Who we are and what this policy covers
Sluicio is operated by Sluicio AB, reg. no. 559610-5709, Guldsmedsvägen 12, 653 46 Karlstad, Sweden, a wholly owned subsidiary of ROMA IT AB (reg. no. 559490-7437). Sluicio AB is the controller for the personal data described here. Our parent company ROMA IT AB owns and operates the website and the Sluicio Cloud infrastructure on our behalf, as our processor. Contact: privacy@sluicio.com.
This policy covers personal data we process when you:
- visit sluicio.com, docs.sluicio.com or the public demo;
- contact us, book a meeting or ask for support;
- create and use an account in the Sluicio portal, start a trial or subscribe;
- receive invoices, service messages or alert emails from Sluicio.
It does not cover the content of the telemetry that customers send to their own Sluicio instances, or user accounts inside those instances. For that data, the customer is the controller and we act as its processor under the Data Processing Agreement in our SaaS Agreement (see “Telemetry in Sluicio Cloud”).
What we collect, why, and for how long
We collect only what we need for each activity below. We do not buy or enrich data from other sources, and we never sell personal data.
| Activity | Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|---|
| Website and docs visits | Server logs: IP address, browser type, time | Security and reliability | Legitimate interest, art. 6(1)(f) | 30 days |
| Contact form and meeting requests | Name, work email, company, message | Answer you and follow up about Sluicio | Legitimate interest; pre-contractual steps, art. 6(1)(b) | Up to 12 months after last contact, or earlier on request |
| Portal account | Name, work email, company, role, login credentials (hashed) or SSO identifier, login and audit logs | Provide the account, secure access, prevent abuse | Legitimate interest, art. 6(1)(f): providing the account to your employer and securing access | While the account is active, plus 90 days; audit logs 12 months |
| Trial and subscription | Company details, chosen plan, Instance settings, usage metrics (number of Integrations and Systems, volumes) | Provision the service, apply fair-use limits, billing | Legitimate interest, art. 6(1)(f); contract, art. 6(1)(b), where you are yourself the customer | Subscription term plus 12 months |
| Billing and payment | Invoice contact, billing address, VAT number, payment history | Invoicing and bookkeeping | Legal obligation, art. 6(1)(c) (Swedish Accounting Act) | 7 years after the end of the financial year |
| Contract signing | Name, email, signature, IP address and timestamps in the signing log | Sign agreements electronically in our self-hosted signing service | Contract, art. 6(1)(b); legitimate interest, art. 6(1)(f), when you sign on behalf of a company | The term of the agreement plus 10 years |
| Support | Name, email, content of your request, any screenshots or log excerpts you choose to share | Solve your issue | Legitimate interest, art. 6(1)(f) | 24 months after the case is closed |
| Service and alert emails | Recipient address, health-check name, alert details such as the exception message, trace IDs and span names, delivery status | Notify you about your account and Instance | Legitimate interest, art. 6(1)(f) | Delivery metadata for a limited period at our email provider; no message content stored |
| Product news | Name, work email, company | Send occasional B2B updates about Sluicio | Legitimate interest; you can opt out in every email | Until you opt out |
Telemetry in Sluicio Cloud and self-hosted Sluicio
Self-hosted Sluicio. When you run Sluicio in your own environment, your traces, metrics and logs stay in your own databases. They are never sent to us.
Sluicio Cloud. Each customer gets its own instance, with separate databases, hosted in Germany. Telemetry you send to it is stored there on the customer’s behalf, until the customer deletes it or the storage included in its plan is full, in which case the customer’s settings decide whether the oldest data is deleted or collection is paused. We do not read, analyse or reuse that content, and we do not extract it from the instance. We access it only when you ask for support, when we need to investigate a security incident or abuse, or when the law requires it. To keep the service stable and enforce fair use, we measure technical usage of each instance, such as volumes, storage and load, without looking at the content.
If the telemetry contains personal data, such as user IDs or email addresses in logs, the customer is the controller and Sluicio AB is its processor under the Data Processing Agreement in our SaaS Agreement. Exports from an instance to other tools are set up and controlled by the customer. We do not use telemetry to train machine learning or AI models made available to other customers without the customer’s prior written consent.
During a trial, telemetry and other instance data are kept for no more than 7 days from collection (back-up copies are overwritten within 7 days), and everything remaining is deleted when the trial ends, unless the customer subscribes before then. When a subscription ends, the customer can export its data and have it erased as set out in our SaaS Agreement. The instance is then permanently deleted, and back-ups within 7 days.
Cookies and analytics
The website sets no cookies for visitors: no tracking pixels, advertising or fingerprinting. We measure website use with Plausible Analytics, which we host ourselves. It uses no cookies, stores no IP addresses and shows us only aggregate figures such as page views, referrers and rough geography.
The portal and Sluicio Cloud use strictly necessary cookies only, to keep you signed in and protect against forged requests. They need no consent banner, and we do not use them for analytics or marketing.
Who we share data with
We share personal data only with the service providers below, each bound by a data processing agreement, and with authorities where the law requires it.
| Recipient | Role | What they receive | Location |
|---|---|---|---|
| ROMA IT AB (our parent company) | Owns and operates the website and the Sluicio Cloud infrastructure, and supports Sluicio, on our behalf | All categories above, as needed | Sweden |
| Hetzner Online GmbH | Hosting of website, portal and Sluicio Cloud instances, engaged by ROMA IT AB | All data stored on our servers | Germany |
| AhaSend B.V. | Delivery of service and alert emails | Recipient address, alert content (such as exception messages, trace IDs and span names) and delivery metadata; message content is not stored | Netherlands (EU) |
| Time4Money | Bookkeeping | Invoices and billing contacts | Sweden |
| Partner (managed service provider or agent) | Only if you buy Sluicio through a managed service provider, or were introduced by an agent | Account and contact details needed for the agreement | EU/EEA |
Where we store data and how we protect it
All data, including back-ups, is stored within the EU/EEA, mainly in Germany, and back-ups of instance data are kept for 7 days. We do not transfer personal data outside the EU/EEA as part of the normal operation of Sluicio. If a service provider were to process personal data outside the EU/EEA, we make sure the transfer complies with the GDPR, for example through an adequacy decision such as the EU–US Data Privacy Framework, or the European Commission’s standard contractual clauses.
Traffic between you and Sluicio, and to external recipients, is encrypted in transit (HTTPS/TLS). Each Sluicio Cloud customer has its own instance with separate databases. Access to personal data is limited to the few people who need it, and is logged. We keep systems patched and maintain an incident-response plan. If a breach occurs, we notify the Swedish Authority for Privacy Protection (IMY) and affected customers as the law requires.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have data erased, unless we must keep it, for example under accounting law;
- restrict or object to processing based on legitimate interest, including direct marketing;
- receive data you gave us in a portable format, where we process it on the basis of a contract with you or your consent.
Email privacy@sluicio.com to exercise these rights. We answer within one month. If your request concerns telemetry in a customer’s Sluicio instance, we will forward it to that customer, who decides on it.
You can also complain to the Swedish Authority for Privacy Protection (IMY), imy.se, or to the data protection authority where you live or work.
Changes and contact
We may update this policy as Sluicio develops or the law changes. For material changes we update the date below and notify account holders by email or in the portal.
Sluicio AB, Guldsmedsvägen 12, 653 46 Karlstad, Sweden · privacy@sluicio.com
Last updated: 6 November 2026