Privacy Policy
This policy explains what personal data Skiwo AS processes when BufferDesk is used and when you visit www.bufferdesk.com, why, and what your rights are.
Who is responsible
Skiwo AS (org. no. 916 636 660), Pilestredet 17, 0164 Oslo, Norway, is the data controller for the processing described here. Contact: support@bufferdesk.com.
For the purchase orders, SuperOffice requests and Visma.net data that BufferDesk processes for a customer, the customer is the controller and Skiwo is its processor. That processing is governed by our Data Processing Agreement, not by this policy.
Whose data we process as controller
- Administrators and members at our customers who sign in to BufferDesk.
- People at customers and prospective customers who contact us.
- Visitors to www.bufferdesk.com.
What we process, why, and on what basis
| Purpose | Personal data | Legal basis |
|---|---|---|
| Provide the Service: accounts, sign-in, membership | Name, email, role, sign-in times, IP address and browser at sign-in | GDPR art. 6(1)(b), contract |
| Security: detect and investigate misuse | Activity log of sign-ins and of changes to members and settings; error records | Art. 6(1)(f), legitimate interest in security |
| Support and sales | Contact details and the content of your messages | Art. 6(1)(b) and (f) |
| Billing and accounting | Billing contact of the customer | Art. 6(1)(c), legal obligation (bokføringsloven) |
How we protect it
- All traffic is encrypted (TLS), and browsers are told to use it only (HSTS).
- Sign-in uses one-time codes that expire after 15 minutes. Codes and session tokens are stored only as one-way SHA-256 digests. A session ends after 24 hours without use and after 7 days at most.
- Each customer's data is separated from every other customer's.
- The history of calls into and out of BufferDesk records each call and what it carried, and is kept 90 days.
Who we share it with
We never sell personal data. We share it with the sub-processors below, under data processing agreements, and with public authorities where the law requires it.
| Sub-processor | What for | Where |
|---|---|---|
| Heroku (Salesforce, Inc.) | Hosting, database and managed AI inference | EU region |
| Anthropic, via Heroku managed inference | The language model that reads purchase orders | Heroku's EU inference |
| Amazon Web Services (SES, S3) | Sending email, and storing the purchase-order files | EU (Frankfurt) |
Some of these companies have parents outside the EU/EEA. Where a transfer outside the EU/EEA occurs, it relies on the European Commission's Standard Contractual Clauses or an adequacy decision.
How long we keep it
- Accounts and the activity log: for the customer agreement, plus up to 12 months.
- Call history: 90 days.
- Billing records: as long as Norwegian accounting law requires.
The website
www.bufferdesk.com sets no cookies and runs no analytics, trackers or advertising. Our hosting provider keeps short-lived access logs, including IP addresses, for security.
Your rights
You may ask for access to, correction or erasure of your personal data, for a portable copy, or object to processing based on legitimate interest. Write to support@bufferdesk.com; we may verify your identity first. You may also complain to Datatilsynet (datatilsynet.no).
Cookies
See the Cookie Policy.
Changes
The current version is always at www.bufferdesk.com/privacy. Material changes are notified to customer administrators by email.