This policy explains what personal data Crestline AB ("Crestline", "we") collects, why we collect it, and the rights you have over it. It is written to be read, not to be survived. This is a template and not legal advice — have it reviewed by counsel before relying on it in production.

Who is responsible for your data

For residents, your building's management (the BRF or property owner) is the data controller, and Crestline acts as the data processor on their behalf under a signed data processing agreement (PUB-avtal). For buildings and prospects who contact us directly, Crestline is the controller.

What we collect

• Account details: name, email, and the unit you're associated with.
• Content you create: messages to management, maintenance requests, bookings, posts, and RSVPs.
• Technical data: device type and app version, used to keep the service running and secure.
• Demo requests: the information you submit on our contact form.

What we never do

We do not sell your data. We do not share it with advertisers. We do not build advertising profiles, and we do not use resident content to train models. Data is used to operate the platform for your building — nothing else.

How long we keep it

Resident data is retained for as long as your building uses Crestline. If a building leaves, its data is exported to management and then deleted within 90 days. Demo enquiries are kept for up to 24 months unless you ask us to remove them sooner.

Your rights

Under the GDPR you can request access to your data, correction, deletion, restriction, and portability, and you can object to certain processing. See our GDPR page for how to exercise these, or email privacy@crestline.se.

These terms govern the use of Crestline by buildings and their residents. By using the platform, you agree to them. This is a template and not legal advice.

The service

Crestline provides a resident experience platform delivered as a mobile and web application. Features are enabled at the discretion of each building's management. We may add, change, or remove features over time, and we'll give reasonable notice of material changes.

Accounts

Residents access Crestline through an invitation tied to their unit. You're responsible for keeping your login secure and for the content you post. Management is responsible for verifying who belongs to their building.

Acceptable use

• Don't post unlawful, harassing, or misleading content.
• Don't attempt to access data belonging to other residents or buildings.
• Don't misuse the concierge or maintenance channels for emergencies — call the appropriate emergency services instead.

Fees and trials

Pricing is published on our pricing page. New buildings receive the first three months free with no commitment. After the trial, subscription fees apply at the building's tier rate. There are no automatic charges without confirmation.

Cancellation

A building may cancel at any time. On cancellation, data is exported to management and then deleted as described in our Privacy Policy.

Liability

Crestline is provided "as is" to the extent permitted by law. We are not liable for indirect or consequential losses. Nothing in these terms limits liability that cannot be limited under Swedish law.

Crestline is built around the principle that resident data belongs to residents. This page summarises your rights under the General Data Protection Regulation and how to exercise them. It's a template — confirm the specifics with a data protection professional.

Your rights at a glance

• Access — get a copy of the personal data we hold about you.
• Rectification — correct data that's wrong or incomplete.
• Erasure — ask us to delete your data where there's no overriding reason to keep it.
• Restriction — limit how we use your data in certain cases.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.

How to make a request

Email privacy@crestline.se from the address tied to your account. We'll respond within 30 days. For residents, some requests may be routed to your building's management, who is the controller of your data.

Data processing agreements

Every building on Crestline signs a PUB-avtal (data processing agreement) before going live. This sets out exactly what data we process and on what basis, and is a precondition for joining the platform.

Where data is stored

Resident data is hosted within the EU/EEA. We use sub-processors only where necessary to run the service, and each is bound by equivalent data protection obligations.

Complaints

If you believe we've handled your data improperly, you can contact us first, and you also have the right to lodge a complaint with the Swedish data protection authority, Integritetsskyddsmyndigheten (IMY).