Privacy and data processing
Uploaded XML is processed in memory for one validation request and is not retained after the response.
Last updated:
1. Operator
Flakstad Software AS, organisation number 935 382 017, Fløanvegen 214, 7510 Skatval, Norway. Contact: kontakt@saftlint.no.
2. Uploaded SAF-T data
The uploader is the controller for personal data in the file and must have the necessary authority and legal basis. Flakstad Software AS acts as processor solely on the instruction to validate the file and return the result.
- Raw XML and filenames are not written to application logs.
- XML exists in working memory only for the request.
- Files, results and findings are not used for training, analytics, marketing or any other purpose.
- The response contains findings, aggregate status, a SHA-256 hash and deterministic validation ID; Saftlint does not retain it.
3. Processor terms
The subject and purpose is automated SAF-T validation. The nature is temporary receipt, parsing, checking and return of a result; duration is one request. Data types depend on the file and may include identifiers, contact details, transactions and accounting data about employees, customers, suppliers and other persons.
- Processing follows the documented instruction created by use of the validator.
- Any person authorised to access the data is bound by confidentiality.
- Access is restricted, transport uses HTTPS, external entities are rejected and resource use is bounded.
- Hetzner Online GmbH is the authorised subprocessor for server hosting in Finland and is subject to equivalent data-protection obligations. A planned replacement or addition will be published before it takes effect, allowing the user to object by ceasing use of the web validator.
- We provide reasonable assistance with data-subject rights, incidents and compliance information relevant to this transient processing.
- We notify the controller if an instruction appears to breach data-protection law, provide information necessary to demonstrate compliance and permit reasonable audits relevant to this processing.
- No uploaded file remains to return or delete after the request, and files are not included in backups.
4. Operational logs
Flakstad Software AS is controller for limited technical processing based on legitimate interests in secure and stable operation. The IP address is used transiently in memory for rate limiting. Access logs contain time, method, URL path, status, duration and response size, but not IP address, query parameters, headers, filename, XML, hash, result or findings. Logs are automatically deleted within seven days.
5. Analytics and cookies
Analytics is disabled. Saftlint uses no cookies, local storage or session storage.
6. Contact and rights
Do not email a complete SAF-T file. Send a ruleset, rule ID and minimised synthetic example if needed. For access, correction, deletion, objection, incidents or questions, contact kontakt@saftlint.no. You may complain to the Norwegian Data Protection Authority.
If this translation conflicts with the Norwegian privacy notice, the Norwegian text controls.