Privacy Policy
Effective date: 18 October 2026
1. Who we are, and what role we play
Gesana AB, organisation number 559574-4151, is a software studio registered in Sweden. Our registered address is Trollebergsvägen 81B, 22731 Lund, Sweden.
We act in one of two roles under data protection law, and which one applies depends on the situation:
- Controller
- We decide why and how personal data is processed. This applies to data about people who use our own products, who contact us, or who visit this website.
- Processor
- We process personal data on a client's instructions, on their behalf. This applies to personal data we encounter while building software for a client. The client is the controller in that case.
Sections 2 and 3 to 16 describe how we act as a controller. Section 4 describes the processor role.
2. Scope
This policy covers:
- this website, gesana.net;
- support and business correspondence with us; and
- our own products, including mobile apps we publish under our own terms.
It does not cover personal data we process solely on a client's behalf — that is covered by section 4 — or the Apple App Store and Google Play, which process your data under their own privacy policies.
3. Personal data we collect as controller
3.1 Data you give us
- Contact and account data. Your name, email address, and the credentials you use to sign in to any of our products.
- Content you create. Notes, highlights, bookmarks, reading progress, playlists, and anything else you make inside a product. You keep ownership of it.
- Product activity. Searches, plays, shares and feature usage, recorded so we can operate rankings and personalise what a product shows you. This is internal and is not published to other users.
- Support correspondence. The content of messages you send us and the email address you send them from.
- Billing data. Subscription status and transaction references. We never see or store your card number — that is handled by the payment provider.
- Phone numbers and call records. Where a product places or receives calls. See section 5.
3.2 Data collected automatically
- Device and technical data. Device model, operating system and version, app version, and a device identifier needed to keep you signed in.
- Approximate location. Only where a product offers a "near me" feature, and only for the single request that needs it.
- Diagnostics and crash logs. Used to find and fix faults.
- Server logs. When you visit this website, our hosting provider records your IP address, browser user agent, requested URL, and the time of the request.
3.3 What we do not collect
- We do not sell personal data.
- We do not run advertising trackers or third-party advertising networks.
- We do not build behavioural profiles for advertising purposes.
4. When we act as a processor
Most of our work is building software for other organisations. When we do, the personal data inside that software belongs to our client, and the client is the controller. Our obligations are set out in a data processing agreement with that client, and we act only on their documented instructions.
In that role we:
- process personal data only as the client instructs;
- do not use it for our own purposes or for any other client;
- ensure that people who can access it are bound by confidentiality;
- put in place the technical and organisational measures described in section 10; and
- assist the client with data subject requests, security obligations, and DPIAs where the contract requires it.
If you contact us about personal data in a system we built for someone else, we will normally point you to that client, who is the controller and the right party to answer you.
5. Phone numbers and call records
We develop a calling application. Where a product places or receives calls, we process phone numbers and call metadata. These are the highest-risk categories we handle, and we treat them accordingly.
What we process: the numbers dialled and received, the date and time of each call, its duration, and whether it was answered, missed or rejected. We process this to route and connect calls, to show call history to the account holder, and to keep the service secure.
Call content. The audio and the content of a conversation are not recorded or transcribed by us. A call may be recorded by the participants themselves using their device's own recording feature, which is outside our control and outside this policy.
Special category data. We do not knowingly process data revealing racial or ethnic origin, political opinions, religious beliefs, health, or sexual orientation.
6. Why we use it, and our legal bases
We rely on the following bases under Article 6 GDPR:
Contract — Article 6(1)(b)
Processing necessary to perform our contract with you: managing your account, providing the features of the product you use, syncing the content you create, providing subscription features you have paid for, and handling refunds. Without this data we cannot provide the product.
Legitimate interests — Article 6(1)(f)
Securing the service and preventing fraud and abuse, diagnosing faults, powering in-app rankings and recommendations, sorting nearby results, and answering your support requests. We have assessed that these do not override your rights and freedoms, but you may object — see section 12.
Legal obligation — Article 6(1)(c)
Keeping accounting records and meeting Swedish bookkeeping and tax requirements.
Consent — Article 6(1)(a)
Limited to genuinely optional processing: non-essential cookies, and marketing email where you have asked for it. We do not rely on consent as a substitute for a contract or a legitimate interest, and we do not condition the service on consent. You may withdraw consent at any time.
7. How long we keep it
We keep personal data only as long as it is needed for the purpose it was collected, then delete or anonymise it.
Retention schedule
- Active account
- For as long as your account is open.
- On account deletion
- Deleted from production systems within 30 days. We allow a short recovery window in case the request was made by mistake or the account was compromised; you can ask us to skip it.
- Backups
- Up to 35 days after deletion from production, until those backups are cycled out. We do not restore individual deleted accounts from backups.
- Billing and transaction records
- 7 years, as required by Swedish accounting law. After that period we anonymise the record so it can be retained for audit without identifying you.
- Support correspondence
- 24 months from the last message.
- Security and abuse logs
- 12 months, unless needed longer to investigate an incident.
- Consent records
- 3 years from the time consent was withdrawn, so we can demonstrate that we respected it.
8. Who we share it with
We do not sell personal data. We share it only with these categories of recipient:
Platform providers
Apple Inc. — the App Store handles distribution, updates, purchase and subscription billing, and receives your Apple ID and device data, under Apple's privacy policy.
Google LLC — Google Play does the same on Android, under Google's privacy policy.
Payment providers
Card payments are processed by our payment provider, who holds the data required to take payment. We receive a transaction reference and status, not your card number.
Infrastructure and service providers
We use processors for cloud hosting, email delivery, crash reporting and support tooling. They may process data only on our instructions and only for the purposes set out here. Our current sub-processors are listed in the appendix below.
Legal disclosure
We may disclose personal data where required by law or a competent authority, or where necessary to protect our rights, users' safety, or the security of the service.
Content licensors
Where a product includes licensed content — translations, study materials or reference works — the licence may require us to identify the user who downloaded a copy for offline use. Where that applies, we name the licensor and the data shared in this policy before releasing the product.
9. Transfers outside the EU/EEA
Some providers named in section 8 operate outside the EU/EEA. Where your data goes to a country without an adequacy decision from the European Commission, we rely on an appropriate safeguard under Chapter V GDPR — currently the Commission's Standard Contractual Clauses together with a transfer impact assessment.
You may request a copy of the clauses we rely on, and the relevant transfer impact assessment, by writing to privacy@gesana.net.
10. Security
All traffic to this website and to our servers is encrypted in transit using TLS. Passwords are stored hashed rather than in readable form. Access to personal data is restricted to those who need it to do their job and is subject to confidentiality obligations. Production access is logged and reviewed.
No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify IMY within 72 hours of becoming aware of it, and will notify you where the breach is likely to result in a high risk to you.
If you believe an account has been compromised, contact support@gesana.net immediately.
11. Cookies and similar technologies
This website sets no cookies, runs no analytics or advertising trackers, and uses no non-essential storage. There is no cookie banner because there is nothing to consent to.
Within our products, strictly necessary storage is used to keep you signed in and to remember your preferences. Anything genuinely optional is only set with your consent, and you can withdraw that consent.
Some features request a separate device permission, such as location. That prompt comes from your operating system, not from us. Declining it disables that one feature and nothing else.
12. Your rights
Under the GDPR you have the following rights. We respond free of charge and normally within one month.
- Access — Art. 15
- Confirmation of whether we process your data, a copy of it, and the purposes and legal bases.
- Rectification — Art. 16
- Correction of inaccurate data and completion of incomplete data.
- Erasure — Art. 17
- Deletion of your data where there is no overriding legal reason to keep it. See how to request deletion.
- Restriction — Art. 18
- Limiting how we use your data while a dispute is resolved.
- Data portability — Art. 20
- Receiving your data in a structured, commonly used, machine-readable format.
- Objection — Art. 21
- Objecting to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent — Art. 7(3)
- Withdrawing consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
- Automated decisions — Art. 22
- We do not use automated decision-making that produces legal effects or similarly significantly affects you.
Email privacy@gesana.net with your request. Tell us which product it concerns and include enough detail for us to identify your account. We may ask you to verify your identity to protect your data — we will explain what we need and why.
We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. Privacy questions and rights requests are handled by our management team at privacy@gesana.net.
13. Complaining to a supervisory authority
If you believe we have not handled your data properly, you may complain to the Swedish data protection authority, Integritetsskyddsmyndigheten (IMY). You can also complain to the supervisory authority in the country where you live or work.
- Authority
- Integritetsskyddsmyndigheten (IMY)
- Postal address
- Box 8114, 104 20 Stockholm, Sweden
- Website
- imy.se
- How to complain
- Submit a complaint to IMY
We would rather you raised any problem with us first so we can put it right. But you do not have to, and contacting IMY does not affect any other right you have.
14. Children
Our products are not directed at children under 16, and we do not knowingly collect personal data from anyone below that age.
If you believe a child has provided us with personal data, email privacy@gesana.net and we will delete it.
Where a parent or guardian permits a child to use an account, that parent or guardian is responsible for supervising the use and for any content accessed through it.
15. Changes to this policy
We may update this policy — for example if we launch a new app, add a feature that changes what we collect, or if the law changes. The current version is always at gesana.net/privacy.html, and the effective date at the top of the page shows when it last changed.
Where a change materially affects you, we will tell you before it takes effect.
16. How to contact us
Appendix: sub-processors
We maintain a current list of the processors we use, with the category of data each handles. The categories are:
- cloud hosting and storage;
- email delivery;
- payment processing;
- crash reporting and diagnostics;
- customer support tooling.
To receive the named list with the countries each processor operates from, write to privacy@gesana.net.