI: customers’ email addresses, phone numbers and postal addresses are hidden from it. Each workspace’s Settings → Privacy shows what is hidden. When you connect your own AI app to Sentrive, it reads only what your role allows, and it processes what it reads under your terms with that app’s provider.

Where data lives, and who processes it

Each workspace lives in one copy of Sentrive: the EU copy (eu.sentrive.ai), hosted in Frankfurt with its email sent from Stockholm, or the US copy (us.sentrive.ai), hosted in the United States. The copies share nothing, and your account lives in the copy you signed up on.

We use a few companies to run Sentrive: Vercel (hosting), Neon (database), Render (background work), Amazon Web Services (email), Anthropic (AI) and Sentry (error monitoring). Our list of subprocessors says what each does and where.

Some of these companies are in the United States, and Anthropic processes data there for both copies. Where personal data leaves the European Economic Area, it is protected by the safeguards in each company’s data processing terms, such as the European Commission’s Standard Contractual Clauses or the EU-U.S. Data Privacy Framework; the list of subprocessors says which, where their terms say it.

Cookies

Sentrive uses only the cookies it needs to work for you, and no analytics, advertising or tracking of any kind, so there is nothing to accept or refuse:

• The session cookie keeps you signed in. It ends when you sign out, or after a week without using Sentrive.
• The last-workspace cookie remembers which workspace you opened last in this browser, so Sentrive opens it next time. It holds only that workspace’s address and lasts up to 400 days.

Your choice of light or dark theme is kept in your browser’s own storage, never sent to us.

How long we keep data

• Your account: for as long as you have it. There is no button to close an account yet: email us and we’ll delete it within 30 days.
• Your sessions: a session stops working after a week without use. Its record, with the IP address and browser it signed in from, is deleted when you sign out or when that browser comes back after it has expired; otherwise it is kept until your account is deleted.
• Your company’s workspace data: until the company deletes it or asks us to. It can disconnect a tool and delete what that tool synced. To delete a whole workspace, its owner emails us, and we delete it within 30 days.
• Ask Sentrive conversations: until the person who had them deletes them. They never delete themselves.
• The audit log and AI request records: kept, and never deleted automatically, so a workspace’s record of what happened stays complete. They are deleted with the workspace when its owner asks us to delete it.
• The counts that limit attempts: they hold IP addresses and hashed email addresses, and are deleted automatically about an hour after each count starts, the next time Sentrive counts a request.

Your rights

You can ask us for a copy of your personal data, and ask us to correct it, delete it, limit what we do with it, or send it to you in a form you can take elsewhere. You can object to what we do on the basis of our legitimate interests.

To use any of these rights, email hello@sentrive.ai from the address of your account, or tell us how to recognise you. We’ll answer within one month. If your data is in a company’s workspace, ask that company first; we’ll help it answer.

Complaints

If you think we handle your data wrongly, please tell us first so we can put it right. You can also complain to Sweden’s data protection authority, Integritetsskyddsmyndigheten (IMY), or to the authority where you live or work.

Changes to this policy

When this policy changes, the date at the top changes too. If a change matters to how we use your data, we’ll email account holders before it applies.

Contact

For anything about privacy, these pages or Sentrive itself, write to hello@sentrive.ai. Sentrive’s Terms of Service and Data Processing Agreement cover the rest.