This policy explains what personal data we handle when you use CashPulse (cashpulse.tiater.se) or MarginBridge (marginbridge.tiater.se), why we handle it, where it is stored, and how long we keep it.
It does not cover any other service. Tiater AB operates other applications that are not open to external users and are not described here.
Tiater AB is the data controller for the services described in this policy.
| Company | Tiater AB |
|---|---|
| Registration number | 559033-7639 |
| Registered address | Viborgsslingan 22, 224 72 Lund, Sweden |
| Contact | teriksson.home@gmail.com |
Write to that address for any question about this policy, or to exercise any of the rights described below.
To give you access we store a username, a display name, an email address where one is provided, your access level, and — in CashPulse — which company workspace your account belongs to. Passwords are stored only as a bcrypt hash; we cannot read your password and cannot tell you what it is.
If you sign in with Google, we request basic profile information — your email address, name and profile picture. We store only your email address, and use it solely to recognise you; the rest is discarded. We never gain access to your Google data: no Drive, no Gmail, no contacts, no calendar.
CashPulse holds the financial information you upload or enter. In practice this is exported profit-and-loss and balance-sheet reports from your accounting system, together with the forecast assumptions you build on top of them.
Some of that content can identify people. The personnel and consultant sections are free-text fields intended for roles, salaries, employment dates and fees, and nothing stops you entering a person's name alongside their salary. We do not require you to, and we recommend using role titles rather than names where that works for you. Whatever you enter, you decide — we do not inspect it.
CashPulse keeps an internal change history so you can see what was edited and when. That history stores previous values, so removing an entry from a table does not remove it from the change history.
MarginBridge works differently. The file you upload is held in memory for your session and is not written to a database. Closing the session discards it.
When a sign-in fails we record the username tried and the network address it came from, so that repeated attempts can be slowed down. A record stops counting fifteen minutes after the attempt, and is erased from the file the next time that application writes to it — which happens on the next failed or successful sign-in. On a quiet system a spent record can therefore sit in the file for longer than fifteen minutes before it is physically removed.
In CashPulse we also keep an administrative log of changes to accounts — an account being created or removed, a change to the workspace it can open or to its access level, and a password being reset by us or changed by its holder. Each entry records when the change was made and who made it; passwords themselves are never recorded. This exists so that questions about who had access to what, and when, can be answered.
No analytics, no tracking, no advertising identifiers, no profiling. We use a small number of strictly necessary cookies — for keeping you signed in and for security — and none for tracking or advertising. No analytics service, and no artificial intelligence service, is involved in any of our applications.
Your financial figures and personal data are never sent anywhere outside the service. MarginBridge does retrieve published reference data from two public sources: official exchange rates from Sveriges Riksbank, and consumer and producer price index figures from Statistics Sweden (SCB). Nothing you upload is sent to either. The request to Sveriges Riksbank does identify which currency and which date range is being looked up, so that request reveals which currencies and periods you are analysing — not the amounts, the customers, or any other content. The request to Statistics Sweden contains no information derived from your data at all. CashPulse makes no external requests of any kind.
| Account and sign-in data | To provide the service you have asked for — performance of a contract |
|---|---|
| The content you enter | To provide the service — performance of a contract |
| Failed sign-in records | To protect accounts against password guessing — legitimate interest |
| Administrative log | To keep an auditable record of who had access to what, and of changes to accounts — legitimate interest |
Where you enter another person's details — an employee's salary, for example — you are the controller of that information and we process it on your behalf. If you need a written data processing agreement, ask and we will provide one.
The services run on a virtual server provided by OVH GmbH in Germany. Your data is stored on that server, inside the European Union.
Backups are copied off that server so they survive a hardware failure. Those copies are held by Spec-Imaging AB (registration number 559259-0169) acting as our processor, using Microsoft 365. Microsoft acts as a further processor in that arrangement.
Microsoft's own deletion timers — recycle bin and file version history — apply to those backup copies in addition to our retention periods, and are set within that Microsoft 365 subscription rather than by us. That period is currently 93 days.
Google processes your email address when you choose to sign in with Google, under Google's own terms.
We do not sell your data, share it for marketing, or disclose it to anyone else except where the law requires it.
| Your account and its contents | For as long as your account is open |
|---|---|
| After your account is closed | The live data is deleted when the account is closed. Backup copies containing it are removed by rotation within 60 days. |
| Failed sign-in records | 15 minutes after the last failed attempt |
| Administrative log of account changes | 12 months |
Deletion of the live data is carried out by us, not automatically by the software, so it begins when we act on a closure or a deletion request rather than on a timer. We will confirm to you when it has been done.
Under the General Data Protection Regulation you may ask us to:
Write to teriksson.home@gmail.com. We will respond within one month.
You can export your own data from CashPulse at any time without asking us, using the export function in the application.
If you are not satisfied with how we have handled your data, you may complain to Integritetsskyddsmyndigheten (IMY), the Swedish data protection authority, at imy.se.
Access requires a password or a Google sign-in. Passwords are stored as bcrypt hashes. Repeated failed sign-ins are slowed automatically. In CashPulse each company's data is held in a separate database and the application refuses to serve data when it cannot establish which workspace a session belongs to. All traffic is encrypted in transit.
No system is perfectly secure. If a breach affects your personal data we will tell you and the supervisory authority as the law requires.
The date at the top of this page shows when this policy was last changed. If a change materially affects how we handle your data, we will contact account holders directly about it.