Stomra · Privacy Policy

Privacy Policy

What Stomra knows about you, why, where it is kept and for how long: on stomra.com, in the app at app.stomra.com, in the client portal at portal.stomra.com and through the Stomra connector for AI assistants.

Last updated: 27 October 2026.

In short. Stomra is a tool for modelling and drawing buildings. It keeps your account, the projects you make and what is needed to run them, in a database in Sweden. It shows no advertising, sells no data and sets no tracking cookies. Stomra has no AI of its own: if you connect your own assistant, what that assistant reads goes to the assistant's provider, because you asked it to. You can export your work and ask us to delete it.

1. Who is responsible

Stomra is made and run by Karpa Gada AB, reg. no. 559010-3858, Simvägen 6, 312 72 Skummeslövsstrand, Sweden ("we"). We are the controller of the personal data described in this policy.

One thing is different. What a firm puts into its own projects (a name in a title block, a signature on a drawing, a contact in a report) is the firm's data. The firm is its controller, and we handle it for the firm as a processor, under section 11 of the Terms of Service. If your question is about such data, ask the firm first.

2. What we keep, and why

We keep what Stomra needs to work and nothing for advertising or profiling. For each kind: what it is, on which legal ground, and for how long.

2.1 Your account

What: Your email address, your name, the firms and projects you belong to and your role in them, how you sign in (a link by email, Google or Microsoft) and, if you turn it on, your two-step verification.
Why: To let you in and to show your colleagues who you are. Ground: our agreement with you or your firm.
How long: Until you ask us to close the account; it is then deleted within 30 days.

2.2 Your projects

What: The models, views, sheets, reports, files and pictures you make or upload, the firm's handbook, markups, issues and work orders, and the project's history: who changed what, and when. A building model is seldom personal data, but a drawing can carry names, signatures and contact details. The people in your firm see your name beside the work you did and see when you are at work in a project.
Why: This is the service. Ground: our agreement with you or your firm; for what the firm puts in, the firm's instructions to us as its processor.
How long: As long as the project exists. A project you delete is gone. When a firm asks us to close its account, its projects and files are deleted within 30 days.

What: The email addresses of people you invite to a firm or a project and what became of the invitation. For a client's link to the portal: the address it was sent to, when it ends, when it was opened, and the markups and comments the client leaves.
Why: To deliver the invitation and the project that was shared. Ground: our agreement with the firm that shares; for the person invited, our legitimate interest in delivering what was sent to them.
How long: An invitation ends after 7 or 14 days, a client's link on the day its sender chose. What a client wrote stays with the project.

2.4 Email from Stomra

What: Your address, your name and the message: sign-in links, invitations and notices about markups, reports and work orders. We do not track whether you open a mail or press a link in it.
Why: To let you sign in and to tell you what concerns you. Ground: our agreement with you or your firm.
How long: Notices are kept with the account or the project they belong to.

2.5 Problems you report

What: Your email address, what you wrote, the app's version, the page's address, your browser, the project's name, a picture of the view and a copy of the project (you can leave out the picture and the copy), and what we write to each other about it.
Why: To find the fault and mend it. Ground: our agreement with you, and our legitimate interest in a Stomra that works.
How long: 24 months after the report is closed.

2.6 How Stomra is used

What: Events tied to your account: which kind of action, a count, a small detail, a session's identifier and the time. Nothing you type is recorded.
Why: To see what is used and what gets in the way. Ground: our legitimate interest in improving Stomra.
How long: 12 months.

2.7 The waitlist on stomra.com

What: The email address you enter, and the page you entered it on.
Why: To tell you when Stomra opens to you. Ground: your consent, which you take back by asking to be removed.
How long: Until Stomra opens to you, or until you ask to be removed.

2.8 Running the sites

What: What every web server sees: your IP address, the address you asked for, your browser and the time. stomra.com fetches its typefaces from Google Fonts, so Google sees your IP address when that page loads.
Why: To serve the pages and keep them safe. Ground: our legitimate interest in sites that work and are secure.
How long: The request logs are kept for up to 7 days.

2.9 When you write to us

What: Your name, your address and what we write to each other.
Why: To answer you. Ground: our agreement with you, or our legitimate interest in answering a question.
How long: 24 months after the matter is closed.

2.10 Paying

When you buy a day pass or a subscription you pay in Stripe's checkout. Stripe handles your card; we never see or keep its number.

When you start your free first day, Stripe saves a card and charges nothing to it. Stripe tells us the card's fingerprint: a code that is the same for one card wherever it is used, from which the card's number cannot be read. We keep it so that one card starts one free day. Ground: our legitimate interest in giving the free day once for each person. How long: for as long as the free day is offered.

What: Your name or your organisation's, the billing address, your email, a VAT number if you give one, what you bought and when, and what Stripe tells us of the payment (paid, failed, refunded). Stripe keeps its own record of the card and the payment as a controller of its own.
Why: To give you what you paid for and to invoice it. Ground: our agreement with you, and the Swedish Bookkeeping Act for what it makes us keep.
How long: Invoices and the records the Bookkeeping Act names: seven years after the year they belong to. What you have, and its end, for as long as your account exists.

2.11 Booking a demo

When you book a demo on stomra.com/book, the calendar is Cal.com's. You give it your name, your email and the time you choose, and anything you write in the booking; it sends you the confirmation and the meeting's link, and puts the meeting in our calendar.

Why: To meet you at the time you chose. Ground: your request, and our legitimate interest in showing Stomra to someone who asked to see it.
How long: 12 months after the demo, unless you become a customer.

3. AI assistants and the Stomra connector

Stomra has no AI of its own and sends your work to no AI provider. What it has is a way in for the assistant you already use, such as Claude or ChatGPT: the Stomra connector (https://app.stomra.com/mcp). You add it in your assistant, sign in with your Stomra account and press Allow. From then on the assistant can use Stomra's tools as you, with your rights and no more.

3.1 What passes through

Your identity. Each call carries an access token. The connector checks it, reads from it who you are (your user identifier and email address) and which assistant it was given to, and does not store it.
The calls and their answers. A tool call goes through a relay that is yours alone to your own open Stomra tab, where it runs, and the answer goes back the same way. You see each change in the tab and can undo it. The relay passes the content on and does not keep it. An answer can hold parts of the model, drawings, pictures, exported files or links to them, the project's name and your email address.
With no tab open the connector can read a project's saved state from the database, with your token and your rights, and change nothing.
What changes in Stomra. What a tool changes is saved to the project like your own work, with its place in the history. A problem the assistant reports for you is handled as in 2.5 and says which assistant sent it.

3.2 What is kept

The grant. That you allowed this assistant, and when, with its tokens: until you remove the assistant's access or the tokens expire.
Which tab a conversation works in. The assistant's identifier, a random identifier for the conversation, the tab's session and the project's identifier and name: deleted when the choice has not been used for 30 days.
A meter. For each call: the tool's name, how large the answer was, whether it failed, how long it took and the assistant's name. No person, no firm, no project and none of the content.
Request logs of the kind in 2.8, for up to 7 days. Tool calls and answers are not logged.

3.3 The assistant's provider

Everything a tool answers goes to the assistant you connected, and so to its provider, for example Anthropic or OpenAI. That provider handles it together with the rest of your conversation under its own terms and privacy policy, as a controller of its own. It is not our sub-processor, and we send it nothing but the answers to the calls you let the assistant make.

3.4 Stopping it

Close your Stomra tab: the assistant can change nothing.
In the assistant: disconnect or remove Stomra in its connector settings.
In Stomra: app.stomra.com/admin, Account security, AI assistants with access, Remove. The assistant can then get no new token; one already given works until it expires, within about an hour.

4. Who else receives data

We sell no personal data. These companies handle data for us, as our sub-processors, each under an agreement that binds it to our instructions:

Company	What for	Where	Safeguard
Supabase	The database, the files, sign-in and the grants given to assistants. Holds accounts, projects and what section 2 lists.	Sweden (Stockholm); Supabase, Inc. is a US company	EU SCCs + DPF
Cloudflare	Serves stomra.com, the app and the client portal; runs the connector and its relay.	A worldwide network; Cloudflare, Inc. is a US company	EU SCCs + DPF
Resend	Sends Stomra's email (2.4).	Ireland; Resend, Inc. is a US company	EU SCCs + DPF
Stripe	Takes payments and sends invoices (2.10).	Ireland (Stripe Payments Europe, Ltd.); Stripe, Inc. is a US company	EU SCCs + DPF
Cal.com	The calendar for booking a demo (2.11).	USA; Cal.com, Inc. is a US company	EU SCCs

Others receive data because you choose to use them, each as a controller of its own:

The provider of an assistant you connect (3.3).
Google or Microsoft, if you sign in with them: they tell Stomra who you are.
Map services, if you place a project on a map: your browser fetches map tiles from OpenFreeMap, place searches from Photon (komoot) and ground heights from Amazon Web Services. They see your IP address and the area or the words you search for.
Google Fonts, when you load stomra.com (2.8).

We hand data to an authority only where the law makes us. If Stomra is sold or moved to another company, the data goes with it under this policy, and we tell you first.

5. Outside the EU/EEA

Stomra's database and files are in Sweden. The companies in section 4 are, or belong to, US companies, so some data can be handled outside the EU/EEA. Such a transfer rests on the European Commission's decision on the EU-U.S. Data Privacy Framework (DPF) or on its Standard Contractual Clauses (SCCs). Ask us if you want to know more about a particular one.

6. How it is protected

Everything travels over HTTPS, and the database and the files are encrypted where they are stored.
Rules in the database decide, for every project, who may read it and who may change it.
You can turn on two-step verification, and sign out every session at once.
For assistants: every call's token is checked, a call reaches only the tabs of the person who gave the grant, and only Stomra's own pages can join a tab to the relay.
With us, only those who need the data for their work can reach it, and they are bound to keep it to themselves.

If something goes wrong with personal data, we tell the people and the firms it concerns, and the authority, as the law requires.

7. Cookies and browser storage

Neither stomra.com nor the app sets cookies. The app keeps your sign-in in your browser's local storage, and changes that are not yet sent, copies for opening a project quickly and your settings in the browser's own storage. They are needed for Stomra to work, they stay on your device, and they go when you sign out or clear the site's data. Nothing is stored for advertising or for following you between sites.

8. Your rights, and the controls in Stomra

Write to us and we answer within a month. You have the right to:

know what we hold about you and get a copy of it;
have what is wrong put right;
have your data deleted, where no law makes us keep it;
have our use of it limited while a question about it is open;
get your data in a form a computer can read, and take it elsewhere;
object to what we do on the ground of our legitimate interest (2.5, 2.6, 2.8, 2.9);
take back a consent you gave (2.7).

Much of this you can do yourself in Stomra:

export a project as IFC, DXF and PDF, or as its model file;
delete a project you own, and cancel an invitation or a client's link you sent;
remove an assistant's access, turn on two-step verification and sign out every session (Account security);
leave the picture or the copy of the project out of a problem report.

If you think we handle your data wrongly, tell us. You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY): imy.se, imy@imy.se, Box 8114, SE-104 20 Stockholm, Sweden.

9. Changes

When Stomra changes, this policy changes with it: a new feature, a new sub-processor, a new rule. The date at the top says when it was last changed. If a change matters to how your data is handled, we tell you by email before it takes effect.

10. Contact

Questions, requests and complaints about personal data in Stomra: erik@goverde.se.
Karpa Gada AB · Reg. no. 559010-3858 · Simvägen 6, 312 72 Skummeslövsstrand, Sweden