Dataceen Privacy Policy
Effective 18 October 2026 · Download as PDF
This policy explains what personal data Dataceen collects when you use dataceen.com, Studio, the Dataceen MCP server and the systems you publish, why we collect it, who we share it with, how long we keep it, and the rights you have.
Effective date: 18 October 2026
1. Who we are
Dataceen is provided by Dataceen AB, organisation number 559529-9016, Engelbrektsgatan 9, 411 27 Göteborg, Sweden (“Dataceen”, “we”, “us”). Contact for privacy questions: info@dataceen.com.
This policy covers:
- dataceen.com, our website
- Studio (studio.dataceen.com), where models are designed and systems are published and operated
- The Dataceen MCP server, which lets an AI agent such as Claude, Claude Code or Cursor create models and publish systems, with or without an account
- Published systems: the databases, APIs, MCP servers, SDKs, documentation and applications generated from your models
- Support by email and chat
Terms used in this policy
- Personal data: any information about an identified or identifiable person, such as a name, email address, IP address or a log entry tied to an account. Where a law uses another term, such as “personal information”, we mean what that law covers.
- Account data: data about you as a user of Dataceen: your account, billing, support conversations and how you use Studio and the MCP server.
- Customer content: what you submit to or create with Dataceen: sources, models, scopes, rules, instructions given through an AI agent, generated code and applications. It may contain personal data.
- System data: the records held in a published system and the data its applications and their users send to it, including example data. You control system data; we process it on your behalf.
If you use Dataceen under an organisation’s agreement with us, that agreement governs the customer content and system data in that organisation, and section 10 applies to your account.
Two roles: controller and processor
For data about you as our user (your account, billing, how you use Studio and the MCP server), Dataceen is the controller and this policy applies in full.
For data you put into a published system (the customers, assets, orders or other records your system holds, and the people who use your applications), you are the controller and Dataceen is your processor. We process that data only on your instructions, under our Data Processing Agreement at dataceen.com/legal/dpa. If you are a person whose data is held in a system someone else built on Dataceen, contact that organisation first; we will help them answer you.
When a system’s data is stored in a database you run, Dataceen does not store it at all; we only process it while serving requests to your system.
2. What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Name, email address, organisation, role in Studio, sign-in identifiers from Microsoft or Google if you sign in with them | You, and your identity provider |
| Models and sources | Model names and descriptions, the sources you add (text, API specs, database schemas, documents, images), scopes, rules, and the drafts we build from them | You, or the AI agent you use on your behalf |
| Published system data | Records stored in a published system, including example data, and the identities of people and applications that use it | You, your applications and their users (we act as processor, see section 1) |
| Generated code | SDKs, applications and their source code in the model’s repository, and the GitHub usernames you invite or transfer to | Generated by us; usernames from you |
| MCP and API usage | Tool calls, their parameters and results, timestamps, the client name your AI host reports (for example Claude or Cursor), IP address, errors | Your AI host and applications |
| Sandbox use | Drafts you make without an account, an identity for each AI-tool connection, the claim link, IP address and timestamps | Your AI host |
| Billing | Credit balance, purchases and invoices, billing contact. Card details are handled by Stripe and never reach us | You and Stripe |
| Support | Messages, attachments and the translation of them, if you contact support | You |
| Website | Pages visited, referring link including campaign tags, approximate location from IP, device and browser type | Your browser, through Google Analytics |
Data from integrations and fetched content. When you connect GitHub, we receive your GitHub username and the repository events needed to invite or transfer. When you use Dataceen through an AI host, we receive the client name the host reports and the tool calls it makes. When you add a source by URL, we fetch that page or file once and store it as a source. Sources may contain personal data about other people; you are responsible for having the right to use it, and for keeping it out of a model where it isn’t needed.
We do not ask for sensitive personal data (health, religion, political opinions and similar). Don’t put it in a source or a system unless your own legal basis covers it.
3. How we use it, and why we may
| Purpose | Data used | Legal basis (GDPR art. 6) |
|---|---|---|
| Provide the service: build models, publish systems, host applications, keep repositories | Account, models and sources, system data, generated code | Contract (6.1.b) |
| Let you draft without an account and claim a draft by signing up | Sandbox use | Legitimate interest in letting people try Dataceen before signing up (6.1.f) |
| Charge for credits and keep accounting records | Billing | Contract (6.1.b) and legal obligation under Swedish bookkeeping law (6.1.c) |
| Keep the service secure: authentication, abuse prevention, audit logs | Account, MCP and API usage | Legitimate interest (6.1.f); for system data, your instructions as controller |
| Answer support requests | Support, and what is needed to investigate | Contract (6.1.b) or legitimate interest (6.1.f) |
| Improve the product: which tools fail, where people stall | MCP and API usage, website, in aggregated or pseudonymised form where possible | Legitimate interest (6.1.f) |
| Send service messages (build finished, security notices, changes to terms) | Account | Contract (6.1.b) |
| Send product news | Account email | Consent (6.1.a), which you can withdraw at any time |
We do not sell personal data, and we do not use the content of your models or systems for advertising.
Automated decisions. We use automated checks to detect abuse, fraud and unusual credit use. If an automated decision significantly affects you, such as suspending an account or blocking a build, you can ask for a person to review it by writing to info@dataceen.com.
4. AI processing
Dataceen uses AI models to draft models from your sources, generate example data, build and change applications, and translate support messages. To do that, the relevant sources, model definitions and instructions are sent to Anthropic, through the Claude API. Under Anthropic’s commercial terms this data is not used to train its models, and Anthropic deletes it within 30 days, except where it must keep it longer to enforce its usage policy or to comply with the law.
Dataceen does not train AI models on your sources, models or system data, and our AI provider is contractually bound not to either. We do not submit your content to our provider’s feedback or data-sharing programmes. If our provider changes its terms in a way that affects how your data is used, we tell you before the change takes effect.
Your own AI host is separate. When you connect Claude, Cursor or another AI host to the Dataceen MCP server or to a published system’s MCP server, what you type and what our tools return pass through that host. That provider’s own privacy policy governs it, not this one. Scopes decide what a host can reach in a published system; publish a narrow scope for each agent rather than the full model.
Model drafting runs on our provider. We may later offer drafting on your own AI host’s model; if we do, we will say so here, and the sources would then go to that host’s provider under its terms.
5. Who we share it with
We share personal data only with the providers below, each bound by a data processing agreement, and only as far as their part of the service needs. The current list, with any changes announced in advance, is kept at dataceen.com/legal/subprocessors.
| Provider | What they do for us | Data involved | Location |
|---|---|---|---|
| Microsoft Azure | Hosting of Studio, the MCP servers and applications | All categories | EU (Sweden Central) |
| MongoDB Atlas (MongoDB, Inc.) | Databases of Dataceen-hosted systems | Models, system data, example data | EU (AWS Stockholm) |
| Elastic Cloud (Elasticsearch B.V.) | Search indexes of Dataceen-hosted systems | System data in the search index | EU (Google Cloud, Belgium) |
| Microsoft (Entra External ID) | Sign-in and identity | Account | EU (Microsoft EU datacenters) |
| Optional sign-in with a Google account | Name, email | US | |
| Anthropic (Claude API) | AI drafting, example data, application building, translation | Sources, model definitions, instructions, support messages | US |
| GitHub | Private repositories holding generated code; invitations and transfers you start | Generated code, GitHub usernames | US |
| Stripe (Stripe Payments Europe, Ltd.) | Payments for credits | Billing | EU (Ireland); Stripe, Inc. in the US under DPF and SCCs |
| Microsoft (Exchange Online) | Service and support email | Account email, support messages | EU (Microsoft EU datacenters) |
| Google (Google Analytics) | Website statistics | Website | US (DPF and SCCs under Google’s terms) |
We also disclose data when the law requires it, to protect our rights or users’ safety, or to a buyer if Dataceen’s business is transferred, in which case this policy continues to apply.
When you invite someone to a repository or transfer it, the code and its history go to that GitHub account under GitHub’s terms.
6. Transfers outside the EU
We store Dataceen-hosted data in the EU, in Sweden and Belgium. Some providers in section 5 are based in the United States. Where data goes there, the transfer relies on the provider’s certification under the EU–US Data Privacy Framework or on the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914), with transfer impact assessments where needed. For data from the UK we use the UK International Data Transfer Addendum; for Switzerland, the same clauses with the Swiss addendum. You can ask us for a copy of the relevant safeguards.
7. How long we keep it
| Data | Kept for |
|---|---|
| Draft made without an account | Deleted after 30 days of inactivity, unless claimed by signing up |
| Account | While the account is active; deleted 30 days after you close it |
| Models, sources and published systems | Until you delete them or close the account |
| Repositories | Until you delete the model or close the account. A repository transferred to you is yours, and we keep no copy after the transfer |
| MCP and API logs | Call records of published systems: 90 days. Studio and builder usage logs: 180 days |
| Billing records | 7 years, as Swedish bookkeeping law requires |
| Support conversations | 24 months after the last message |
| Website analytics | 14 months |
Deleted data may remain in database backups for up to 3 months; backups are used only to restore the service.
8. Security
Every person, application and agent signs in through an identity provider and reaches only the scope it was given. Data is encrypted in transit (TLS) and at rest. Each tenant’s data is separated from every other tenant’s. Every call to a published system is recorded with its caller, time, scope and outcome; the content returned is not. We provide the record to the system’s owner on request. Each published model has its own database. Access by Dataceen staff to customer data is limited to what support or operations require.
If a personal data breach affects you, we notify the supervisory authority within 72 hours where required, and tell you without undue delay. Report a vulnerability to info@dataceen.com.
9. Your rights
Under the GDPR you can ask us to:
- give you a copy of your personal data (access)
- correct data that is wrong (rectification)
- delete it (erasure)
- limit how we use it (restriction)
- hand it over in a machine-readable format (portability); models and generated code can also be exported or transferred from Studio
- stop processing based on legitimate interest (objection)
- withdraw consent you have given, without affecting earlier processing
Write to info@dataceen.com. We answer within one month. For data in a system built by another organisation, we pass your request to that organisation as its processor.
You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se, or to the authority where you live or work.
10. Organisation accounts
When an organisation invites you as a member in Studio, or you sign in through your organisation’s directory, the organisation controls the account. It decides who is a member and which scopes each member has, and it can remove you. Its agreement with us governs the customer content and system data in that organisation, and we handle them on its behalf.
Your own account data (name, email address, sign-in) stays covered by this policy. If you leave the organisation, its models and systems stay with it and your access ends.
11. United States residents
This section supplements the rest of the policy for residents of US states with comprehensive privacy laws, including California. We do not sell or share personal information as those laws define the terms, and we do not use it for targeted advertising or for profiling with legal or similarly significant effects.
| Category | Examples | Disclosed for business purposes to | Sold or shared |
|---|---|---|---|
| Identifiers | Name, email, IP address, user ID | Service providers in section 5 | No |
| Commercial information | Credit purchases, invoices | Payment provider | No |
| Internet or network activity | MCP and API usage, website visits | Hosting and analytics providers | No |
| Coarse geolocation | Country or city from IP address | Analytics provider | No |
| User content | Sources, models, generated code | Hosting, AI and GitHub providers | No |
| Sensitive personal information | Sign-in credentials, used only to authenticate you | Identity providers | No |
Your rights. Depending on your state, you can ask to know and access the personal information we hold about you, to correct or delete it, and to receive a portable copy. Write to info@dataceen.com. We verify requests through the email address on your account, respond within the time your state’s law requires, and accept requests from an authorised agent with proof of authorisation. We will not discriminate against you for using these rights.
If we say no. Reply to our decision to appeal. If we deny the appeal, you can contact your state Attorney General.
12. Cookies
Studio uses cookies that are strictly necessary for sign-in and security. dataceen.com and Studio use Google Analytics to count visits, only with your consent through the cookie banner (Google Consent Mode). We use no advertising cookies.
13. Children
Dataceen is a business service and not meant for anyone under 18. We do not knowingly collect data about children; if you believe we have, contact us and we will delete it.
14. Changes
We update this policy when the service or the law changes. The effective date at the top shows the current version. Material changes are announced by email to account holders at least 30 days before they take effect.
15. Contact
Dataceen AB, organisation number 559529-9016, Engelbrektsgatan 9, 411 27 Göteborg, Sweden
Privacy, security and support: info@dataceen.com