Privacy and data processing

Uploaded XML is processed in an isolated temporary area for one validation request and deleted before the request ends.

Last updated: 13 August 2026

1. Operator

Flakstad Software AS, organisation number 935 382 017, Fløanvegen 214, 7510 Skatval, Norway. Contact: kontakt@saftlint.no.

2. Uploaded SAF-T data

The uploader is the controller for personal data in the file and must have the necessary authority and legal basis. Flakstad Software AS acts as processor solely on the instruction to validate the file and return the result.

• Raw XML and filenames are not written to application logs.
• XML is written temporarily to the systemd service's isolated PrivateTmp work area and deleted when validation ends. The area is not part of Saftlint's application backups.
• Files, exact results and findings are not used for training, analytics, marketing or any other purpose. Only the coarse outcome category described in section 5 is used for analytics.
• The response contains findings, aggregate status, a SHA-256 hash and deterministic validation ID; Saftlint does not retain it.

3. Processor terms

The subject and purpose is automated SAF-T validation. The nature is temporary receipt, parsing, checking and return of a result; duration is one request. Data types depend on the file and may include identifiers, contact details, transactions and accounting data about employees, customers, suppliers and other persons.

• Processing follows the documented instruction created by use of the validator.
• Any person authorised to access the data is bound by confidentiality.
• Access is restricted, transport uses HTTPS, external entities are rejected and resource use is bounded.
• Hetzner Online GmbH is the authorised subprocessor for server hosting in Finland and is subject to equivalent data-protection obligations. A planned replacement or addition will be published before it takes effect, allowing the user to object by ceasing use of the web validator.
• We provide reasonable assistance with data-subject rights, incidents and compliance information relevant to this transient processing.
• We notify the controller if an instruction appears to breach data-protection law, provide information necessary to demonstrate compliance and permit reasonable audits relevant to this processing.
• No uploaded file remains to return or delete after the request, and files are not included in backups.

4. Operational logs

Flakstad Software AS is controller for limited technical processing based on legitimate interests in secure and stable operation. The IP address is used transiently in memory for rate limiting. Access logs contain time, method, URL path, status, duration and response size, but not IP address, query parameters, headers, filename, XML, hash, result or findings. Logs are automatically deleted within seven days.

5. Analytics and cookies

Saftlint uses PostHog Cloud EU for limited cookieless traffic analytics. The purpose and legal basis is our legitimate interest in understanding whether the pages and validator are used, and improving the service without analysing SAF-T data.

• PostHog receives page views, language, referring domain, UTM source/medium/campaign, coarse browser and device type, and named actions such as starting/completing validation and following vendor-contact, CLI, CI or feedback links.
• After a completed web validation, the server sends one coarse outcome category: malformed XML, XSD error, semantic findings or pass. The category is not linked to a browser or session.
• Filename, XML, hash, exact result, finding counts, rule IDs, XML paths, line/column and explanation text are never sent to PostHog.
• No cookies, localStorage or sessionStorage are used. Cookieless processing removes the IP address, and we do not use person profiles, autocapture, session replay, heatmaps or surveys.
• Do Not Track is respected. PostHog acts as processor for analytics data in the EU.

You can object by enabling Do Not Track in your browser or contacting us.

6. Contact and rights

Do not email a complete SAF-T file. Send a ruleset, rule ID and minimised synthetic example if needed. For access, correction, deletion, objection, incidents or questions, contact kontakt@saftlint.no. You may complain to the Norwegian Data Protection Authority.

If this translation conflicts with the Norwegian privacy notice, the Norwegian text controls.