DatumHue Platform — Privacy Policy

Version 1.14 — 2026-10-17

This Privacy Policy explains how Shuusei AB handles personal data when you use the DatumHue platform and when you buy from Shuusei AB itself.

The short version. Signing in gives us a Google account identifier and email, which we check when you buy a paid package or register a device to open one. Paid packages are sold and delivered by their creators, who record your purchase under a pseudonym rather than your identity. Card data is handled by Stripe. When you buy from Shuusei AB directly, we keep the name, email, and payment reference needed to deliver, account for, and renew what you bought. Our sites set no cookies.

1. Who we are (the controller)

The controller of your personal data is:

Shuusei AB (org. nr 559146-8292), a company registered in Sweden, with its registered office at Hällebergsgatan 36, 442 54 Ytterby, Sweden.

For any data-protection matter — questions, requests to exercise your rights, or complaints — contact us at privacy@datumhue.com, or by post at the address above.

2. What this policy covers

This policy covers the platform service that Shuusei AB operates at datumhue.app — sign-in, connecting workstations to one another, package discovery and installation, the buying of paid packages, the devices registered to your account, and publishing packages — together with the shop at datumhue.com, where you buy from Shuusei AB itself (the creator subscription and the enterprise subscription — §3.5, §11), manage an enterprise subscription, become a creator, and send us a consulting request (§3.7). It also covers the marketing pages on datumhue.com and the documentation site at datumhue.dev, and the update check the Platform workstation app's launcher performs (§3.4).

It does not cover:

The packages and apps you run. Packages are third-party content published by independent creators. What a package does with data, on your device or elsewhere, is governed by that creator's own terms, not this policy.
Stripe's own processing. When you pay, Stripe processes your card and payment data under its own privacy policy and partly for its own purposes (see §5 and §7).
Google's own processing. Google operates the sign-in you use to authenticate, under Google's own privacy policy (see §5 and §7).
Self-hosted enterprise deployments. An organization that runs DatumHue under the enterprise subscription is the controller of the data inside its own deployment; the only data that reaches us from it is the license renewal exchange described in §3.6.

3. The personal data we process

We process:

Sign-in identity — a Google account identifier and email. You sign in to the platform with Google sign-in. From Google we receive your Google account identifier and your email address. The sign-in tokens are stored on your own device (§9). Because Google requires a client secret at its token endpoint, your sign-in and the periodic token refresh that keeps you signed in pass through our identity service, which adds the secret, forwards the request to Google, reads your account identifier, and keeps Google's refresh token in a sign-in session (§3.9). Your client presents the tokens to us when you buy a paid package, when a device of yours checks your purchases with a creator through us, when you list or remove your devices, and when you publish (§3.10), so we can verify who is acting and derive from the account identifier the pseudonyms described in §3.2, §3.8, and §3.9. The identifier and email are kept as §6 states. Creators also present them at onboarding, and a creator's identifier is kept with the creator record (§11).
Paid-package purchase data. Paid packages are sold to you by their creator, as the seller and merchant of record, with checkout hosted by Stripe on the creator's own Stripe account (§5.2). At checkout Stripe collects your email address and payment details on that account. What we pass to the creator's package provider is a pseudonymous buyer reference — derived from your sign-in identity, different for each creator, and not on its own attributable to you — together with the package bought and Stripe's payment reference. The purchase ledger lives with the creator (§5.4). Our server logs hold your buyer reference with the package for each purchase and refund, and with the creator for each ownership check, that we pass on to a creator (§6). We can view the sale records on the creator's Stripe account for reconciliation and to account for the platform fee we earn (§5.2).
Device key and entitlements. To renew your access to a paid package without signing in again, your client generates for your sign-in identity a separate device key for each creator, and a device identifier (§3.8), and keeps them on your device (§9). Where you own packages from a creator, the creator's provider stores the public half of your key for that creator against your pseudonymous buyer reference, and your entitlements themselves are kept on your device (§9).
Connection metadata. To operate our servers and relay, our infrastructure processes technical connection data such as your IP address in transient server logs. This is used to run and secure the service. Our servers also hold each connecting workstation's network address and identifier, and which shared documents and message topics it joins, so that workstations can reach and find one another (§5.7). To limit repeated requests, the shop and the platform hold the IP address of each request and a digest of the email address, subscription, or account it names. The Platform workstation app's launcher also checks for updates on each start by fetching a release feed from GitHub, which sees your IP address in that request and in any download that follows (§5.6).
Checkout and fulfillment data for purchases from us. When you start the creator or enterprise subscription through our checkout, we receive from Stripe — after you complete payment — the name and email address you gave at checkout, your billing address (and, for the enterprise subscription, your VAT or tax identification number), and a payment or subscription reference. We use them to deliver what you bought (the license file of the enterprise subscription, or the registry credentials of the creator subscription, which we generate and email to you), to fulfil each payment exactly once, to charge the correct tax, and to keep what we delivered in step with the subscription's payment status.

For the enterprise subscription we additionally process: the company or organization name you enter at checkout (stamped into the license record and the license file as the licensee); the billing contact email, which receives the license file, renewal reminders, notices this policy or the license agreement promise, and the confirmation code that approves a self-serve resize; the license record itself — the company name, a license identifier, and the licensed size, stored as part of the subscription with our payment processor (Stripe); and, when you use the self-serve pages, the email address you type to have a license file re-sent and the license file you upload to resize or resume a subscription.
License renewal log. A deployment or client that holds a network-renewed license fetches renewed license files from our license issuer while its subscription is active. The issuer keeps a log of each renewal — a fingerprint of the license identifier, a customer reference, the IP address the renewal came from, and timestamps — and of each license it signs for a subscription, by the same fingerprint and customer reference, so that a license file used outside the organization it was issued to can be detected and investigated. The log holds no name or email.
Consulting requests. When you send us a consulting request through the form linked from our marketing site, we process the name, email address, company (if you give one), and message you enter. The request is delivered to us as an email and is not stored in any other system. We use it to respond to you, and we forward it to THoSE AB, the independent consulting company in Sweden that would carry out the work, so they can assess and answer your request (§5.5).
Your account's devices. The platform keeps a device list for your account, named by a pseudonym. For each device it holds the device identifier (§3.3), its system (Linux, macOS, Windows, or web), when it joined, and when it last checked your purchases through us; and, for each creator whose provider holds the device, the creator, the device key, and your buyer reference with that creator. It also holds records of the devices you removed, and the deletion requests still to be delivered to creators' providers (§5.4).
Sign-in sessions. For each sign-in, our identity service keeps a sign-in session: a pseudonym for your account, Google's refresh token, and when the session began, was last renewed, and was last used.
Publishing. When you publish a package, withdraw or reinstate a version, or change a price, we issue a publish pass for the provider you publish to, so that it can apply its publish rules. The pass names your Google account identifier and workstation, and carries your verified email address and the other details of your Google sign-in. Our logs record each pass, and each such action at the providers we operate, with your account identifier, the provider, and the workstation. Every provider records in its public package catalog, with each version and each withdrawal or reinstatement, the Google account identifier of who made it, and we keep a copy of every creator's catalog.

4. Why we process it, and our legal basis

We process each category of data for a specific purpose with a specific lawful basis under Article 6 GDPR. Where the basis is our legitimate interest, the purpose column states that interest, and you may object to the processing on grounds relating to your particular situation (§8).

Data	Purpose	Lawful basis
Google account identifier + email	Relay your sign-in and token refresh to Google so you stay signed in; verify who is buying a paid package, registering a device to open one, managing devices, or publishing, and derive the pseudonymous buyer and account references — providing the platform service to you	Performance of a contract — Art 6(1)(b)
Sign-in session (§3.9)	Keep you signed in; let you sign out on every device	Performance of a contract — Art 6(1)(b)
Pseudonymous buyer reference + payment reference (paid packages)	Have the creator deliver and re-deliver the package you bought; ensure a payment is fulfilled only once (idempotency); account for our platform fee	Performance of a contract — Art 6(1)(b)
Device key (public half, held by the creator's provider)	Check and renew your access to a creator's paid packages	Performance of a contract — Art 6(1)(b)
Device list (§3.8)	Apply the limit of ten devices; let you see and remove your devices; have creators delete the keys of devices not, or no longer, on the list	Performance of a contract — Art 6(1)(b)
Publish pass (§3.10)	Let the provider you publish to apply its publish rules	Performance of a contract — Art 6(1)(b)
Checkout name, email, billing address, tax id + payment/subscription reference (purchases from us)	Deliver what you bought (a license file, or the registry credentials of a creator subscription); fulfil each payment exactly once; charge the correct tax; keep what we delivered for a subscription in step with its payment status	Performance of a contract — Art 6(1)(b); tax handling is a legal obligation — Art 6(1)(c)
Company name + billing contact email + license record (enterprise subscription)	Identify the licensee in the license file; deliver, re-send, renew, resize, and resume the license; send the notices and confirmation code those flows require	Performance of a contract — Art 6(1)(b)
The copy we keep of each delivery email we sent you	Re-send a delivery and answer questions about it	Legitimate interests — Art 6(1)(f)
License renewal log (license-identifier fingerprint, customer reference, source IP address)	Detect and investigate use of a license file outside the organization it was issued to	Legitimate interests — Art 6(1)(f)
Consulting-request details (name, email, company, message)	Respond to your request and scope the work you asked about	Pre-contractual steps at your request — Art 6(1)(b)
The same purchase / payment-reference records, once they form accounting records	Meet Swedish bookkeeping-law retention duties (see §6)	Legal obligation — Art 6(1)(c)
IP address / connection metadata in server logs and in the update check; workstation addresses, the documents and topics they join, and request-limit data (§3.4)	Operate and secure the platform servers and relay; let workstations reach and find one another; prevent abuse; deliver updates	Legitimate interests — Art 6(1)(f)
Buyer references, account pseudonyms, publishers' account identifiers, and workstation identifiers in server logs	Operate, troubleshoot, and secure purchase delivery, devices, sign-in, and publishing	Legitimate interests — Art 6(1)(f)
Publisher records in package catalogs (§3.10)	Show who published each version of a package; sell and deliver creators' packages from our copy of their catalogs	Legitimate interests — Art 6(1)(f)

We share personal data with the following recipients.

Google — in two roles. As the sign-in (identity) provider, Google returns your account identifier and email to us when you authenticate; Google's own processing of your Google account is governed by Google's privacy policy. As our email provider (Google Workspace), Google transports and stores the email we send and receive: license files, creator registry credentials, enterprise confirmation codes and notices, consulting requests, and anything you write to the contact addresses in this policy. In that role Google acts as our processor under Google's data-processing terms.
Stripe — as the payment processor. Paid packages are sold creator-to-buyer through Stripe, where the creator is the merchant of record for the sale. Stripe processes the card and payment data; Shuusei AB does not receive your card data. For purchases where Shuusei AB itself is the seller — the creator and enterprise subscriptions — Stripe processes the payment for us and passes us the checkout details listed in §3.5. Shuusei AB also receives a platform fee on each creator sale; Stripe records that fee against the sale, and those records form our own accounting records (see §6). Stripe acts as our processor for the data it handles on our instructions, and as an independent controller for its own purposes such as fraud detection and legal compliance, where it determines the purposes and means itself.
Hosting provider (Hetzner). Our platform infrastructure — the servers that run the backend and serve the marketing site, the web client, the shop, and the license-management endpoints — is hosted on Hetzner Online GmbH, in the European Union (Germany). Hetzner processes technical connection data such as IP addresses in order to deliver traffic to you, and acts as our processor under a data-processing agreement. The license issuer that signs license files and keeps the renewal log (§3.6) is equipment Shuusei AB operates in Sweden.
Creator package providers. Packages are delivered to you from the package-provider node their creator operates. When your client downloads a creator's package, free or paid, the creator's provider sees the technical connection data needed to serve you — your IP address and which package and version your client requested. When you buy a package, the provider additionally receives your entitlement and the delivery details for the purchased package. Whenever your client checks whether you own the creator's packages, the provider receives your buyer reference with that creator and your device key (§3.3); it also receives our requests to delete a device key, which name that buyer reference. The purchase record a creator's provider keeps identifies you only by the pseudonymous buyer reference described in §3.2. The creator does, however, see the email address and payment details you enter at checkout in their own Stripe account, because the creator is the merchant of record for the sale (§5.2). When you publish to a creator's provider, it receives your publish pass (§3.10) and records your account identifier in its public catalog. The creator processes all of this data as an independent controller under their own terms. For packages that Shuusei AB publishes itself, Shuusei AB is the creator and this policy applies.
THoSE AB — our consulting partner. When you send us a consulting request (§3.7), we forward it — the name, email, company, and message you entered — to THoSE AB, an independent consulting company established in Sweden, so they can assess and answer it. They process your request to prepare that response; any engagement you then enter with them is governed by their own terms.
GitHub — as the distribution channel for updates. The Platform workstation app's launcher fetches its release feed, and any update it then installs, from GitHub (a Microsoft subsidiary, in the United States), which sees your IP address in those requests. GitHub receives nothing else from the client.
Other workstations. Our servers give your workstation's network address, including its IP address, to the workstations in the same shared document or message topic, and to anyone who asks for it by your workstation's identifier.

We may also disclose personal data where we are legally required to (for example, in response to a valid legal request), or to establish, exercise, or defend legal claims.

6. How long we keep it

Data	Retention
Google account identifier + email	The identifier is kept in the server logs, the publisher records in package catalogs, and a creator record, as the rows below state. The sign-in tokens on your device last until you sign out or they expire
Sign-in session	Until you sign out on that device or on every device, until it goes unused for thirty (30) days, or until we erase it at your request (§8)
Device list	A device is deleted ninety (90) days after it last checked your purchases through us, or when you remove it; records of removed devices, and deletion requests not yet delivered, are kept for ninety (90) days. Erased at your request (§8)
Pseudonymous buyer reference + device key (held by the creator's provider)	Kept by the creator under the creator's own terms
Purchase / sale records and payment references that form accounting records	Retained for approximately seven (7) years, as required by the Swedish Bookkeeping Act (Bokföringslagen, SFS 1999:1078)
Checkout name, email, and billing details for deliveries (purchases from us)	Kept as long as needed to deliver and re-deliver what you bought; parts that form accounting records follow the seven-year row above
Copies of the delivery emails we sent you	Kept until you ask us to erase them (§8); parts that form accounting records follow the seven-year row above
Enterprise license record (company name, license identifier, size — held with the subscription at Stripe)	Kept while the subscription can renew or resume; parts that form accounting records follow the seven-year row above
Creator record (§11)	Kept while your subscription is active and, afterwards, for as long as your namespace stays reserved for your account — until you ask us to erase it; then only the namespace, marked as retired, and your registry's public keys are kept, permanently (§11); parts that form accounting records follow the seven-year row above
Consulting request (email correspondence)	Kept as long as needed to handle the request and any engagement that follows; parts that form accounting records follow the seven-year row above
Publisher records in package catalogs (§3.10)	Kept for as long as the catalog exists
License renewal log	Kept for two (2) years
Server logs: connection metadata such as IP addresses; buyer references with the packages and creators concerned; account pseudonyms; publishers' account identifiers; workstation identifiers	Our servers keep log entries for at most thirty (30) days
Workstation addresses, and shared-document and message-topic registrations (§3.4)	Kept while the workstation is connected, or in the document or topic; deleted within eight (8) days after it disconnects or leaves
Request-limit data (§3.4)	At most twenty-five (25) hours after the last request

The payment references we keep are the accounting records for our own sales and for the platform fee revenue described in §5. Because the seven-year accounting-retention duty is a legal obligation, we cannot delete records that fall under it before that period ends, even if you ask us to erase them (see §8).

7. International transfers

Our own infrastructure is in the EU/EEA (§5.3). Creators and their providers (§5.4) may be outside it. Where no adequacy decision covers what we send them, it is protected by the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module One), which every creator accepts in section 13 of the Creator Terms of Use. Three recipients are based in the United States:

Google processes your identity data (sign-in) and our email (Google Workspace) in the US.
Stripe (payments) processes payment data in the US.
GitHub (updates) processes the IP address of your update check in the US.

These transfers are protected by the EU–US Data Privacy Framework, under which Google, Stripe, and GitHub are certified, and by the European Commission's Standard Contractual Clauses as a fallback safeguard.

You can ask us for more information about these safeguards, and for a copy of the relevant clauses, by contacting privacy@datumhue.com.

8. Your rights

Under the GDPR you have the right to:

Access — obtain confirmation of whether we process your personal data and a copy of it.
Rectification — have inaccurate or incomplete data corrected.
Erasure — have your data deleted (the "right to be forgotten").
Restriction — have us limit how we process your data in certain circumstances.
Data portability — receive the data you provided in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
Object — object to processing based on our legitimate interests (§4), on grounds relating to your particular situation.

Limits set by the law. The rights to erasure and to object do not extend to records we are legally required to keep — in particular the purchase and accounting records subject to the seven-year Bokföringslagen retention duty (§6). We can restrict processing of those records to storage-only until the retention period ends, but we cannot delete them before then.

What erasure covers. There is no platform account to close. An erasure request reaches your sign-in sessions and device list (below), the records held with our payment processor, a creator record (§11), your consulting correspondence, and the email we sent you, subject to the limits above. The purchase records a creator keeps are the creator's, and requests about them go to the creator; because they are keyed by a pseudonym, we can tell a creator which reference is yours only if you ask us to.

Erasing your sign-in sessions and device list. Email privacy@datumhue.com from your Google account's address, giving your Google account identifier. The store's Devices page, and the Platform workstation app's datumhue login command, show it.

To exercise any right, contact privacy@datumhue.com. We respond within the time limits set by the GDPR (normally one month). There is no charge for a reasonable request.

Right to complain. If you believe we have not handled your personal data lawfully, you may lodge a complaint with the Swedish supervisory authority:

Integritetsskyddsmyndigheten (IMY) — the Swedish Authority for Privacy Protection. Email: imy@imy.se · Website: imy.se

You may also complain to the supervisory authority in your EU/EEA country of residence.

9. Cookies and local storage

None of our sites sets cookies. datumhue.app, datumhue.com, and datumhue.dev set no cookies of their own. What each site keeps in your browser's storage is listed below. What the client sends to us or to a creator's provider is described in §3; what a package does with the data it saves is governed by its creator's terms (§2).

The web client (datumhue.app) and the Platform workstation app. To run the workstation, the client stores data locally on your own device — in your browser's storage (IndexedDB, Web Storage, and the browser's private file system) on the web, or in your local application-data folder in the workstation app. Every item is strictly necessary for a feature you are using:

What it stores	Purpose	Why it is kept
Sign-in tokens, with your Google account identifier	Keep you signed in so you don't re-authenticate every visit, and tell your purchases apart from another identity's on a shared device	Present only after you sign in; needed for the sign-in you requested
Session identifier	Identify your current session and let you continue where you left off	Needed to run the workstation and the "continue last session" feature
Document identity key	A private key that signs the documents you create and authorises what is shared with you	Needed to keep access to everything shared with you
Device key and cached entitlements	The key described in §3.3 and a local copy of the entitlements it renews	Needed to open the paid packages you bought
Connection cache	Remember how to reach the platform's servers for faster startup	Operates the connection
Downloaded packages	The package content your client has fetched, the list of packages you installed, and an index of what is stored	Needed to run installed packages without downloading them again
Package data	Data your installed packages save, under the package's own terms	Saved at your installed packages' request
Terms and license acceptance	Remember that you accepted the platform terms (web), or the app license and with it the platform terms (workstation app), so you are not asked again on every start	Set only after you accept; records which version you accepted, so you are asked again only when the terms change
Console history (workstation app)	The commands you typed into the client's built-in console	Kept so the console can recall them

The marketing site (datumhue.com) and documentation (datumhue.dev) store your chosen colour theme — and, on datumhue.dev, your chosen font and edition and the pages you viewed most recently — in your browser's local storage so the site remembers them between visits. The shop pages on datumhue.com (checkout, enterprise license management, the creator pages, and the consulting form) store nothing, except that the creator pages keep the state of an in-progress sign-in in session storage, which your browser discards when the tab closes.

Sign-in and payment happen on other companies' sites. When you sign in, the sign-in screen is served by Google on Google's own domain, where Google sets its own cookies under Google's privacy policy. When you buy a paid package, or buy from us, checkout is hosted by Stripe on Stripe's own domain, where Stripe sets its own cookies under Stripe's privacy policy. We do not set or read those cookies (see §5 and §7).

10. Is providing your data required?

Sign-in identity. Signing in with Google is not needed to connect to the platform or to install free packages. It is necessary to buy a paid package, to register a device to open one, to manage your devices, or to publish: without the account identifier we cannot tell who is acting.
Checkout details. Buying from us requires the details in §3.5 — and the enterprise subscription additionally the company name that the license names as its licensee: without them we cannot deliver the purchase or charge the correct tax.
Accounting records. Once a sale exists — a paid package from a creator, or a purchase from us — keeping its payment reference is a statutory obligation under Swedish bookkeeping law (§6).

11. Creators

If you publish on the platform as a creator, we process, in addition to the data above:

Your creator record — the namespace you claimed, the sign-in identity that holds it (§3.1), the display name you enter, your contact email, and the public key of your package registry. It is stored as part of your creator subscription with our payment processor (Stripe) and used to admit your registry to the platform, to attribute your packages, and to deliver your credentials. Your namespace is public: it prefixes everything you publish. The display name labels your registry for the platform operator. Lawful basis: performance of a contract — Art 6(1)(b).
Subscription and payout references. Your creator subscription is billed by Stripe, and sales of your paid packages settle to the Stripe Connect account you onboard, which we create in the country you enter on the onboarding page. We hold the subscription reference, its payment status, and your connected-account identifier — not your card or bank details, which stay with Stripe. Stripe collects the identity and business information a Connect account requires as an independent controller under its own terms. Lawful bases: performance of a contract — Art 6(1)(b) — and, once fee records become accounting records, legal obligation — Art 6(1)(c).
Delivery email and notices. The email on your creator record is used to deliver your registry credentials, to deliver fresh credentials when you rotate your registry key, and for the notices described in the Creator Terms of Use — including a notice, with an automatic refund, if a namespace you paid for turns out to be held by another account. Lawful basis: performance of a contract — Art 6(1)(b).

Your namespace stays bound to your account. A namespace belongs to the sign-in identity that first subscribed for it. So that nobody else can take it over while your subscription has lapsed, we keep your creator record — including the sign-in identity that holds the namespace — after cancellation, and re-subscribing from the same account resumes it. Lawful basis: our legitimate interest — Art 6(1)(f) — in protecting creators and their buyers against namespace takeover. If you would rather have your creator record erased, write to privacy@datumhue.com: we erase its sign-in identity, display name, and contact email, apart from accounting records, and keep only the namespace, marked as retired, and your registry's public keys, so that the namespace is never reassigned. Lawful basis: the same legitimate interest.

Retention otherwise follows §6: records that become accounting records are kept for the statutory seven years. Your rights under §8 apply to this data in the same way. As the seller of your paid packages you also act as an independent controller of the checkout data Stripe shows you and the delivery data your provider receives (§5.4) — that processing is governed by your own terms, not this policy.

12. Changes to this policy and to processing

We may update this policy. The governing version is identified by the Version line at the top of this document. If we make a material change, or if we intend to process your personal data for a new purpose not described here, we will inform you of that purpose and the relevant information beforehand, and — where the law requires it — obtain your consent before the new processing begins.