Legal

Privacy Policy

Last updated: 19 July 2026 · Nayeri Consulting AB, Sweden.

Provided by Nayeri Consulting AB and currently being finalized with counsel, alongside our Data Processing Agreement and sub-processor list. Where it conflicts with the GDPR or Swedish data-protection law, that law prevails.

1. Who we are

Untangly is provided by Nayeri Consulting AB (org.nr 559287-9117), Sweden. For your account data we are the controller. For personal data contained in the code and data you submit for analysis, we act as your processor under our Data Processing Agreement.

2. What we collect

  • Account data: your name, email, authentication method (Google or magic link), and plan.
  • Submitted content: the source code and repository metadata you connect for analysis, plus the reports we generate from it.
  • Usage data: logs needed to operate, secure, and improve the service (e.g. scan events, feature usage, error diagnostics).
  • Billing data: handled by our payment provider; we store plan status and invoices, not full card numbers.

3. How we use it

  • To provide the service: scan your code, extract rules, produce findings and coverage, and run edits/fixes you request.
  • To operate and secure the service, prevent abuse, and enforce our Terms.
  • To communicate with you about your account, security, and (with your consent where required) product updates.
  • We do not sell your data, and we do not use your submitted code to train generalized models.

4. Legal bases (GDPR)

We rely on performance of a contract (providing the service), our legitimate interests (security, improvement, abuse prevention), consent (optional communications), and legal obligation (tax, accounting) as applicable. Processing is governed by the GDPR and Sweden’s complementary Data Protection Act (Lag (2018:218)).

5. Sub-processors and sharing

We use vetted sub-processors for hosting, AI model processing, payments, and transactional email. The current list is maintained on our sub-processors page. We share personal data only as needed to provide the service, or where required by law.

6. Retention

We retain scan artifacts to provide history and re-scans. When you delete a project, associated stored code and artifacts are removed within 30 days, backup cycles excepted. Account and billing records are kept as long as legally required.

7. Your rights

Subject to applicable law, you may access, correct, export, or delete your personal data, and object to or restrict certain processing. To exercise these rights, contact us via the contact page. You may also lodge a complaint with the Swedish Authority for Privacy Protection (IMY).

8. International transfers

Some sub-processors may process data outside the EEA. Where they do, we rely on appropriate safeguards (e.g. EU Standard Contractual Clauses).

9. Contact

Questions about privacy? Reach us on the contact page.