Privacy Policy

1. Data Controller

Offlane AB is the data controller for the personal data described in this Privacy Policy.

If you have privacy-related questions, you may contact Offlane AB through the contact details published on www.nashi.se.

2. Personal Data We Process

Depending on how you use Nashi, we may process the following categories of personal data:

• Account and identity data, such as name, email address, organisation membership, role, profile information, and authentication-related identifiers.
• Content and collaboration data, such as articles, drafts, comments, mentions, suggestions, feedback, attachments, and imported material.
• Usage and technical data, such as IP address, browser and device information, log data, session data, search activity, article view events, and similar service interaction data.
• Preference data, such as language, theme, notification settings, and similar service preferences.
• Billing and transaction data, where paid plans are used, such as billing contact details, company information, billing address, invoice information, and payment-provider identifiers.
• Communication data, such as support requests, service emails, email preferences, and notification delivery records.
• Browser extension data, where you choose to use the extension, such as source URLs, domains, selected text, captured screenshots, and page-derived content that you submit to the service.

3. How We Collect Personal Data

We collect personal data:

• directly from you when you create an account, sign in, upload content, complete forms, configure settings, or otherwise use the service
• from your organisation or administrator, for example through invitations, role assignment, SSO, or SCIM provisioning
• from service providers that support authentication, payment processing, email delivery, hosting, storage, monitoring, and similar technical functions
• automatically through cookies, local storage, logs, and other technical mechanisms needed to run and secure the service

4. Why We Process Personal Data

We process personal data to:

• provide, maintain, and secure Nashi
• create and manage accounts, workspaces, and access rights
• enable collaboration features such as comments, notifications, and article history
• process payments, subscriptions, and billing administration where applicable
• communicate with users about the service, including important operational and support messages
• improve the service, troubleshoot issues, and prevent misuse
• comply with legal obligations

5. Legal Bases

We process personal data based on one or more of the following legal bases under the GDPR:

These legal bases may include performance of a contract, legitimate interests, compliance with legal obligations, and consent where consent is required.

6. Sharing of Personal Data

We may share personal data with trusted service providers that help us operate the service, such as providers for hosting, authentication, storage, payments, email delivery, monitoring, and similar infrastructure.

We may also disclose personal data where required by law, to protect legal rights, or in connection with a business transfer such as a merger, acquisition, or reorganisation.

We do not sell personal data.

7. International Transfers

Some of our service providers may process personal data outside the EU or EEA.

Where that happens, we aim to use appropriate safeguards, such as adequacy decisions or standard contractual clauses, as required by applicable law.

8. Retention

We retain personal data for as long as necessary to provide the service, fulfil the purposes described in this policy, comply with legal obligations, resolve disputes, and enforce agreements.

Retention periods vary depending on the type of data. Some technical and authentication data may be short-lived, while account, workspace, billing, and content data may be kept for longer while the service relationship remains active or where retention is legally required.

9. Cookies and Similar Technologies

Nashi uses cookies, local storage, and similar technologies to provide essential functionality, maintain sessions, remember preferences, and support the operation of the website and application.

Where required by law, non-essential technologies are used only after the necessary consent has been obtained.

10. Security

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Your Rights

Subject to applicable law, you may have the right to:

• request access to your personal data
• request correction of inaccurate data
• request deletion of your data
• request restriction of processing
• object to certain processing
• request data portability where applicable
• withdraw consent where processing is based on consent

12. Complaints

If you believe that our processing of your personal data violates applicable law, you may contact us first so we can try to resolve the issue.

You also have the right to lodge a complaint with the relevant supervisory authority. In Sweden, this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

13. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version will always be published on this page together with the updated date above.