Privacy Policy

1Who is responsible

Acropea is provided by Cheap Thrills Media AB (org. no. 559262-6278), Ystadsvägen 142, 121 51 Johanneshov, Sweden. We are the data controller for the personal data described in this policy. Questions and requests: christer@cheapthrillsmedia.se.

When you upload a document, it may contain personal data about other people. For that content you decide what is processed and why; we process it only to perform the edit you ask for.

2Your documents

We process the files you upload only to provide the service — reading, editing, converting and exporting them.

• Editor: an uploaded document is held in our servers’ memory while you work and in a private storage bucket so your session survives a restart. It is deleted automatically 24 hours after upload, together with the changes you made to it. The edited file you download is created for you on request; we do not keep a copy.
• Enterprise batch: files are kept on our processing server only while a job is active — deleted 2 hours after your last activity, and never kept longer than 24 hours. You can delete an upload or a job immediately.
• We do not sell your documents, use them for advertising, or use them to train AI models.

3AI features

Some features use an AI model: editing with AI, rewriting, translating, answering questions about a document, suggestions and checks. When you use one, the relevant text of your document (and your instruction) is sent to Anthropic, which runs the model and returns the result. Under Anthropic’s commercial terms, this data is not used to train their models.

Scanned pages are read with Microsoft Azure text recognition (the page image is sent for recognition). Read-aloud sends the text being read to Microsoft Azure speech. Voice input uses your browser’s own speech recognition — in Chrome, for example, the audio is processed by Google.

Features that do not need AI — such as find and replace, masking, page operations and export — run on our own servers.

4Account and payment

You can use the editor without an account. If you sign in with Google, we receive your email address and Google account identifier (and your name and profile picture for the signed-in session). We store your email, the account identifier and your subscription status.

Payments are handled by Stripe. We send Stripe your email address and an internal customer reference; card details go directly to Stripe and never reach us.

If you choose to save to Google Drive, we ask for access only to files Acropea creates or that you open with it (Google’s “drive.file” permission) — never your whole Drive. The access token is kept in your encrypted sign-in cookie.

5Usage and security data

To run the service fairly and safely — usage limits, billing, preventing abuse, and understanding which features are used — we record:

• a random session ID stored in your browser (not linked to your identity unless you sign in),
• your IP address in hashed form only — we do not store the address itself,
• the action used, page counts, AI usage (token counts) and time.

We do not record the content of your documents in these logs. Our servers also keep short-lived technical logs, and we may use an error-reporting service (Sentry) that receives technical details when something breaks — not your documents.

6Cookies and local storage

We use no advertising or tracking cookies and no analytics tools. When you sign in, a necessary session cookie keeps you signed in. Your browser’s local storage keeps your settings (theme, language, read-aloud), your session ID and — if you save one — your signature, which stays on your device. Fonts for the editor are loaded from Google Fonts, which means your browser contacts Google’s servers.

7Who helps us

We use these providers to run Acropea. They process data on our behalf and only for these purposes:

Some of these companies are based in the United States. Where data leaves the EU/EEA, the transfer is protected by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

8Why we may process your data

• To provide the service you ask for (contract): processing your documents, your account and payments.
• Our legitimate interest in running a secure, fair and working service: usage limits, abuse prevention, error reporting and statistics.
• Legal obligations, such as bookkeeping rules for payments.
• Your choice where you actively turn something on, such as Google Drive.

9How long we keep data

• Editor documents: deleted automatically 24 hours after upload.
• Enterprise batch files: deleted 2 hours after your last activity, at most 24 hours.
• Account data: as long as you have an account; deleted on request.
• Usage records: as long as needed for usage limits, billing, security and statistics.
• Payment records: as long as Swedish bookkeeping law requires (normally 7 years), kept by Stripe and us.

10Your rights

You have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. Email christer@cheapthrillsmedia.se and we will answer within one month.

You can also complain to the Swedish data protection authority, Integritetsskyddsmyndigheten (IMY), at imy.se.

11Children and changes

Acropea is not intended for children under 16.

We may update this policy as the service changes. The date at the top shows the latest version; if a change matters to how we use your data, we will say so on the site before it applies.