Privacy notice for Aldorock Underlag
Version 2026-11-11. Applies from 11 November 2026
1. Who is responsible
For details about the firm's clients, the firm is the controller and Aldorock the processor, see the data processing agreement. For details about the firm's own users and about payment, Aldorock AB, company number 559607-5985, VAT number SE559607598501, Gammelgårdsvägen 58, 112 64 Stockholm, Sweden is the controller.
2. Details about the firm's users
Name, e-mail address and Microsoft 365 id when the user signs in, the user's role and a log of events. The purpose is to give access to the service and to show who did what. The legal basis is the agreement with the firm.
3. Payment
The firm's name, company number, billing address and e-mail for receipts. Card details are handled only by Stripe. Invoices are kept for seven years under the Swedish Bookkeeping Act. The legal basis is the agreement and a legal obligation. For a sole trader the company number is a personal identity number. It is kept at Aldorock only, not sent to Stripe, not printed on the invoice and never shown to the firm's clients.
Stripe Payments Europe, Ltd. (Ireland) receives the billing details for the payment. Stripe may transfer data to Stripe, Inc. in the USA. This relies on Stripe's data processing agreement, the EU standard contractual clauses and the EU US Data Privacy Framework.
4. Clients who upload
The client needs no account. Aldorock processes the client's details on the firm's behalf. The files go straight to the firm's Microsoft 365. The client can stop reminders with the link in every e-mail.
5. The website and cookies
The website uses no analytics and no tracking cookies. One necessary cookie keeps the sign in and the language. The sample page keeps no files. The details about them are deleted within an hour. Calls are counted per network address to stop abuse. The address is then stored only in hashed form and deleted after a day.
6. How long
- Details about a request (the client's name and e-mail, the checklist, file names and sizes, comments, reminders) are deleted when the period the customer has chosen has passed after the request was closed. The default is 90 days, the customer chooses between 7 and 3650 days.
- A client with no request left is deleted when the same period has passed.
- The customer can delete a client with no open request at any time.
- An open request whose link has expired is closed by the service 30 days later, and then deleted like other closed requests.
- Everything the firm has at Aldorock is deleted at once when an administrator asks for it in Settings, and otherwise 30 days after a paid subscription ended if nobody has signed in since. A receipt goes to the firm's e-mail.
- The event log holds only ids and events, no names, and is deleted after 400 days.
- The sample page on the website keeps no files. The file passes through the service and is thrown away at once. The details about it are deleted within an hour.
- The content of files is never stored at Aldorock. It sits in the customer's own Microsoft 365 and the customer decides for how long.
7. Recipients
Aldorock uses the listed sub processors, and Stripe for payment (section 3). Data is never sold and is not used for advertising or AI.
8. Your rights
You have the right to know which details are processed, to have them corrected or erased, to object and to move them. If you are a client of a firm, contact the firm first. You can complain to the Swedish Authority for Privacy Protection (IMY).
Contact: support@aldorock.com