Privacy Policy

Read our Privacy Policy carefully to understand how we process your personal data.

Privacy Policy for Delatool AB

Last updated: 20 August 2026

Delatool AB ("Delatool", "we", "us" or "our"), organisation number 559517-8053, is the controller of personal data processed in connection with our web application and related services (the "Service"). We process personal data in accordance with the EU General Data Protection Regulation (GDPR), the UK GDPR where applicable, and Swedish law. This Privacy Policy describes how we collect, use, store, share and protect personal data. By using the Service, you acknowledge this processing as described here.

1. Introduction

Delatool provides a B2B SaaS platform for tool management (including QR labelling, inventory, loans, maintenance/calibration), SMART 5S, AI-assisted features, reviews/tool database content, and related training or consultancy offerings. To deliver these services we process personal data about account holders, users within customer organisations and, in limited cases, individuals identified in operational data (for example borrower names) or fault reports submitted by users without login.

2. Personal data we collect

Depending on how you use the Service, we may collect:

  • Account and company data: email, hashed password, username, profile image, organisation number, company name, contact person, phone, invoice/delivery address, profession/experience, optional PIN, customer number and Stripe customer/subscription identifiers.
  • Operational data that may include personal data: tool and location records, activity logs, loan records (including borrower names), deviation/fault reports, chat history, uploaded images/documents, 5S status and related notes.
  • Technical and location data: session and cookie data, approximate usage metadata, and GPS/location data when scanning or location features are used.
  • User / QR flows: information submitted via open QR fault or deviation reporting without login, where that feature is enabled.
  • Communications: messages sent via contact forms, support email, webinar/training sign-ups or similar.

How we collect data: registration and subscription forms; forms and uploads inside the Service; QR reports from users without login; cookies and similar technologies; and payment providers when you subscribe.

3. Purposes and legal bases

We process personal data in order to:

  • Provide and administer the Service, accounts, roles and customer-number tenancy (performance of a contract).
  • Send operational notifications (for example maintenance reminders and fault-report updates) (contract / legitimate interest).
  • Process payments and invoicing (contract / legal obligation for accounting).
  • Provide AI-assisted diagnosis, activity-log assistance and recommendations (contract / legitimate interest in delivering requested features).
  • Secure the Service, prevent abuse and improve functionality, including limited analytics (legitimate interest; non-essential cookies/analytics only with consent where required).
  • Comply with legal obligations, for example bookkeeping (legal obligation).

We do not use your personal data for direct marketing without your explicit consent.

4. Sharing of personal data and processors

We may share personal data with suppliers and processors only as needed, including:

  • Render.com: hosting and database infrastructure.
  • AWS S3: storage of images, documents and similar files.
  • PostgreSQL database hosting (via our hosting provider) and, where enabled, MongoDB / Redis for caching or auxiliary storage.
  • Stripe: card payments and subscription management.
  • Fortnox: invoicing and payment administration.
  • Email/SMTP providers: transactional and operational email.
  • Anthropic: AI/LLM and vision processing for diagnosis, assistants and related features.
  • Voyage AI: embeddings for search/recommendation features where used.
  • OpenAI: AI processing where enabled for specific features or internal analysis.
  • Google Analytics: website analytics subject to cookie consent.
  • Google reCAPTCHA: bot protection on selected forms/endpoints.
  • Price lookup providers (for example Prisjakt or similar APIs): when price estimates are requested.
  • Repair/service suppliers: only data necessary to carry out agreed service or repairs.

Some providers may process data outside the EU/EEA. Where that occurs, we rely on appropriate safeguards such as standard contractual clauses (SCCs) and related measures. We require processors to protect personal data under data processing agreements where applicable.

5. AI processing

When you use AI features, relevant inputs may be sent to AI providers to generate a response. Depending on the feature, this can include fault descriptions, chat history, uploaded images (for example of a tool or receipt), tool context (model, brand, type), activity-log excerpts and borrower names included in those logs. QR deviation flows from users without login may also send submitted text and images to AI providers. AI outputs are decision support only and should be verified before operational use.

6. Multi-tenant access

Customer operational data is organised by customer number. Owner and sub-admin users linked to the same customer number share access to that organisation's data according to their roles. You are responsible for appointing users and for personal data you enter about third parties.

7. Storage and security

  • Storage: Primary application data is stored with our hosting/database providers (including Render.com). Files may be stored in AWS S3. Data is processed within the EU/EEA where possible, subject to transfers described above.
  • Security: Passwords are hashed. Access controls, encrypted transport (HTTPS) and provider security measures are used to protect the Service. See also Render.com/security.
  • Retention: Personal data for active accounts is kept for as long as the account and Service relationship require. If you delete your account via My Page, the account record is removed from the live application promptly. Anonymised or aggregated operational data, backups for a limited period, and records required for accounting or legal claims may be retained longer. Request export or additional erasure via our contact form.

8. Your rights as a data subject

Under the GDPR and UK GDPR (where applicable), you have the right to:

  • Request access to your personal data.
  • Request rectification of inaccurate data.
  • Request erasure of your data (under certain conditions).
  • Request restriction of processing or data portability.
  • Object to certain processing activities.
  • Lodge a complaint with a supervisory authority (for example the Swedish IMY or the UK ICO).

You can change certain data directly at delatool.com/mypage. For other requests, contact us via delatool.com/contact or info@delatool.com.

9. Cookies

We use necessary cookies for the Service to function and, with consent where required, analytics cookies. Details are set out in our Cookie Policy.

10. Changes to the policy

We may update this policy at any time. For material changes, we will notify you by email where reasonably practicable.

11. Contact information

For questions about this policy, contact us:

  • Controller: Delatool AB, org. no. 559517-8053
  • Email: info@delatool.com
  • Phone: +46 760 198 819
  • Address: Golfgatan 28, 71993 Vintrosa, Sweden