What we do with your information.

Who we are

Ateliva is a product of Swepth Oy, a company registered in Finland with Business ID 3619574-3. You can reach us at hello@ateliva.com.

This policy covers the website at ateliva.com and the Ateliva application at app.ateliva.com.

The two things we are

Ateliva is sold to organisations, and that gives Swepth Oy two different roles at once.

For the account and the business relationship we are the controller. Your name, your email address, the workspace you own, what it is subscribed to and what we invoice for it are ours to decide about, and this policy describes them.

For the performance data inside a workspace we are the processor. The organisation that owns the workspace decides what is measured, who is measured, what is recorded and how long it is kept. We hold it and act on that organisation's instructions. The terms for that are on the data processing page.

If somebody invited you to a workspace

Your results, your targets and your place in a ranking belong to the organisation whose workspace you were invited to, not to us. If you want to know what is measured about you, why, or for how long, ask them first: they decide it, and we cannot answer for them.

Your account itself is yours. It is not owned by the organisation, you can belong to several, and leaving one does not delete it.

What we hold

Your account. Held by us as controller.

• your name and your email address
• a hash of your password, never the password
• the sessions you are signed in with, and when they were last refreshed
• which workspaces you belong to and in what role

What a workspace contains. Held by us as processor, for the organisation that owns it.

• the people in it, their display names, their teams and their roles
• results: a number, a metric, a person, a moment, and an optional note
• metrics, processes, targets, competitions and work sessions
• an audit history of who changed what, so a corrected number keeps its story
• where a result came from — a person, a spreadsheet, the API or a connected CRM

Billing. Held by us as controller.

• the Stripe customer the workspace is, and what it is subscribed to
• how many active accounts it has, which is what the price follows
• when the trial started and ends, and whether a payment failed

We never see or store a card number. Stripe holds the payment method, and Ateliva holds no part of it.

Connections you make yourself.

• an access token for a CRM you connected, encrypted and readable only by the server
• an identifier for each deal or record a result came from, so the same event is never counted twice
• an API key you created, stored as a hash, so nobody — including us — can read it back

A connected CRM gives Ateliva the smallest read permission the vendor offers. We do not copy contacts, phone numbers, notes or email threads out of it, and we never write to it.

Why we hold it, and on what basis

Under Article 6 of the GDPR:

• To provide what was bought. Running the workspace, signing you in and sending the emails the product needs to send — Article 6(1)(b), performance of a contract, or the legitimate interests of the organisation that invited you.
• To be paid. Subscriptions, invoices and seat counts — Article 6(1)(b).
• To keep the service safe. Rate limits, sign-in protection and the audit history — Article 6(1)(f), our legitimate interests and yours.
• To meet the law. Accounting records — Article 6(1)(c).

We do not profile you for advertising, we do not sell anything to anyone, and there is no automated decision that produces a legal effect about you.

Cookies and what is kept in your browser

The website at ateliva.com sets no cookies at all. It runs no analytics, keeps nothing in local storage and loads no third-party script. That is why there is no cookie banner: there is nothing to consent to.

The application at app.ateliva.com needs cookies to work. Being signed in is a cookie; there is no way to be signed in without one. They are strictly necessary, they are set by us and by nobody else, and there are no optional ones to turn off.

What the application keeps:

• a session cookie and a refresh cookie, so you stay signed in between pages
• a short-lived cookie during sign-in, to prove the round trip finished where it started

Signing out clears them. More detail is on the cookies page.

Who else touches the data

Four companies, each doing one job, each under a contract with us:

We will say on this page before a new one is added.

HubSpot, Pipedrive and Zapier are not on that list, on purpose. They are not our suppliers: they are systems a customer already has, connected by the customer, read by Ateliva only because the customer asked. Data flows from them to us, not the other way, and the customer's relationship with them is their own.

Leaving the EU

The application and the database both run inside the European Union: the server code in Stockholm, the database and sign-in in Ireland.

Two things reach further. Transactional email goes through a provider in the United States, so the address a message is sent to leaves the EU with it. Stripe contracts through Ireland and has group companies in the United States. Both transfers rely on the European Commission's standard contractual clauses.

How long we keep it

• A workspace's data stays while the workspace exists. Cancelling a subscription does not delete anything: the numbers a team recorded are the team's history, and losing them for missing a payment would be the wrong thing to do.
• Your account stays until you ask us to delete it.
• Diagnostic notes about a delivery that failed are deleted after 30 days.
• Accounting records are kept as Finnish law requires, which is longer than anything else here and is not ours to shorten.

Deleting a workspace is a request, not a button. Ateliva has no self-service delete for a whole workspace, and we would rather say so than imply otherwise. Write to hello@ateliva.com from the owner's address and we will confirm what will go, export anything you want to keep first, and then remove it. We aim to finish within 30 days.

Your rights

Where we are the controller — your account, and the billing relationship — you can ask us to:

• give you a copy of what we hold, or send it somewhere else
• correct something that is wrong
• delete it
• restrict or object to what we do with it

Write to hello@ateliva.com. We answer within a month and do not charge for it.

Where we are the processor — the performance data inside somebody's workspace — the request belongs to the organisation that owns it. Ask them. If you ask us, we will pass it on and help them answer, but we will not act on their data without them.

You can also complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or to the authority where you live.

Security

What is actually in place:

• every table in the database refuses by default, and a workspace's rows are reachable only by that workspace's members — enforced by the database, not by the application
• traffic is encrypted in transit; the database is encrypted at rest
• passwords are hashed, API keys are hashed, and CRM tokens are held in a vault the browser roles cannot read
• who changed what is written to an audit history that cannot be edited
• rate limits on sign-in, on email and on the public API

We hold no certification. We are not SOC 2 audited, not ISO 27001 certified, and we will not describe ourselves as bank-grade or enterprise-grade, because those words would mean nothing coming from us. What is written above is what exists and can be checked.

Children

Ateliva is sold to organisations for work. It is not for children and we do not knowingly hold data about anyone under 16.

Changes to this policy

If what we do with personal data changes, we update this page and change the date before the change takes effect. This version was written when Ateliva launched and replaced a policy that described a website with a waiting list.