Privacy policy

Last updated 27 October 2026

This policy explains how Shanova AB (we) handles personal data in connection with NIVO and the site inivo.se.

Who we are

Company: Shanova AB
Organisation number: 559193-0069
Email: info@shanova.se

Two roles

We are the controller for the data of the people we deal with ourselves: visitors to our site, the users of a workshop's NIVO account (as account holders), and the contact people at our customers.
We are a processor for the data a workshop puts into NIVO about its own customers and staff: names, phone numbers, email addresses, cars, jobs, photos, messages and invoices. The workshop is the controller of that data and decides how it is used; our processing follows the Data processing agreement. If you are a workshop's customer, please turn to the workshop with questions about your data. We will help the workshop answer.

What we process as controller, and why

Account data (name, email address, phone number, language, role, sign-in history), to provide the service under the agreement with the workshop (legitimate interest in giving the workshop's users their accounts, and the agreement itself).
Customer and invoicing data for the workshops that buy NIVO (contact people, invoicing details), to enter into and perform the agreement and to meet our bookkeeping obligations (contract and legal obligation).
My NIVO accounts (the email or mobile number you sign in with, your language, and the phones you turned notifications on for), so that you can see your cars and workshops in one place and be told when a workshop writes (the agreement with you, which you enter by signing in). Your account finds your customer records at each workshop by that email or number; each workshop's data stays its own.
Support and contact (what you write to us), to answer you (legitimate interest).
Technical logs (IP address, time, the page or function used, errors), to keep the service secure and working and to find faults (legitimate interest). Logs are kept for a limited time, normally no longer than 90 days.
Visitors to the site: we use no analytics and no advertising cookies. The site stores only what it needs to work; see Cookies.

A car's history, shared only when you ask

In My NIVO you can ask that what one workshop did on your car is shown to another workshop where you are also a customer. Nothing is shared until the workshop that holds the history approves, and then only dates, work and parts: never prices, invoices, messages or who you are. You or the workshop can stop it at any time, and it stops by itself if the car is no longer yours there. Each request, approval and withdrawal is recorded.

How long we keep it

Account data: while the account exists, and deleted within 90 days after the workshop's agreement ends.
My NIVO accounts: while you use them; ask us at info@shanova.se to delete yours at any time.
Accounting records: seven years, as the Swedish Bookkeeping Act requires.
Support conversations: as long as the agreement lasts, then up to 12 months.
Backups rotate and disappear within 14 days.

Who receives it

We use suppliers to run NIVO. They process data only on our instructions, under agreements that protect it. The cloud, messaging and AI providers we use are listed under Subprocessors. We use Microsoft 365 for our own email. We never sell personal data.

Outside the EU and EEA

NIVO is hosted in Stockholm, and AI runs within the EU. Some providers of email and messaging are part of US groups (Twilio). Where data may reach a country outside the EU/EEA, the transfer is covered by the EU Commission's standard contractual clauses or by the provider's certification under the EU-US Data Privacy Framework.

Your rights

You may ask for access to your data, correction, erasure, restriction of processing, data portability, and object to processing based on legitimate interest. Write to info@shanova.se. We answer within one month. If you believe we handle your data wrongly, you may complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se).

Security

We protect data with encryption in transit and at rest, strict separation between workshops, and limited access. See Security.

Changes

We update this policy when our processing changes. The date at the top shows the latest version.