1. Controller
Attmos AB, organization number 556855-4884, Sweden, operates DIV3RSA and is the controller for personal data processed for account administration, platform operations, security, support, product administration and direct customer relationships unless a separate agreement establishes another role.
Privacy questions and data-subject requests can be sent to info@div3rsa.com.
2. Data we process
| Category | Examples |
|---|---|
| Account and identity data | Name, email address, account identifiers, organization/workspace membership, role, authentication and security state. |
| Access-request data | Information submitted when requesting access, organization details, intended use and review status. |
| Service content | Prompts, messages, files, project context, instructions, generated output and user feedback submitted through DIV3RSA. |
| Integration data | Provider account/team identifiers, project or repository identifiers, resource names, installation/configuration identifiers, authorization scopes and connection state. |
| Deployment and operational data | Deployment IDs, project IDs, status, environment/target, branch or commit metadata, webhook event identifiers, timestamps, error metadata and logs retrieved when requested. |
| Usage and audit data | Feature usage, actions, execution approvals, timestamps, security/audit events, rate-limit information and system diagnostics. |
| Device and network data | IP address, browser/user-agent information, request metadata and security-related technical information. |
| Support communications | Messages, contact details, troubleshooting information and correspondence sent to support. |
3. Why we process data and legal bases
- Performance of a contract: to provide accounts, workspaces, integrations, requested platform functions and support.
- Legitimate interests: to secure the service, prevent abuse, maintain auditability, troubleshoot faults, improve reliability and administer business relationships.
- Legal obligations: where required for accounting, legal claims, regulatory requests or other applicable obligations.
- Consent: where we specifically request consent and consent is the appropriate legal basis.
4. Vercel integration data
When you install the DIV3RSA Vercel integration, Vercel provides an authorization code and installation context that can include the selected Vercel user, team, projects, integration configuration and granted permissions. DIV3RSA exchanges the authorization code server-side and stores the resulting integration credential in protected server-side secret storage.
DIV3RSA uses this information to discover the Vercel resources you deliberately authorized, display those resources inside your workspace and perform Vercel operations that an authorized user requests through the service.
Vercel may also send signed webhook events about authorized deployments, projects and integration configuration changes. DIV3RSA verifies the signature before processing. We record the event identifier and limited operational metadata necessary to update deployment/project state and maintain an audit trail. We do not use Integration Webhooks as a general-purpose copy of all Vercel logs.
5. AI processing
Information submitted to DIV3RSA may be processed by the model and agent infrastructure configured for your workspace in order to generate responses, analyze code or operational data, execute approved workflows and maintain relevant product context. Provider access tokens and client secrets should not be exposed to the model or normal client-side interfaces.
We do not make decisions producing legal or similarly significant effects about you solely through automated processing unless such processing is separately disclosed and lawfully implemented.
6. Service providers and recipients
We may use service providers to operate DIV3RSA, including infrastructure, database/authentication, hosting, security, email and connected integration providers. Depending on the features you use, these can include services such as Supabase, Vercel, GitHub and email infrastructure providers. A connected provider also processes data under its own terms and privacy policy.
We may disclose data when necessary to professional advisers, auditors, insurers, authorities or courts, or in connection with a corporate transaction, where permitted or required by law.
We do not sell personal data to advertisers.
7. International transfers
Some service providers may process information outside Sweden or the EU/EEA. Where GDPR requires a transfer mechanism, we use an applicable adequacy decision, the European Commission's Standard Contractual Clauses, or another lawful safeguard, together with supplementary measures where appropriate.
8. Retention
We retain personal data only for as long as necessary for the purpose for which it was collected, including providing the service, maintaining security and auditability, resolving disputes and meeting legal obligations. Connected-resource records are removed or deactivated when a connection is disconnected, subject to backup cycles, security records and legal requirements.
9. Security
We use technical and organizational safeguards appropriate to the service, including authentication and role controls, server-side secret handling, least-privilege integration scopes, signed-webhook validation, access checks, audit records and environment separation. No system can guarantee absolute security, and users must also protect their credentials and connected accounts.
10. Cookies and authentication
DIV3RSA uses cookies or equivalent browser storage where necessary for authentication, session continuity, security and essential application functionality. Optional cookies or similar storage for analytics or marketing must not be enabled before the user has made an active choice. Details and controls are described in the Cookie Policy.
11. Your rights
Subject to applicable law, you may have the right to request access to your personal data, correction, deletion, restriction, portability or objection to certain processing. Where processing is based on consent, you may withdraw consent.
In Sweden, the supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY). You may contact us first at info@div3rsa.com.
12. Organization-controlled data
If you use DIV3RSA through an employer, customer or other organization, that organization may control parts of the workspace and may be the controller for personal data submitted in its business context. Attmos AB may act as a processor for such data under the applicable agreement.
13. Children
DIV3RSA is a professional service and is not directed to children. We do not knowingly offer the service to children in circumstances that would require parental consent under applicable data-protection law.
14. Changes to this policy
We may update this Privacy Policy when the service, processing activities or legal requirements change. The updated version will be published on this page with a revised “Last updated” date.
15. Contact
Privacy requests and questions: info@div3rsa.com.
Operator: Attmos AB, organization number 556855-4884, Sweden.