Data processing agreement

The data controller is you, that is, the company that holds the account. You decide what is put into the service and why.

The data processor is To be filled in: registered company name, company registration number To be filled in: company registration number, To be filled in: postal address, Sweden.

The agreement applies for as long as you have an account with us. Data about you as a customer, on the other hand, we process in our own name, and that is set out in the privacy policy.

Purpose: to deliver Mängda to you. That means storing and displaying your drawings and projects, calculating on them, producing quantity lists and quotes, and reading a drawing page with AI when someone at your end asks for it. It also means de-identifying content under the terms of use, so that we can use it to develop the service’s AI.

Duration: for as long as you have an account.

Type of data: names and email addresses for your users, and the personal data that may appear in material you upload yourselves, for example a name in a drawing’s title block, a client in a project name or a contact person in a quote. What is in there is for you to decide.

Categories of data subject: your employees and other users, your customers and clients, and people who appear in your documents.

Mängda is not built for special categories of personal data under Article 9, personal identity numbers in free text, or data on criminal offences. Do not put such data into the service.

This section applies from 2026-09-11. No such statistics are compiled before that date.

When someone at your end has had a drawing read by AI and then carries on working on it, the service compares, in your browser, what the reading drew with how it looks afterwards. All that is sent to us is numbers and values from the service’s own lists, and we use them as statistics to find where the AI reading goes wrong and to improve it.

We compile those statistics on our own account, as data controller and not as your data processor, and they are therefore not covered by this agreement. They are drawn from how the service is used. They hold no drawings, no text from them, no coordinates, lengths or areas, and no personal data about the people who appear in your material. Nor do they give us any access to your drawings, take-offs or price lists.

Under the terms of use, we may also use your content to improve the service and to train and evaluate its AI features. Through this agreement you instruct us to de-identify it first, that is, to remove what identifies you, your customers or individual people, such as names and addresses in a title block, coordinates and project names. We use the de-identified material on our own account. It contains no personal data from your material and is therefore not covered by this agreement.

What the statistics contain and how long they are kept is set out in the privacy policy, as is how content is de-identified. If you do not want the statistics compiled or your content used in this way, write to sales@mangda.app. We will then exclude your workspace and delete the statistics already collected from it.

We process the data only in accordance with your documented instructions. Your use of the service, together with this agreement and the terms of use, constitutes that instruction. Further instructions are given in writing to sales@mangda.app.

If we become required under EU law or Swedish law to process the data in some other way, we inform you beforehand, unless the law prohibits it.

If we consider that an instruction infringes the data protection rules, we say so.

Those at our end who are given access to the data are bound by a duty of confidentiality, and are given only the access their task requires.

Our staff cannot reach the content of your drawings, take-offs or price lists. The administration view shows data on subscriptions, licences and payments, not customer content, and every action taken there is logged with who took it and when. Content used to develop the service’s AI reaches our staff only once it has been de-identified.

We take the technical and organisational measures that Article 32 requires. Today that includes, among other things:

• Encryption in transit (TLS) and encryption of stored data at our providers.
• Row-level access control in the database, so that one sign-in reaches only its own organisation's data.
• Two-factor authentication required for our own staff in the administration view.
• Logging of administrative actions, in a log that cannot be altered afterwards.
• Regular backups at our database provider.

You give your authorisation for us to engage sub-processors. We have an agreement with each of them imposing at least the same obligations as we have towards you, and we are liable for their processing as for our own.

If we replace or add a sub-processor, we give at least 30 days’ notice to the account’s email address. If you have well-founded objections, tell us within that time. If we cannot agree, you may terminate the subscription at no cost for the remaining period.

Your data is stored in Stockholm. Three sub-processors process data in the United States (Stripe, Anthropic and Resend), and this is done on the basis of the European Commission’s standard contractual clauses and, where the provider is certified under it, the EU–US Data Privacy Framework.

The transfer to Anthropic happens only when someone at your end requests an AI reading of a drawing.

We assist you, so far as is reasonably possible, in meeting your obligations: responding to requests from data subjects, carrying out data protection impact assessments, and in prior consultation with the Swedish Authority for Privacy Protection.

Most of it you handle yourselves in the service: you reach, correct, export and delete your data directly. If you need help beyond that, get in touch.

If we become aware of a personal data breach affecting your data, we notify you without undue delay, and at the latest within 48 hours. We give what we know about what has happened, which data is affected, what consequences we assess it to have, and what we are doing about it.

Notification to the Swedish Authority for Privacy Protection, and information to the individuals affected, is your responsibility as data controller. We help you with the material for it.

When the agreement ends, we delete the data. You can export your quantity lists and quotes from the service at any time, and should do so before you close the account. De-identified material we have already produced to develop the service’s AI is not deleted, as it contains no personal data from your material.

We keep what the law requires us to keep: in practice the accounting records, which do not contain your project content.

We give you the information you need in order to show that the obligations in Article 28 are being met, and allow for audits that you carry out yourselves or through an independent auditor whom we can accept.

An audit is notified at least 30 days in advance, takes place during working hours, must not disturb operations, and may take place at most once a year, over and above after an incident has occurred. You bear the cost.

If this agreement is changed, we give at least 30 days’ notice. In the event of a conflict, this agreement takes precedence over the terms of use on questions of the processing of personal data.