Dataceen Privacy Policy

This policy explains what personal data Dataceen collects when you use dataceen.com, Studio, the Dataceen MCP server and the systems you publish, why we collect it, who we share it with, how long we keep it, and the rights you have.

Effective date: 18 October 2026

1. Who we are

Dataceen is provided by Dataceen AB, organisation number 559529-9016, Engelbrektsgatan 9, 411 27 Göteborg, Sweden (“Dataceen”, “we”, “us”). Contact for privacy questions: privacy@dataceen.com.

This policy covers:

• dataceen.com, our website
• Studio (studio.dataceen.com), where models are designed and systems are published and operated
• The Dataceen MCP server, which lets an AI agent such as Claude, Claude Code or Cursor create models and publish systems, with or without an account
• Published systems: the databases, APIs, MCP servers, SDKs, documentation and applications generated from your models
• Support by email and chat

Terms used in this policy

• Personal data: any information about an identified or identifiable person, such as a name, email address, IP address or a log entry tied to an account. Where a law uses another term, such as “personal information”, we mean what that law covers.
• Account data: data about you as a user of Dataceen: your account, billing, support conversations and how you use Studio and the MCP server.
• Customer content: what you submit to or create with Dataceen: sources, models, scopes, rules, instructions given through an AI agent, generated code and applications. It may contain personal data.
• System data: the records held in a published system and the data its applications and their users send to it, including example data. You control system data; we process it on your behalf.

If you use Dataceen under an organisation’s agreement with us, that agreement governs the customer content and system data in that organisation, and section 10 applies to your account.

Two roles: controller and processor

For data about you as our user (your account, billing, how you use Studio and the MCP server), Dataceen is the controller and this policy applies in full.

For data you put into a published system (the customers, assets, orders or other records your system holds, and the people who use your applications), you are the controller and Dataceen is your processor. We process that data only on your instructions, under our Data Processing Agreement at dataceen.com/legal/dpa. If you are a person whose data is held in a system someone else built on Dataceen, contact that organisation first; we will help them answer you.

When a system’s data is stored in a database you run, Dataceen does not store it at all; we only process it while serving requests to your system.

2. What we collect

Data from integrations and fetched content. When you connect GitHub, we receive your GitHub username and the repository events needed to invite or transfer. When you use Dataceen through an AI host, we receive the client name the host reports and the tool calls it makes. When you add a source by URL, we fetch that page or file once and store it as a source. Sources may contain personal data about other people; you are responsible for having the right to use it, and for keeping it out of a model where it isn’t needed.

We do not ask for sensitive personal data (health, religion, political opinions and similar). Don’t put it in a source or a system unless your own legal basis covers it.

3. How we use it, and why we may

We do not sell personal data, and we do not use the content of your models or systems for advertising.

Automated decisions. We use automated checks to detect abuse, fraud and unusual credit use. If an automated decision significantly affects you, such as suspending an account or blocking a build, you can ask for a person to review it by writing to privacy@dataceen.com.

4. AI processing

Dataceen uses AI models to draft models from your sources, generate example data, build and change applications, and translate support messages. To do that, the relevant sources, model definitions and instructions are sent to Anthropic, through the Claude API. Under Anthropic’s commercial terms this data is not used to train its models, and Anthropic deletes it within 30 days, except where it must keep it longer to enforce its usage policy or to comply with the law.

Dataceen does not train AI models on your sources, models or system data, and our AI provider is contractually bound not to either. We do not submit your content to our provider’s feedback or data-sharing programmes. If our provider changes its terms in a way that affects how your data is used, we tell you before the change takes effect.

Your own AI host is separate. When you connect Claude, Cursor or another AI host to the Dataceen MCP server or to a published system’s MCP server, what you type and what our tools return pass through that host. That provider’s own privacy policy governs it, not this one. Scopes decide what a host can reach in a published system; publish a narrow scope for each agent rather than the full model.

Model drafting runs on our provider. We may later offer drafting on your own AI host’s model; if we do, we will say so here, and the sources would then go to that host’s provider under its terms.

5. Who we share it with

We share personal data only with the providers below, each bound by a data processing agreement, and only as far as their part of the service needs. The current list, with any changes announced in advance, is kept at dataceen.com/legal/subprocessors.

We also disclose data when the law requires it, to protect our rights or users’ safety, or to a buyer if Dataceen’s business is transferred, in which case this policy continues to apply.

When you invite someone to a repository or transfer it, the code and its history go to that GitHub account under GitHub’s terms.

6. Transfers outside the EU

We store Dataceen-hosted data in the EU, in Sweden and Belgium. Some providers in section 5 are based in the United States. Where data goes there, the transfer relies on the provider’s certification under the EU–US Data Privacy Framework or on the European Commission’s Standard Contractual Clauses (Decision (EU) 2021/914), with transfer impact assessments where needed. For data from the UK we use the UK International Data Transfer Addendum; for Switzerland, the same clauses with the Swiss addendum. You can ask us for a copy of the relevant safeguards.

7. How long we keep it

Deleted data may remain in database backups for up to 3 months; backups are used only to restore the service.

8. Security

Every person, application and agent signs in through an identity provider and reaches only the scope it was given. Data is encrypted in transit (TLS) and at rest. Each tenant’s data is separated from every other tenant’s. Every call to a published system is recorded with its caller, time, scope and outcome; the content returned is not. We provide the record to the system’s owner on request. Each published model has its own database. Access by Dataceen staff to customer data is limited to what support or operations require.

If a personal data breach affects you, we notify the supervisory authority within 72 hours where required, and tell you without undue delay. Report a vulnerability to security@dataceen.com.

9. Your rights

Under the GDPR you can ask us to:

• give you a copy of your personal data (access)
• correct data that is wrong (rectification)
• delete it (erasure)
• limit how we use it (restriction)
• hand it over in a machine-readable format (portability); models and generated code can also be exported or transferred from Studio
• stop processing based on legitimate interest (objection)
• withdraw consent you have given, without affecting earlier processing

Write to privacy@dataceen.com. We answer within one month. For data in a system built by another organisation, we pass your request to that organisation as its processor.

You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se, or to the authority where you live or work.

10. Organisation accounts

When an organisation invites you as a member in Studio, or you sign in through your organisation’s directory, the organisation controls the account. It decides who is a member and which scopes each member has, and it can remove you. Its agreement with us governs the customer content and system data in that organisation, and we handle them on its behalf.

Your own account data (name, email address, sign-in) stays covered by this policy. If you leave the organisation, its models and systems stay with it and your access ends.

11. United States residents

This section supplements the rest of the policy for residents of US states with comprehensive privacy laws, including California. We do not sell or share personal information as those laws define the terms, and we do not use it for targeted advertising or for profiling with legal or similarly significant effects.

Your rights. Depending on your state, you can ask to know and access the personal information we hold about you, to correct or delete it, and to receive a portable copy. Write to privacy@dataceen.com. We verify requests through the email address on your account, respond within the time your state’s law requires, and accept requests from an authorised agent with proof of authorisation. We will not discriminate against you for using these rights.

If we say no. Reply to our decision to appeal. If we deny the appeal, you can contact your state Attorney General.

12. Cookies

Studio uses cookies that are strictly necessary for sign-in and security. dataceen.com and Studio use Google Analytics to count visits, only with your consent through the cookie banner (Google Consent Mode). We use no advertising cookies.

13. Children

Dataceen is a business service and not meant for anyone under 18. We do not knowingly collect data about children; if you believe we have, contact us and we will delete it.

14. Changes

We update this policy when the service or the law changes. The effective date at the top shows the current version. Material changes are announced by email to account holders at least 30 days before they take effect.

15. Contact

Dataceen AB, organisation number 559529-9016, Engelbrektsgatan 9, 411 27 Göteborg, Sweden

Privacy: privacy@dataceen.com · Security: security@dataceen.com · Support: support@dataceen.com · Legal notices: legal@dataceen.com