Effective date: 8 September 2026
This Privacy Policy is issued by Compounder Services AB, a limited liability company registered in Sweden ("Compounder", "we", "us", or "our"). Compounder Services AB is the legal entity behind the Compounder platform.
We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR. All data-protection matters are handled by the contact given in section 16.
Our role under the GDPR depends on which data is involved, and the distinction matters for your rights:
| Data | Our role | Your role |
|---|---|---|
| Account and user data you give us directly when registering and using the platform | Controller | Data subject |
| Business and financial records retrieved from the systems you choose to connect, including personal data about your employees, customers and suppliers | Processor | Controller |
| Security, availability and usage telemetry about the platform itself | Controller | Data subject |
Where we act as processor, we process personal data only on your documented instructions. Those instructions, and the other terms required by Article 28(3) GDPR, are set out in the Data Processing Agreement that forms part of our Terms of Service and applies automatically to every customer — you do not need to request or sign a separate document for it to be in force.
When you choose to connect an external data source, we store the credentials or tokens required to synchronise data on your behalf. Credentials are encrypted at rest using industry-standard cryptographic methods and are accessible only by the service processes that need them to perform the synchronisation you have authorised.
When you connect an external system, we retrieve the records required to deliver the features you have enabled. Depending on the system and the features you configure, this may include:
We only retrieve data categories that are necessary for the features you have enabled. You can review and change which categories are enabled at any time from within the application.
Most personal data we hold about individuals other than our own registered users — your employees, customers and suppliers — is not collected from those individuals directly. It reaches us from the accounting, ERP, point-of-sale, payroll and banking systems that you have connected, using the official authorisation flows those systems provide. Because we act as your processor for that data, the obligation to inform those individuals under Articles 13 and 14 GDPR rests with you as controller, and we will support you in meeting it.
We do not purchase personal data, and we do not enrich your data from third-party data brokers.
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide the reporting, analytics, and automation features of the service | Performance of contract |
| Authenticate users and protect account security | Legitimate interest; legal obligation |
| Send service and security notifications | Performance of contract; legitimate interest |
| Detect and prevent fraud, abuse, and security incidents | Legitimate interest; legal obligation |
| Improve product quality and performance | Legitimate interest (aggregated / anonymised) |
| Comply with legal, tax, and accounting obligations | Legal obligation |
Where we rely on legitimate interest, we have carried out a balancing assessment and concluded that our interest in operating and securing the service does not override your rights and freedoms. You may object to such processing at any time (see section 9), and you can request a summary of that assessment.
We do not sell, rent, trade, or market your data, or the data we retrieve from systems you have connected, to any third party. We do not use your data to train general-purpose machine-learning models.
Parts of the service use automated processing, including machine learning, to generate summaries, answers, and insights. Inputs to these features may include a condensed, non-sensitive summary of your data together with the question you have asked. We use only service providers whose commercial terms prohibit the use of customer inputs to train general-purpose models. You can disable AI features in your account settings.
No solely automated decisions with legal effect. We do not take decisions about you that produce legal effects or similarly significantly affect you based solely on automated processing, within the meaning of Article 22 GDPR. AI-generated output in the platform is decision support: it is presented to a person who decides what to do with it, and it is never presented as audited professional advice.
We disclose personal data only to:
If we receive a binding request from a public authority for access to your data, we will — unless legally prohibited — inform you before disclosing anything, and we will challenge requests that appear unlawful or overbroad.
Your data is hosted within the European Union. We apply a defence-in-depth security approach including:
These measures are appropriate to the risk under Article 32 GDPR. No system is perfectly secure, and they are not a guarantee against every possible attack.
We retain your data for as long as your account is active. When you disconnect an integration, the associated credentials are revoked and removed within 24 hours. When you delete your account, all personal data and data retrieved from connected systems are deleted within 30 days, except where retention is required by law (for example, the Swedish Accounting Act requires certain records to be retained for 7 years) or where data has been fully anonymised for statistical purposes.
Under GDPR and applicable local law you have the right to:
To exercise any of these rights, email privacy@compounder.dev. We respond within one month of receiving your request. Where a request is complex, or where you have made several, we may extend that period by up to two further months and will tell you within the first month if we do (Article 12(3) GDPR). Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.
If your data reached us through a customer of ours — for example because you are an employee, customer or supplier of a company that uses Compounder — we act as processor and cannot decide on your request ourselves. Please contact that company directly. If you contact us instead, we will forward your request to them without undue delay and tell you that we have done so.
We engage a limited number of reputable sub-processors to help deliver the service, covering the following categories:
| Category | Purpose |
|---|---|
| Cloud infrastructure and hosting | Running the application and storing your data |
| Automated processing / AI model providers | Generating summaries, answers and insights on request |
| Transactional email and messaging delivery | Sending service, security and briefing notifications |
| Payment and billing services | Processing subscription payments |
| Error monitoring and operational telemetry | Detecting and diagnosing faults |
Each sub-processor is bound by a written agreement imposing data protection obligations no less protective than those in this Privacy Policy and in our Data Processing Agreement. We remain fully liable to you for their performance.
A current list naming each sub-processor, its role and its location is available on request at privacy@compounder.dev. We will give you at least 30 days' notice before adding or replacing a sub-processor that processes personal data on your behalf. If you have a reasonable, data-protection-related objection, tell us within that period and we will work with you to find an alternative; if we cannot, you may terminate the affected part of the service without penalty for the remainder of the prepaid term.
Where a sub-processor is located outside the European Economic Area, international transfers are protected by appropriate safeguards under Chapter V GDPR — an adequacy decision where one applies, otherwise the Standard Contractual Clauses adopted by the European Commission, supplemented by a transfer impact assessment and additional technical measures where required. A summary of current third-country transfers is available on request.
We use only strictly-necessary cookies, to maintain your login session and to protect against cross-site request forgery. Because those cookies are essential to a service you have actively requested, they do not require consent under the Swedish Electronic Communications Act or the ePrivacy Directive. We do not use advertising, marketing, or third-party tracking cookies, and we do not build behavioural profiles. Session cookies are cleared when you log out.
You may choose to connect external systems to the service. Your use of those systems is governed by their own terms and privacy policies. We access those systems only via the official authorisation flows they provide and only for the purposes you enable. You can revoke our access to any connected system at any time from the settings of that system or from inside our application. Once revoked, we cease all access immediately and delete stored credentials within 24 hours.
We are not affiliated with, endorsed by, or a partner of any specific external provider unless expressly stated in writing. Trademarks belong to their respective owners.
In the event of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the Swedish supervisory authority within 72 hours of becoming aware of the breach, in accordance with Article 33 GDPR, and we will notify affected users without undue delay. Where we act as your processor, we will notify you without undue delay after becoming aware of a breach affecting your data, with enough information for you to meet your own notification duties.
The service is a business-to-business product and is not directed at children under 16. We do not knowingly collect personal data from children.
We may update this Privacy Policy from time to time. The "Effective date" at the top of this page reflects the latest version. Material changes will be communicated by email to registered users at least 30 days before taking effect. Previous versions are available on request.
Data protection inquiries:
privacy@compounder.dev
General support:
support@compounder.dev
Postal address: Compounder Services AB, Strandvägen 7A, 114 56 Stockholm, Sweden