Privacy Notice

Last updated: 6 November 2026 · Version 2.7

This notice explains how MSET handles personal data: on this website, in our consulting work, and in the MSET products — MSET Sign, MSET Trust and MSET ID. It is one notice for everything we do, so the rules are in one place.

We work in IT security and regulated-industry compliance, and we hold ourselves to the standards we advise on. This notice is written to be read. If anything is unclear, ask us and we will explain.

1. Who we are

The controller of your personal data is Design & Animation i Vellinge AB, a Swedish limited company, org. no. 556825-4295, Vellinge, Skåne, Sweden.

We work under the names MSET and Kifarkis Nätsäkerhet. Whichever name you met us under, the company responsible for your personal data is Design & Animation i Vellinge AB.

Contact us about anything in this notice at info@mset.se — put “Privacy enquiry” in the subject.

We have not appointed a data protection officer, as the law does not require one of us. Privacy enquiries to the address above reach the person responsible for data protection.

Two roles, stated up front. For most of what this notice covers, we decide why and how personal data is used, so we are the controller. When a customer uses an MSET product to handle other people's data — documents it sends for signature, visitors to its trust centre, meetings it records — the customer decides, and we act as its processor under a data processing agreement. Sections 5 to 7 say which is which.

2. This website and enquiries

Contact form and email

When you use the contact form on this website or on the MSET Sign, MSET Trust or MSET Transcribe product page, or write to us, we receive your name, email address, company (optional) and your message, and on this website also the service area you chose. We use them to answer you and, if it leads anywhere, to prepare an offer.

Legal basis: steps you asked us to take before a contract (Art. 6(1)(b) GDPR), or our legitimate interest in answering enquiries (Art. 6(1)(f)). The form's required fields are what we need to reply; without them we cannot answer.

Visiting the site

The site is hosted on GitHub Pages. Like any web server, GitHub receives your IP address and browser details when you load a page, and may keep them in its own security logs; we have no access to those logs. The site's fonts are served from the site itself, so no font service receives your IP address.

We use Google Search Console, which shows us aggregated search statistics — not individual visitors. There is no Google Analytics, no advertising pixel and no behavioural tracking on this site.

No cookies, no tracking across websites and no profile of you: we count visits with GoatCounter to learn which pages help and where visitors come from. We see totals only — pages, links and forms used, referring site or campaign, browser, screen size, country, region and language. Your IP address is never stored. Legal basis: our legitimate interest in knowing how the website is used (Art. 6(1)(f)).

Legal basis for serving the site: our legitimate interest in running a secure, working website (Art. 6(1)(f)).

3. Consulting clients

When you engage us, we process the contact details of the people we work with at your organisation, the agreement, correspondence, invoices and our working notes. Legal basis: performing our contract with you (Art. 6(1)(b)) and, for accounting records, a legal obligation (Art. 6(1)(c)).

Where an engagement means handling personal data in your systems — your staff, patients, study participants or customers — you are the controller and we act as your processor under a data processing agreement. We use that data only for the work you asked for.

4. MSET product accounts

When your organisation uses MSET Sign, MSET Trust or MSET Transcribe, we hold the account: the organisation's name and details, the people who use it (name, work email, role and an optional job title), how they sign in, their settings, and the subscription and billing state. We also keep the account's activity record — who did what, and when — because customers rely on it as evidence.

Sign-in runs through MSET ID, our own identity service. Passwords are stored only as one-way hashes and two-factor secrets are encrypted. We record sign-ins and refused attempts to protect accounts from being taken over. If your organisation uses its own sign-in (single sign-on), we receive your identity from it instead of a password.

Payments are handled by Stripe; we never see or store card numbers. We send service emails you cannot switch off — verification, security notices, subscription changes. We do not run a marketing list.

AI assistance in MSET Sign is off unless an administrator of your organisation switches it on. When it is on, the text of the document being prepared — never the file itself, and never signers' addresses — is sent to the AI provider your organisation chose, to suggest where fields belong or to draft wording. The provider is named in the product before it is switched on. We do not use your documents or data to train AI models.

When your organisation accepts a product's terms of service, we record which version was accepted and how: the work email address of the administrator who accepted it, in the product or by placing an order, and when; or that it applied when the notice period ended. It is your organisation's record of its agreement with us, so it is kept after the account closes (section 10). Legal basis: our legitimate interest in being able to show what was agreed (Art. 6(1)(f)).

If your organisation uses the 21 CFR Part 11 mode of MSET Sign, its Part 11 audit trail names each person who acts in it — who changed a Part 11 setting, who was enrolled, who signed — by name and work email, because a regulated record must show who did what. Your organisation is the controller of that trail and is required to keep it, so it is not erased when a person's account is deleted; it is kept for as long as your organisation keeps its Part 11 records (section 10).

Legal basis: performing the contract with your organisation (Art. 6(1)(b)); our legitimate interest in keeping accounts secure and the service running (Art. 6(1)(f)); and accounting law for billing records (Art. 6(1)(c)).

5. MSET Sign: if you were asked to sign

An organisation sent you a document through MSET Sign. That organisation decides what the document is, why you were asked and how long it is kept: it is the controller, and we run the service on its instructions as its processor. Its name is in the email and on the signing page. Ask the organisation why you were contacted or to withdraw the document; if you cannot reach it, write to us and we will tell you who it is and pass your request on.

What is recorded when you sign

• Your name and email address as the sender entered them, and any job title you add.
• When the link was sent and opened, and when you signed, approved or declined — with any reason you gave.
• Your IP address at those moments.
• How your identity was checked: by the link alone, a one-time code sent to your mailbox (the code itself is not kept), a sign-in, or an electronic ID where the sender required one.
• Your signature as you drew or typed it, and anything you filled in on the document.

These facts are written into the sealed PDF and its audit trail. That is the point of the service: they are what make the signature provable later.

Electronic ID and identity checks

If the sender requires an electronic ID or an identity-document check, you complete it with a separate identity provider, which is responsible for that check under its own privacy notice; the signing page links to it. From an electronic ID we keep the provider's signed confirmation as evidence of who signed: your name, your date of birth and, when your electronic ID includes one, your national identity number. It is kept with the signing record and deleted with it. From an identity-document check we receive the result and the name it confirmed — not your identity documents.

The evidence record, and the limit of erasure

When a document is deleted, its content really is destroyed. We keep a minimal evidence record — the document's reference, who signed and when, how they were identified, and a fingerprint of the signed file, with no document content — for three years, so that anyone holding the signed PDF can still have it verified. We keep this record as controller, on our legitimate interest in being able to prove the signatures our service produced (Art. 6(1)(f)), and because it is needed to establish, exercise or defend legal claims. That is why we cannot erase it on request (Art. 17(3)(e)). Everything else about you, we can.

Being sent a document does not create an account or put you on any list. We do not market to signers.

6. MSET Trust: if you asked for a company's documents

A company uses MSET Trust to share confidential documents — security reports, certificates — with people who ask for them, usually after a confidentiality undertaking is signed. If you asked for access, that company is the controller of your request and of the record of what you opened; we process it on the company's behalf. The company's own privacy notice is linked on every page of its trust centre, and you should read it first.

What is processed: your request (name, work email, organisation, role, your reason and any answers to the company's questions); the undertaking you sign, through MSET Sign — section 5 applies, including the evidence record; your access, through single-use links and one-time codes that we hold only in a form that cannot be reversed; and an access log of what you opened, when, and from which IP address and browser. Documents you open carry a watermark that ties the copy to you.

Questions you ask a trust centre. If the company has switched on answers written by AI, a question you type on its trust centre is sent, with the parts of its public page that match it, to the AI provider the company chose — Microsoft (Azure OpenAI, in the EU) or Anthropic (in the United States) — which writes the answer. We do not store the question or who asked it; we count that a question was answered. The providers do not use it to train their models.

The company chooses how long the access log is kept, between one and ten years (four if it chooses none). Requests that never led to access are deleted after 90 days. People who only read a trust centre's public page are not tracked: views are counted as one number per day, with no IP address and no cookie. The access log is not erased on request during its period: it is kept to establish or defend legal claims about who saw what (GDPR Art. 17(3)(e); its basis is legitimate interest, Art. 6(1)(f)).

If the trust centre is MSET's own, MSET is the controller and everything in this section applies to us directly.

AI assistants. Where the trust centre allows it, you may let an AI assistant read a pack under your own access — with a key, or by signing it in with your email and a one-time code. We keep the assistant's name, and its key and tokens only in a form that cannot be reversed. What it does is logged as yours, and what it downloads carries your watermark.

Mail while you have access. Without subscribing, people with live access receive a reminder a week before their access ends, a message when a document they opened has a new version, and the trust centre's change notices while their access lasts (our legitimate interest, and the company's, in keeping the people it shares documents with up to date: Art. 6(1)(f)).

7. MSET Transcribe: meetings you record, and meetings you were in

An organisation uses MSET Transcribe to turn recordings of its meetings into transcripts, briefs and action items. The organisation decides what is recorded and why: it is the controller of its meetings, and we process them on its behalf under a data processing agreement. Your account with us is covered by section 4. Every brief says that it was written by AI, by which provider, and whether a person has reviewed it.

What is processed. The audio a person records in the browser, uploads, or imports from their own Plaud account or their own Microsoft Teams meetings; the transcript, with the speakers separated and the names the person gives them; the brief and action items; the names and terms kept per client to improve the transcription; and the addresses a person saves for sending a brief to a client. Alongside, the organisation's activity log records who shared a meeting with whom, who opened it, exports, deliveries and admin actions — by person, never by meeting title. Usage is counted per person (meetings, minutes, cost), without titles.

If you were in a recorded meeting. The organisation that recorded it is the controller. Your voice and what you said are in its transcript. We do not create an account for you or contact you. Ask that organisation about the recording; if you cannot reach it, write to us and we will pass your request on.

Where meetings are kept. In each person's own OneDrive, in an app folder MSET Transcribe can reach and nothing else, inside the organisation's own Microsoft 365 — or, if the organisation chooses, in one SharePoint site of its own. We keep no copy of meetings on our own storage; audio is held only while it is being processed. How long meetings are kept is decided by the organisation's Microsoft 365 retention settings, and the organisation's Microsoft administrators can reach those files as they can any file in its tenant.

Who can read a meeting. The person who recorded it, and colleagues they choose to share it with, read-only, until they stop sharing. An organisation's admins see usage and the activity log, not meetings. For a legal need an admin can ask to read one person's meetings: a second admin decides, access is read-only for 72 hours, and the person is told, with the reason. MSET staff have no access to meetings in the product; access to the infrastructure is restricted and audited.

Training. Recordings and transcripts are not used to train AI models, ours or our providers'.

Plaud. A person who imports from Plaud connects their own Plaud account. Plaud keeps recordings in the United States under its own terms; the organisation's admin can switch Plaud import off.

8. The providers we use

We use these providers, and only as far as needed. Where a provider acts for us, it does so under a data processing agreement.

Customers receive the current list of sub-processors with their data processing agreement, and notice before it changes. Timestamps on sealed documents come from an independent timestamp authority, which receives only a fingerprint of the file — no personal data.

We do not sell personal data, share it with data brokers or use it for advertising.

9. Transfers outside the EU/EEA

The MSET products store your data at rest in the EU, in Azure Sweden Central. That is not the same as saying no personal data ever leaves the EEA, and we do not claim it: Microsoft, Stripe, GitHub, Google, Formspree, AssemblyAI and Anthropic are US companies or have US parents, and limited transfers happen — for support, payment processing, hosting this website and the contact form. AssemblyAI processes MSET Transcribe's audio on its EU endpoint; Anthropic, only where it has been chosen, processes transcripts and trust-centre questions in the United States. Plaud, which a person may connect to MSET Transcribe themselves, keeps recordings in the United States.

Where data leaves the EEA, we rely on the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on the EU Standard Contractual Clauses, together with the further measures Chapter V of the GDPR requires. Ask us for a copy of the safeguards that apply.

10. How long we keep data

• Enquiries through the form or by email: up to 12 months after our last contact, unless they lead to an engagement.
• Consulting engagements: for the engagement, then as long as accounting law requires — seven years for invoices and accounting records — or as our data processing agreement with you says.
• MSET product accounts: while the account is open. When a subscription ends, its documents become read-only and are deleted within 90 days; billing records are kept for seven years. An unconfirmed sign-up is deleted after seven days.
• The record of which terms of service an organisation accepted (section 4): while the account is open and for ten years after it closes, the Swedish limitation period for claims under the agreement.
• Documents in MSET Sign: the retention period the organisation has chosen, shown in advance on each document. Drafts are deleted 30 days after they were created.
• The MSET Sign evidence record: three years after the document is deleted; for a 21 CFR Part 11 document, never less than five years from completion (section 5).
• The Part 11 audit trail of a 21 CFR Part 11 organisation: for as long as the organisation keeps its Part 11 records (section 4).
• MSET Trust: the access log as section 6 describes; granted requests and grants until the access ended longer ago than the log period; visitor sessions 12 hours, their records cleared 30 days after; an AI assistant's keys and tokens no longer than the access, cleared 30 days after; queued mail — the message is destroyed once delivered, the delivery record kept 30 days; change-notice subscriptions until you unsubscribe; console sessions 8 hours, their record 90 days after.
• MSET Transcribe: meetings in the organisation's own Microsoft 365, for as long as its retention settings keep them (section 7); the activity log while the organisation has a subscription and for 90 days after it ends, then deleted (a record that a file existed, without its content or name, is kept three years); usage counts while the organisation's account is open.
• The products' security logs: up to 30 days.
• Marketing lists: none — we do not operate any.

11. Your rights

You have the right to:

• get a copy of the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data erased, subject to legal retention duties, the evidence record in section 5 and a trust centre's access log during its period (section 6);
• have the processing restricted;
• receive your data in a structured, machine-readable format;
• object to processing based on our legitimate interest;
• withdraw any consent you have given, at any time.

To use any of these rights, email info@mset.se. We reply within 30 days, and a first request is free. If your request concerns data a customer controls (sections 5 to 7), we pass it to that customer and tell you we have done so.

You can complain to the Swedish data protection authority, Integritetsskyddsmyndigheten (IMY), or to the authority in the EU country where you live or work.

We make no decisions about you by automated means alone that have legal or similarly significant effects.

12. Security

Encryption in transit everywhere and at rest for our databases and documents; hashed passwords and encrypted two-factor secrets; separation between customers; access limited to what each person needs; and logs of privileged access. Our support staff cannot open a customer's documents unless the customer grants access, and every use of that access is recorded. Our approach follows ISO/IEC 27001 principles; we are not certified and do not claim to be.

If a breach puts personal data at risk, we notify IMY within 72 hours and tell the people affected without undue delay where the risk is high. Where we are a customer's processor, we tell the customer, who decides how to inform its own data subjects.

13. Cookies and browser storage

This website sets no cookies. It stores two small preferences in your browser — your language, and that you closed the privacy banner — which never leave your device. The MSET products set only strictly necessary session and preference cookies — to keep you signed in, or to remember your language in a console. All are HttpOnly and Secure, none is shared with anyone, and none needs consent. There are no analytics or advertising cookies anywhere.

14. Children

Our services are for business use. We do not knowingly process the data of children under 16. If you believe a child's data has reached us, contact us and we will delete it.

15. Changes to this notice

We update this notice when what we do changes. The date at the top shows the latest substantive change, and the log below records what changed. For material changes we email the administrators of product accounts in advance, and our active consulting clients.

Change log

• 6 November 2026 — version 2.7. The website's fonts are served from the site itself, so Google no longer receives your IP address when a page loads, and its visit statistics are cookie-free (GoatCounter; sections 2 and 8). A 21 CFR Part 11 audit trail names the people who act in it, and is kept with the organisation's Part 11 records (sections 4 and 10).
• 30 October 2026 — version 2.6. The record of which version of a product's terms of service your organisation accepted, and how (sections 4 and 10).
• 27 October 2026 — version 2.5. What we keep from an electronic ID, and that it is deleted with the signing record (section 5). How long a 21 CFR Part 11 evidence record is kept (section 10). MSET Transcribe's activity log is deleted 90 days after a subscription ends (section 10). Our data processing agreement, one for every MSET product, is published at mset.se/dpa.
• 23 October 2026 — version 2.4. A section for MSET Transcribe (section 7, the sections after it renumbered): meetings recorded and meetings attended, where meetings are kept, who can read them, training and Plaud. Its product page's contact form named under Formspree; Anthropic (optional), AssemblyAI, Plaud and Microsoft's part in MSET Transcribe named under providers and transfers; its retention added. MSET Trust's answers written by AI named in section 6 and under Microsoft and Anthropic.
• 22 October 2026 — version 2.3. The contact form on the MSET Trust product page is named: it too goes through Formspree.
• 22 October 2026 — version 2.2. The contact form on the MSET Sign product page is named: like the form here, it goes through Formspree.
• 21 October 2026 — version 2.1. MSET Trust in more detail: MSET's own trust centre, AI assistants, mail during access, retention of each kind of record, the access log and the right to erasure, and the products' cookies. Microsoft AB named as the contracting party.
• 20 October 2026 — version 2.0. One notice for MSET: the website, consulting and the MSET products. The controller is stated as Design & Animation i Vellinge AB, with the names MSET and Kifarkis Nätsäkerhet. New sections for product accounts, MSET Sign and MSET Trust; GitHub and Google Fonts named; the legal basis for enquiries changed from consent to pre-contract steps and legitimate interest.
• 21 April 2026 — version 1.0, covering the website and consulting.