Privacy Policy

The data controller for Panoptik is Skarnlabs, a sole proprietorship (personligt ejet mindre virksomhed) registered in Denmark under CVR no. 35098178, owned by Bram Alexander Lyng Andersen, at Bådehavnsgade 55 H, 2450 København SV, Denmark.

For any request about your data, including access, correction, export or deletion, write to us through the contact form, or from Settings, Help & support when you are signed in. You also have the right to complain to Datatilsynet, the Danish Data Protection Agency.

When an organisation uses Panoptik, the organisation is the controller of what it puts in its workspace: its calendars, rooms, boards and the names on them. We process that on its behalf under our Data Processing Agreement, and a question about it is best sent to that organisation first. This policy covers the rest, which we control ourselves.

• Account: email address, password hash (argon2), the public key and name of each passkey you add (the private key never leaves your device), organization name, verification and session timestamps.
• Content: dashboards, widgets, backgrounds, and media assets you create or upload.
• Devices:device name, pairing state, last-seen timestamp, assigned dashboard, and the network the display is on (wired or Wi-Fi, the Wi-Fi network's name and its signal strength), shown only to your workspace.
• Support:the messages you and our staff exchange in Help & support, kept with your account and workspace and deleted with either. You can also delete a solved conversation yourself, which removes it for our staff too; the email copy of each message that went to our support inbox when it was sent is not removed by that.
• Billing:plan tier, subscription status, and an opaque Paddle customer ID. Card data never touches our servers — it's handled by Paddle (our Merchant of Record).
• Operational logs: request metadata and error traces, retained for up to 30 days to debug and defend the service.
• Usage: on this website and in the editor (never on a display or a share link), which page you opened (the kind of page, not its address), the site that sent you, the site a link took you to, how long the page was in view, your device type, browser and operating system family, and your country. Your country is looked up on our own server from your IP address using IP Geolocation by DB-IP; your address is not stored and is never sent to DB-IP. Visits are counted with an identifier made from a key that is replaced and deleted every day, so a visit cannot be linked to one on another day. No cookie or browser storage is used for it. Retained for up to 400 days.

• No telemetry or analytics from rendered dashboards. We don't know what's on your screen.
• No advertising identifiers or ad-network tracking. We don't sell data.
• No persistent storage of the third-party payloads your widgets proxy (calendars, photos, JSON feeds) beyond short caches required to deliver them.
• No speech service outside our own servers. When a calendar alert is set to read an event aloud, the event's title is turned into speech by software running on our own EU server, and the recording is kept there for at most 30 days so a display can play it.

We use a single encrypted session cookie (iron-session) to keep you signed in. No tracking cookies. No cross-site cookies. No third-party cookies are set by our application.

• Paddle: Merchant of Record for payment processing, subscription management, and EU VAT remittance.
• Lettermint and Brevo:one of the two at a time carries our transactional email (verification, password reset, billing receipts), workspace invitations, which carry the workspace's name to the address invited, and display alerts to the owners of a workspace, which name the displays that went offline, and support chat mail: your message to our support inbox, and our answer to you. When an account is created, it also carries a note to us naming the new account's address, and when a subscription is cancelled or a refund or chargeback is asked for, a note to us naming the workspace, its owners' addresses and the reason given.
• Hetzner: server and storage hosting inside the EU, in Helsinki, Finland.
• Scaleway: storage for our nightly backup archives, in Paris, France. An archive is a copy of the database, so it holds everything this policy describes.
• GlitchTip: error tracking, self-hosted on our own server in Denmark. Receives stack traces and request metadata when something fails.
• Cloudflare:the address our error reports are sent to is routed through Cloudflare's network, a United States company, so those reports pass through it on their way to GlitchTip.
• Microsoft 365:only if someone in your workspace adds your organisation’s own Microsoft Entra app to a meeting room widget. We then read your room list and the room calendars' times, titles, organiser names and privacy flags, with the permissions your administrator gave that app and can withdraw. Titles and organisers reach a display only where its tile is set to show them, never for a meeting marked private. Our server caches them for at most a minute, and a display keeps the last answer it showed so it can redraw after a restart. We store that app’s tenant ID, client ID and client secret with the widget; the secret is never sent to a display or a shared link. If the widget is set to allow booking, a display can also create, extend and end bookings in a room’s own calendar, and only extend or end the bookings it made. We hold no Microsoft password of any person.
• Google Workspace:only if someone in your workspace adds your organisation’s own Google service account to a meeting room widget. We then read your domain’s room resources and the room calendars, acting as the user your administrator named, with the same limits as Microsoft 365 above: titles and organisers only where a tile shows them, never for a private meeting, cached for at most a minute. We store the service account’s key and that user’s address with the widget; neither is sent to a display or a shared link. A booking made from a display is created in that user’s calendar with the room invited.
• A CalDAV server or a published calendar link: only if someone adds one to a meeting room widget. We read that one calendar, and with CalDAV we store the username and app password you typed; the link, username and password are never sent to a display or a shared link. A CalDAV room can be booked from a display; a published link is read only.
• Open-Meteo:weather and air quality for those widgets, and the city search when you pick a place. The browser showing the widget asks Open-Meteo directly, so it sees that browser's IP address and the place chosen; no account or other identifier is sent.
• UK Carbon Intensity API:grid carbon figures for the carbon widget set to the UK, asked for directly by the browser showing it, so it sees that browser's IP address and the region chosen.
• Anthropic or OpenAI:only if someone adds an AI brief widget with their own API key. Our server sends the prompt written in that widget to the provider chosen, under that key's account. We store the prompt and the key with the widget, and the answer only in the browser that shows it.

Each vendor receives only the minimum data needed to perform its function. The ones that process an organisation's workspace data for us are listed as sub-processors in our Data Processing Agreement.

Deleting your account removes your data from our systems. It does not reach back into theirs, so their retention is worth stating rather than leaving you to assume. Paddle keeps billing records for the period tax law requires, which is the same reason ours survive. Each of Lettermint and Brevo holds delivery logs for the messages it sent you. GlitchTip is self-hosted on our own server in Denmark and its records age out on the windows described above, so a deletion reaches it as those windows pass rather than at the moment you ask. Hetzner holds nothing of its own: it is the hardware everything above runs on, so its retention is ours, and a deletion is complete there once the backups written before it have aged out. Scaleway holds the backup archives themselves, so a deletion reaches it the same way, as the archives written before it age out. Cloudflare only relays error reports, and its retention is its own request logging, which we do not control. Microsoft 365 is your organisation’s own system: we only read from it, so it holds nothing from us, and deleting the widget or closing the workspace deletes the app details we stored. Google Workspace and a CalDAV server or a published calendar link are the same: each is your own system, holds nothing from us beyond any booking a display makes there, and deleting the widget deletes the details we stored. Open-Meteo and the UK Carbon Intensity API see a browser's address with each request, and their retention of it is their own request logging, which we do not control. Anthropic or OpenAI is your own account with that provider, so its retention is set by your agreement with them; deleting the widget deletes the prompt and key we stored.

Nobody at Panoptik can open a terminal on one of your displays unless an owner of your workspace allows it, for that one display, from All displays. Access lasts 15, 30 or 60 minutes, ends by itself, and an owner can end it at any moment. Every owner is emailed when it is allowed and when someone connects, and the display shows a notice for as long as someone is connected.

The connection runs through a relay we operate ourselves, in the same EU datacentre as the rest of the service, and staff must sign in with a passkey to open it. On the display it runs as a separate user that holds none of the display's credentials and cannot reach other devices on your local network. We record which staff member connected, when, and everything they typed, and keep that record for 90 days.

We keep your data for as long as your account is active. When you delete your account, your content is removed from live systems immediately. Backup archives are retained for up to 30 days and are transferred over an encrypted connection, so a deletion becomes final in them once the archives written before it have aged out of that window. Billing records are retained for the period required by tax law (typically five to ten years, depending on jurisdiction). Usage records are kept for up to 400 days. They carry no account and no address, and their visitor identifier cannot be recomputed once its day has passed, so they are not tied to your account and are not part of an account deletion. Records of support sessions on your displays are kept for 90 days, and go before then if the workspace is closed. A note of each cancellation, refund and chargeback, with the reason given, is kept for 400 days so we can answer questions about it, and goes before then if the workspace is closed.

If you're in the EU, UK, or another jurisdiction with similar laws, you have the right to:

• Access the personal data we hold about you.
• Export your data in a portable format.
• Correct inaccurate data.
• Delete your account and associated data.
• Object to or restrict certain processing.
• Lodge a complaint with your local data protection authority.

Use the contact form to exercise any of these rights. We'll respond within 30 days.

Passwords are hashed with argon2id. A passkey is checked against its public key, and changing or resetting your password removes every passkey added before it. Sessions ride in encrypted, signed cookies. All traffic is served over TLS, and backups are transferred over an encrypted connection. Our servers sit in EU datacentres with physical access controls; the disk volumes themselves are not separately encrypted at rest. Access is least-privilege: production is reachable by a small number of people, and each of them by name.

No system is perfectly secure. If you believe you've found a vulnerability, please use the contact form with subject “Security vulnerability”.

Panoptik is not directed at children under 13, and we don't knowingly collect data from them. If you believe a child has created an account, contact us and we'll remove it.

We'll update this policy as the service evolves. Material changes will be announced by email or in-app notice before taking effect.

Privacy questions? Contact us.