Privacy Policy
Last updated 11 October 2026
This page explains what personal data en-view collects, why, who sees it and what your rights are. We keep it short and concrete: it describes what the service really does.
1. Who is responsible
en-visagePrismastigen 2
181-55 Lidingö
Organisation number: 770424-0733
E-mail: envisage@en-visage.com
We are the controller of the data described below, with one exception. Real-estate partners also type information about their own clients into the service (for example a client's name and e-mail address, so a delivery can be sent to them). For that data the partner decides why and how it is used and we process it on the partner's behalf. If you are such a client and want to see or remove your data, contact the partner who ordered the work first; we will help them with the request.
2. What we collect
- Account data – your e-mail address (it is your user name), phone number, the organisation (partner) you belong to, your role, and your password. The password is stored only as a one-way hash; nobody, including us, can read it. We also record which version of the Terms of Use you accepted and when.
- Order and delivery data – the orders you place or receive: property address, notes and instructions, the service ordered, who it was delivered to, dates and status.
- Files – the photos, videos, floor plans and documents that are uploaded to and delivered through the service.
- Messages – the service e-mails we send you (account confirmation, password reset, order and delivery notifications). Some notifications can be switched off in your settings.
- Invoicing data – the details on invoices: company names, invoice and billing addresses, VAT or tax numbers and amounts. Tax numbers and API secrets are encrypted in our database.
- Technical data – short-lived server logs that record errors and which signed-in user a request belonged to, so we can find and fix faults and protect the service from abuse. Requests to the programming interface (API) are also counted per address to limit abuse.
- API and AI-assistant credentials – if your organisation connects its own software or an AI assistant, the access keys and settings used for that connection.
We do not run advertising or analytics tracking on the site, and we do not sell personal data.
3. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR art. 6) |
|---|---|
| Create and run your account; take, produce, store and deliver orders; send service e-mails | Performance of a contract with you or your organisation (6.1.b) |
| Issue invoices and keep accounting records | Legal obligation – Swedish accounting law (6.1.c) |
| Keep the service secure, find faults, prevent abuse | Our legitimate interest in a safe and working service (6.1.f) |
| Answer your questions and requests | Legitimate interest, or the contract (6.1.f / 6.1.b) |
We do not currently rely on consent for anything. If that ever changes we will ask you first and you will be able to withdraw it.
4. Cookies and similar storage
en-view uses only what is needed to make the site work and to remember choices you make yourself. Because none of it is used for tracking, advertising or statistics, the law does not require your consent and you will not see a cookie banner. This covers cookies and the browser's local and session storage.
| Name | Purpose | Kept |
|---|---|---|
.AspNetCore.Identity.Application | Keeps you signed in. | Until you sign out or the session expires (up to 14 days) |
.AspNetCore.Antiforgery.* | Protects forms and requests from being forged by other sites. | Browser session |
Identity.TwoFactor* | Carries you through the second step of a two-factor sign-in. | A few minutes |
enview_filters | Remembers the filters you set on the order lists; reset on your next sign-in. | Browser session |
lang | Remembers the language you picked on public slideshow pages. | Browser session |
planResized | Remembers that the floor plan in a slideshow was already sized to fit. | 1 day |
| Local storage | An unsent order draft, the camera level-guide lock setting and a marker for which notifications you have seen, all on your own device. | Until you clear it |
| Session storage | Small helpers such as which tab or order you came from, so the Back button works. | Until the tab is closed |
You can delete any of this in your browser's settings. Deleting the sign-in cookie simply signs you out. If we ever add anything that is not strictly necessary, such as analytics, it will be switched off until you say yes.
5. Who else handles your data
- Hosting and database providers that run the servers the service lives on.
- Cloudflare (R2 storage) – stores the uploaded and delivered files.
- E-mail delivery provider – sends the service e-mails.
- Cloudflare cdnjs – the sign-in and registration pages load form-validation scripts from it, so your browser contacts Cloudflare (and your IP address reaches it) when you open those pages.
These providers act on our instructions, except where they are independent as described above. When data is transferred outside the EU/EEA we rely on recognised safeguards, such as the EU–US Data Privacy Framework or the EU Standard Contractual Clauses. Beyond this we share data only with people who are entitled to it in the service (for example the partner and vendor on an order) or when the law requires it.
6. How long we keep it
- Account data – while the account is active. On request we delete or anonymise it, unless we must keep something for legal reasons.
- Orders, deliveries and files – for as long as they are needed to provide the service and handle questions or complaints, or until you or your organisation ask for them to be removed.
- Invoices and accounting records – seven years after the end of the financial year in which they were made, as Swedish accounting law requires.
- Server logs – a short period, then they are deleted automatically.
7. Your rights
Under the GDPR you have the right to:
- ask for a copy of the personal data we hold about you;
- have incorrect data corrected;
- have your data erased, where there is no legal reason for us to keep it;
- restrict how we use your data, or object to use based on our legitimate interest;
- receive the data you gave us in a portable format;
- withdraw a consent, if you have given one.
To use any of these, write to us at the address above; we will answer within one month. If you are not satisfied with how we handle your data you can complain to the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY), or to the authority in your own country.
8. Security
The site is served over HTTPS. Access is limited by role, so people only see the orders and files they are entitled to. Passwords are hashed, and sensitive values such as tax numbers and API secrets are encrypted at rest. No system is perfectly secure, but we take reasonable technical and organisational measures and will notify you and the authorities where the law requires it.
9. Terms of Use
What may be uploaded and how the service may be used is set out in our Terms of Use, which every signed-in user accepts. We record which version you accepted and when.
10. Changes to this policy
When we change how we handle personal data we will update this page and its date. For significant changes we will also tell signed-in users.