Privacy notice

Version beta-2026-10-30. The controller and contact details are on the company page. Public registration remains closed until these details and this notice are configured.

What we process

Account email, customer type and optional company name; email verification metadata, account sessions, licence state, acceptance of beta terms, monthly admitted-request counts and bounded administrative audit records. Administrator accounts additionally use an encrypted Authenticator setup secret and limited verification-attempt metadata. Security alerts contain fixed event categories, counts and timestamps, without document contents or raw IP addresses. Account and access data support the requested service and its security; proposed legal bases are contract (GDPR 6(1)(b)) and legitimate interests in proportionate security and abuse prevention (6(1)(f)), to be confirmed by the operator.

What we do not keep

Documents, engineering text, images, file names, calculation inputs and outputs, AI prompts and request bodies are not stored or logged by Calculator. Documents are temporarily processed in server memory. We do not collect your AI provider's password or payment card details. Your chosen AI provider has separate data practices.

Providers and access

Cloudflare provides hosting and the separate account database. Cloudflare Turnstile performs a security check on email-entry pages; your browser contacts Cloudflare for this check. Calculator sends only the challenge token and verification secret to the fixed validation service, not documents or engineering data. The configured transactional email provider processes your address and the verification email. Only authorised administrators can inspect account and access metadata; this gives no access to your documents. Provider agreements, processing locations, subprocessors and any international transfer safeguards must be confirmed by the operator before opening enrolment.

Retention

Verification challenges expire after 10 minutes, sessions after 8 hours and invitations after 7 days. Expired records are deleted during account maintenance. Authenticator attempts expire after 10 minutes and pending setup after 10 minutes; active encrypted factors remain until reset or account deletion. Security event counters are retained for 7 days and alerts for up to 90 days, capped at 2,000. Capacity reservations expire within 120 seconds; minute/day budgets expire at the corresponding UTC boundary. The hosted profile schedules maintenance every five minutes; physical deletion depends on successful maintenance. Monthly request counters are retained for the current month and recent monthly buckets using a 90-day cutoff (whole monthly buckets may include part of an older month); admin audit records are capped at 10,000 and 90 days. Account details remain until you delete your account or the operator closes the beta and performs account cleanup. Expired accounts require an operator retention decision before public launch; they are not claimed to be automatically deleted.

Your rights

Export or delete your account from Account. Contact support@waicalc.com for access, rectification, restriction, objection, portability and other applicable rights, or to question an access decision. You may complain to the Danish Data Protection Agency, Datatilsynet. Deleting an account revokes access and removes email, sessions, counters and invitations; security audit IDs expire under the stated limit. A keyed email fingerprint remains for up to 90 days to prevent repeated trial resets. This is pseudonymous personal data, not a stored email address. No marketing emails are part of this beta.