Last updated
Privacy Policy
What personal data StandardOS processes, why, where it lives, and the rights you have. Short version: EU-hosted, no tracking, no selling of data, export and deletion on demand.
1. Who is responsible
The data controller for this website and for account data is RMS Systems (CVR 34282668), Nyvangsvej 29, 5000 Odense C, Denmark. privacy@getstandardos.com. For the compliance records your organization keeps inside StandardOS, your organization is the controller and we act as its processor under our Data Processing Agreement (Art. 28 GDPR), which applies to every customer and is published in full.
2. What we process, and why
| Data | Purpose | Legal basis |
|---|---|---|
| Account data: name, work email, password hash or OAuth identity | Sign-in, workspace membership, security notifications | Contract (Art. 6(1)(b)) |
| Organization & billing data: company name, billing country, VAT number, payment status | Subscription management, invoicing, tax compliance | Contract; legal obligation (Art. 6(1)(b), (c)) |
| Content you store: policies, risks, evidence, audit records (may contain personal data your organization controls) | Providing the service to your organization | Processor on your organization's instructions (Art. 28) |
| Service logs: IP address, timestamps, actions | Security, abuse prevention, tamper-evident audit trail | Legitimate interest (Art. 6(1)(f)) |
| Emails we send: delivery and bounce metadata | Transactional notifications and digests you control | Contract (Art. 6(1)(b)) |
| Signup record: the steps a signup attempt reached, its outcome, a hash of the email address (never the address), the language and browser family, and the source of the signup (the page or campaign the link came from, the referring site) | Seeing where signups fail; read by our operators only, kept 90 days | Legitimate interest (Art. 6(1)(f)) |
| Free tools, when you ask for a result by email: the address, the answers, the result and the language | Sending you the result once, as a link that reopens it here and as a PDF built from your answers; if you tick the box, one more email when the tool's date is live, withdrawn in one click from any of these emails. Nothing you type goes into an email. | The request itself (Art. 6(1)(b)) for the result; consent (Art. 6(1)(a)) for the one follow-up, withdrawn at /tools/withdraw |
| Signup reminder, only if you tick "Remind me once if I do not finish": the address, the wording you ticked, the language and when | One email a day later, and only if your account is still unconfirmed, with a link that finishes signing up; never a second one. Kept 30 days. "Do not remind me" on the screen after signing up withdraws it. | Consent (Art. 6(1)(a)) |
| Service enquiries and bookings from the service pages: company, the product or scope, your name, work email, the week you want to start, your notes, the language, and the page or campaign the link came from | Answering you and arranging the service; if you pay, the sale. Received by our founder's mailbox and sent through our email provider (Resend); a payment is handled by Paddle as merchant of record. | Steps at your request before a contract, then the contract (Art. 6(1)(b)) |
| Packs bought on the site without an account: your email, the pack, your country, the Paddle transaction, the download link's use, the language, and your opt-in if you ticked it | Delivering the pack by a download link, sending it again when you ask, and adding it to your workspace if you later sign up with the same address. Paddle takes the payment as merchant of record; our email provider (Resend) sends the link. | Contract (Art. 6(1)(b)); legal obligation to keep sales records (Art. 6(1)(c)) |
| Alerts from the compliance calendar: your email, what you follow (frameworks and countries), the language, and the consent wording as shown with when you ticked and confirmed it. Also the Slack, Teams or webhook URLs you add, and for the paid plan the Paddle subscription. | Sending the alerts and the monthly digest you confirmed, by the channels you chose. A calendar feed only you have the address of. Mail goes through our email provider (Resend); Paddle takes the payment as merchant of record. Nothing is sent before you confirm the link we mail you. | Consent (Art. 6(1)(a)); the paid plan, contract (Art. 6(1)(b)) |
| Business contacts we write to: the company, its country, the work address a public source published for it, the person's name where the source published one, the company's domain, the page we read it from and the date | Writing to a company that we have reason to believe has a professional interest in what we build, at most three times, and stopping at the first reply, bounce, complaint or objection | Legitimate interest (Art. 6(1)(f)) |
| Partner applications from /partners: your name, company, work email, the programme, the clients you expect to bring, the language, and the letter or page the link came from | Deciding the application; for a referral partner or affiliate, creating your partner code at once and emailing you the link; your commission statement, and before the first payout, confirming who you are and where to pay. If we had written to your company, those letters stop. Received by our founder's mailbox and sent through our email provider (Resend). | Steps at your request before a contract, then the contract (Art. 6(1)(b)) |
| If a consultancy referred you, or you named one as your partner: your organization's name and the payments on your subscription | The partner's commission is a share of what you pay us, and the statement they invoice against has to say which organization it is for. The partner named in your workspace, or the one whose link you arrived through, sees these two things and nothing more: no document, no evidence and no framework status unless you name them on your Settings page, where you can also end it at any time. | Legitimate interest (Art. 6(1)(f)): paying the commission we owe under the partner agreement |
| Marketing consent: the wording you agreed to, when, and from which screen | Email about StandardOS itself, only if you asked for it, and proof that you did | Consent (Art. 6(1)(a)); legal obligation to document it (Art. 6(1)(c)) |
That last row is opt-in and stays opt-in. Nothing is pre-ticked, declining changes nothing about your trial or your account, and you can withdraw with one click in any such email or from your notification settings, with no sign-in needed for the link. Notices about your own workspace are separate and are not marketing. We keep the consent record after you withdraw, because Danish marketing law requires us to be able to show what you agreed to for two years after we last relied on it.
Business contacts we write to. We build a list of companies from public sources: national company registers, government lists of approved or referenced providers, industry association member lists, and the companies' own websites. We never buy a list, never take one from a site whose terms forbid it, and never guess or construct an address. Where a source publishes only a company address such as info@ or contact@, that is all we store. Where a source publishes a named person as the company's own point of contact, in France and Ireland, we store that name and that work address and nothing else about them. We do not profile, score or enrich anyone, and we do not track whether a message was opened. We write about the recipient's work, at most three times, thirty days apart, and we stop at the first reply, bounce, complaint or unsubscribe. Every message says where we found the address, carries a one-click unsubscribe that needs no account, and links to this page. You can object at any time by replying or writing to privacy@getstandardos.com, and we will delete the record. What we keep is the address on our do-not-write list, so that we cannot write to you again by mistake; where a sequence simply ended, only a one-way hash of it.
We do not run advertising or cross-site tracking, we do not sell or share personal data for marketing, and our marketing site sets no analytics cookies. See the Cookie Policy.
3. Where your data lives
Customer data is stored in databases located in the European Union. We choose EU regions for our infrastructure providers wherever the service touches customer records.
4. Subprocessors
We use a deliberately short list of subprocessors. This is the same list published on our Trust page: one source, rendered in both places, last changed 2026-09-27.
| Provider | Role | Location of processing |
|---|---|---|
| Supabase | Database, authentication, file storage | EU (Ireland) |
| Vercel | Application hosting & delivery; cookieless traffic analytics (no cookies, no cross-site identifiers) | EU serving; global CDN for static assets |
| Sentry | Error monitoring, diagnostics only; email addresses, IP addresses and record identifiers are stripped before events leave our servers | EU region (Frankfurt) |
| Paddle | Merchant of record: checkout, payment, VAT & invoicing (card data never touches our servers) | UK, under the EU adequacy decision |
| Resend | Transactional email | EU region |
Announced changes
Decided and announced, not yet in use: none of these processes any data until we switch it on, and this notice comes first.
| Provider | Role | Location of processing | Announced |
|---|---|---|---|
| ZeroBounce | Email address verification for outreach prospects: a company role address is checked for deliverability before a first letter is sent, so the sending domain is not spent on dead mailboxes and spam traps. Only the address is sent, never a name, and the answer we keep is the service's own status word | EU. ZeroBounce states it hosts its servers in the EU and that data sent for processing is transmitted, stored and processed only on servers in the EU, on its own hardware rather than a public cloud, and it offers an EU data processing addendum incorporating the Commission's standard contractual clauses (zerobounce.net/gdpr and its EU DPA, read 2026-09-27). We call the EU-only endpoint api-eu.zerobounce.net, which its documentation describes as the endpoint where validations occur only within the EU; the global endpoint is not used | 2026-09-27, applies once enabled |
Where a provider processes data outside the EU/EEA, transfers rest on an adequacy decision (such as the EU-US Data Privacy Framework) or Standard Contractual Clauses. We announce subprocessor changes on our Trust page with prior notice to customers.
5. How long we keep data
- Account and organization data: for the life of the account.
- Workspace content after a subscription ends: read-only and exportable for 90 days, then scheduled for deletion.
- An organization that has ever had a free supplier profile returns to the free plan when its trial or subscription ends. The profile, its answers and its customer links are kept, and stay published if they were, until you delete them. Everything else the subscription held is read-only and exportable for 90 days and then deleted, with the organization's audit chain; the profile's own history starts again from that day.
- Invoices and accounting records: 5 years (Danish Bookkeeping Act).
- Security logs: up to 12 months, unless needed for an ongoing investigation.
- Signup records: 90 days, then deleted.
- Free-tool results sent by email: 90 days, then deleted; with the follow-up ticked, 90 days after that email went.
- Addresses on the notes list, from the box at the pack checkout or the second box on a tool page: kept while that consent stands, and deleted when you unsubscribe. The record of what you agreed to, the wording and the date, is kept for two years after we last relied on it, as section 2 says.
- A free-tool record whose notes box is ticked is kept while that consent stands; the 90 days above apply once you unsubscribe, or if you never ticked it.
- Calendar alerts: a sign-up not confirmed within 7 days is deleted. An unsubscribed address is deleted 30 days after the unsubscribe, with its channels. The record of what was sent: 90 days.
- Service enquiries that did not become a sale: 12 months, then deleted. A paid booking and a pack bought on the site: 5 years, with the accounting records.
- Business contacts we write to: deleted when the person objects or tells us no, and in any case 90 days after the last message in a sequence if nobody replied. The do-not-write entry is kept so that we cannot write again.
- Partner applications: while the partnership lasts, then 5 years with the commission records; a declined application is deleted when you ask. A customer's organization name and payments inside a commission statement are kept on the same clock as the statement.
6. Your rights
Under the GDPR and the Danish Data Protection Act you can request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. Write to privacy@getstandardos.com. We answer within a month. You can also complain to the Danish supervisory authority, Datatilsynet (datatilsynet.dk), or your local EU authority.
7. Security
Encryption in transit and at rest, row-level access isolation between organizations, least-privilege access for our own staff, daily backups with automated alerting and a weekly encrypted copy held outside our database provider, and a tamper-evident, hash-chained audit log, described in detail on the Trust page. We run StandardOS on StandardOS: the same ISMS discipline we sell is the one we operate under, and we notify affected customers of personal-data breaches without undue delay as the GDPR requires.
8. Changes
We update this policy as the service evolves; the date above always reflects the current version, and material changes are announced by email to account owners.