Privacy Notice
This notice explains how Reope AS (org. no. 920 028 268, Nedre Vollgate 5, 0158 Oslo, Norway, "Reope") may process personal data when you use our software services: Dokk, Toolbox and the tools in it, and ToolMaker (together, the "Services"). For personal data collected through our website, see our website privacy policy.
1. Our approach
Reope avoids storing personal data. We design the Services so that they need as little personal data as possible to work.
Where the Services may store personal data, it is stored on behalf of our customers. In those cases the customer is the data controller and Reope is the data processor under a data processing agreement. We do not use that data for our own purposes. The only exceptions are the limited cases described in section 3.
Customers must not enter personal data into ToolMaker prompts or files.
2. What data the Services may store
| Category | Examples |
|---|---|
| Account and licence data | Work email address or username, organisation, licence and sign-in status |
| Usage and diagnostic data | Tool and version used, timestamps, error and application logs, which may include a username |
| ToolMaker usage data | Prompts and generated output the customer submits, and usage counts |
| Contact and business data | Names, work email addresses and roles of customer contacts, support correspondence, invoicing details |
3. When Reope is the controller
Reope may act as an independent controller in limited circumstances, for example for operational identifiers such as system usernames captured in service logs, and for trial registrations. The purposes are support, error diagnosis, security and service improvement, and, for trial users, communication and marketing. Data stored on behalf of a customer is not used for these purposes.
| Purpose | Legal basis (GDPR) | Retention |
|---|---|---|
| Trial users and individuals without an organisation account: providing the trial and contacting you about it | Contract (Art. 6(1)(b)), legitimate interest (Art. 6(1)(f)) | Up to three years after the trial ends, unless you become a customer |
| Support, error diagnosis, security and service improvement, including usernames and other operational identifiers in service logs | Legitimate interest (Art. 6(1)(f)) | Up to three years |
| Business administration and bookkeeping | Legal obligation (Art. 6(1)(c)), contract | As required by the Norwegian Bookkeeping Act |
| Communication, marketing and analytics for trial users and business contacts | Legitimate interest or consent, as applicable | Up to three years, or until you object or withdraw consent |
Reope may also use anonymised and aggregated data derived from customer data to develop, improve and train the Services and to develop new products and services. Such data does not identify individuals.
4. Sub-processors
Reope may use the following providers to deliver the Services. Which of them handle data about you depends on the Services your organisation uses.
| Provider | Purpose | Location |
|---|---|---|
| Google (Firebase Authentication) | Sign-in and account authentication for Dokk | May involve processing outside the EEA (see section 5) |
| DigitalOcean | Hosting of Dokk and related services | EU |
| Slack | Internal and customer support communication | May involve processing outside the EEA (see section 5) |
| Anthropic | AI model provider for ToolMaker | May involve processing outside the EEA (see section 5) |
| LimeLM (wyDay) | Software licence activation and validation | May involve processing outside the EEA (see section 5) |
| Supabase | Database for ToolFinder, where offered | May involve processing outside the EEA (see section 5) |
| OpenAI | AI model provider for ToolFinder, where offered | May involve processing outside the EEA (see section 5) |
We may use other infrastructure providers where needed to run the Services, and we update this list when it changes. Each sub-processor is bound by a data processing agreement.
5. Transfers outside the EEA
Some of the providers above may process data outside the EEA. Where they do, we rely on safeguards required by GDPR, such as the EU Standard Contractual Clauses or the provider's certification under the EU-US Data Privacy Framework.
6. Retention
We keep personal data for no longer than three years, unless a longer period is required by law (for example bookkeeping rules) or is needed to establish, exercise or defend legal claims. Data stored on behalf of a customer is deleted or returned after the customer's agreement ends, as set out in the Terms and the data processing agreement. Anonymised and aggregated data may be kept.
7. Your rights
You may have the right to access, correct or delete your personal data, to restrict or object to processing, and to data portability. Where we process data on behalf of a customer, please contact your organisation first. We will help the customer respond to your request. Where Reope is the controller, contact us using the details below.
You may also complain to the Norwegian Data Protection Authority (Datatilsynet) or to the supervisory authority in your country.
8. Contact
Reope AS, Nedre Vollgate 5, 0158 Oslo, Norway. Email: toolbox@reope.com. Attention: Managing Director.
9. Changes
We may update this notice from time to time. The current version is always published on this page.