Privacy policy
Last updated 30 October 2026
Who is responsible
The data controller for the personal data described here is:
- Registered name
- Mathijs AB
- Trading as
- NowNextLater
- Company number
- 559562-3058
- VAT number
- SE559562305801
- Registered address
- Warvinges Väg 7, LGH 1502, 112 18 Stockholm
- Country
- Sweden
- support@nownextlater.eu
- Phone
- See Contact us
For any question about this policy, or to exercise any of the rights below, write to support@nownextlater.eu.
What we collect
What you give us to make an account
- Your name and email address.
- A password, if you set one. It is stored only as a bcrypt hash and cannot be read back by us or by anybody who obtains a copy of the database.
You can also sign in with an emailed link instead of a password, in which case we never hold a password for you at all.
What you put into the product
Your tasks, projects, folders, sections, saved views, notes and the settings you choose. We treat this as yours. It is not read by us in the ordinary course of running the service, it is never used to train anything, and it is never sold or shared with a third party for their own purposes.
Our administration tools are deliberately built so that no task content can be read through them — no title, description, tag or note. Names of users, projects and folders are visible to an administrator, which is why that access requires two separate credentials held by two different parties.
What the service records by itself
- When you were last active, to the nearest hour. This is one timestamp per account, not a history of what you did.
- When an account was created, changed plan, deactivated or deleted, and who did it. This log never contains task content, passwords or credentials.
- Ordinary server logs, including IP addresses, kept for security and debugging.
If you pay us
We record the amount, the currency, the VAT applied, the country you gave as your billing country, the country your card was issued in where the payment method reports one, and a country derived from your IP address at the moment of the sale. We keep these because tax law requires us to be able to show why a sale was taxed the way it was.
Every payment gets an invoice, which we email to you and keep. It states the name on your account at the time of the payment, your billing country, what you bought and what it cost. It is a billing record, so it is kept as long as those are.
We do not receive or store your card number, your IBAN, or your name and address as held by your bank. Those go directly to Mollie, our payment provider, and never reach our servers.
Cookies and tracking
This marketing site sets no cookies and runs no analytics, no advertising pixels and no third-party trackers. The only thing it stores in your browser is whether you chose the light or dark theme.
It also makes no third-party requests at all. Fonts are served from this site rather than from a font CDN, so loading a page here does not hand your IP address to anyone but us. That is why you are not being asked to accept anything.
The application itself stores your session token and a few display preferences in your browser. These are necessary to keep you signed in and to remember how you like your lists laid out; they are not used to track you and they are not shared.
Why we are allowed to hold it
- To provide the service you asked for. Your account, your content and your settings. Without these there is no product.
- Because the law requires it. Billing and VAT records, which we must keep for seven years under Swedish accounting law and retain for up to ten.
- Because we have a legitimate interest. Keeping the service secure and working, and understanding in aggregate whether people find it useful.
Who else processes it
We use a small number of providers, each of which processes data only on our instructions:
- Scaleway (France) — hosting for the application and the marketing site, the database your account and your tasks are stored in, and delivery of the emails we send you. The application and the database run in Scaleway's Amsterdam data centre (the Netherlands); email is sent from its Paris region (France).
- Mollie (Netherlands) — payment processing. They act as their own controller for the payment data you give them directly.
All of these are in the European Union or the European Economic Area, so your data is not transferred outside it. If that ever changes we will say so here before it happens.
How long we keep it
- Your account and content — until you ask us to delete it.
- After you ask to be deleted — your account is switched off immediately, which ends every session and every API token. It is then permanently erased after a thirty-day grace period. The wait exists so that a mistake, or somebody else acting on your account, can still be undone; a month of nobody needing the account is better evidence than a confirmation dialog.
- Billing and tax records — up to ten years, because we are required to keep them. These include your invoices, which name you. They survive the deletion of your account and contain no task content.
- The administrative log — retained, because it is the record of what was done to accounts and by whom. It never contains task content.
What happens to shared work when you leave
If you delete your account, we remove your content and the contents of projects you owned. We do not touch anybody else's: a collaborator keeps their own projects, their own tasks and their other members, your membership of their project is revoked rather than their project deleted, and a task assigned to you is unassigned rather than removed.
Your rights
Under the GDPR you can ask us to:
- give you a copy of the personal data we hold about you — your account and everything you made in it you can download yourself, as one file, from Settings → Account;
- correct anything that is wrong — your name and email you can change yourself;
- delete your account and its content, which you can start yourself from Settings;
- restrict or object to a particular use;
- provide your data in a portable form — that same file is plain JSON, which another service can read.
Write to support@nownextlater.eu and we will respond within one month. If you think we have got it wrong, you can complain to the Swedish authority for privacy protection (Integritetsskyddsmyndigheten, imy.se), or to the equivalent authority where you live.
Security
Passwords are hashed and never stored in a readable form. Every link and token we email you is stored only as a hash, expires, and can be used once. All traffic is encrypted in transit. Access to production data is limited to the people who need it, and reading another account's settings through our administration tools is itself recorded.
No system is perfect. If we discover a breach affecting your personal data we will tell the supervisory authority within 72 hours and tell you without undue delay where the risk to you is high.
Children
The service is not intended for children under 16 and we do not knowingly collect their data.
Changes
If we change this policy we will update the date at the top. If a change materially affects how we use data you have already given us, we will tell you by email before it takes effect.