Privacy Policy
Stan Privacy Policy
Last updated: 20 September 2026
Stan Solutions ApS ("Stan", "we", "us") makes a small device that sits on your desk and mirrors how much you move. This Microsoft Teams application is a companion to that device: it is how you talk to Stan, see how your day is going, and change your settings.
The device does the measuring. The Teams application does the talking. This policy explains what the Teams application uses and who sees it.
Who is responsible for your data
Your employer is the data controller for your standing data — the measurements your Stan device makes — as well as your settings and your identity in Stan. They decide that Stan is used, which desks it covers, and on what terms. Stan Solutions ApS is the data processor: we handle that information on your employer's instructions and under a written agreement with them, and we do not use it for our own purposes.
Where we act as controller instead is limited and separate: visitors to our website, people who contact us directly, and our own customer and billing records.
What the Teams application uses about you
Almost nothing, and nothing that describes you as a person:
Your Microsoft user identifier and your organisation's identifier. These are the identifiers Microsoft puts in the sign-in token. They are how we know which Stan is yours and keep your settings attached to you.
What Teams needs in order for Stan to message you — the conversation identifier and the Teams service address. Without these Stan cannot send you the morning flex-seating question or tell you when someone takes your desk.
Your settings — your standing target, the desk you are linked to, and whether flex seating is on.
That is the whole list. The Teams application does not ask Microsoft for your name, your email address, your photograph or any other profile information. It requests no Microsoft Graph permissions, so it cannot read your mail, your calendar, your files, your contacts, or any Teams conversation other than your conversation with Stan.
Note that your Microsoft user identifier still counts as personal data under the GDPR, because it refers to you. We treat it as such. We simply do not hold anything alongside it that would tell a reader who you are.
What you type
Messages to Stan. To understand what you are asking, Stan sends the text of your message to Azure OpenAI, operated by Microsoft in Sweden, together with a short extract of your recent standing figures where the question needs them. It is not sent anywhere else. Stan does not store your conversation: it keeps at most the last ten messages in memory so it can follow a thread, and that memory is discarded when the service restarts.
Microsoft operates automated abuse monitoring on the service. Content its classifiers flag may be retained by Microsoft for up to 30 days within the same region and may be reviewed by authorised Microsoft personnel for that purpose. It is not accessible to other customers and is not used to train any model.
Messages to the Stan team. If you report a problem or ask for a feature, we store what you wrote and the device you are connected to, if that applies. We do not ask for your email address or any other contact detail; we reply through your organisation.
Who processes data on our behalf
We use the following sub-processors. All processing takes place in the European Union.
Microsoft — application hosting (Azure App Service) — Denmark
Microsoft — message understanding (Azure OpenAI) — Sweden
Supabase — database — Germany
InfluxData — standing and presence measurements — Netherlands (Azure West Europe)
Who else sees your data
Your employer's designated administrators can see the business units they have configured to organize the Stan devices in your organization and Stan devices in your organisation.
We do not sell your data. We do not use it for advertising. We do not use your messages to train models.
How long we keep it
We keep your standing data, your settings and the identifiers needed to message you for as long as your organisation's agreement with us is active, and we delete them on your organisation's instruction or when that agreement ends.
Because your employer is the controller, they set the retention period — it is part of their agreement with us, and their own privacy notice is where you will find the specific period that applies to you.
Your conversation with Stan is not kept at all beyond the last ten messages held in memory, which are discarded when the service restarts. The conversation is kept by the Teams Application itself, and not the Stan App.
Your rights
Under the GDPR you may request access to your personal data, correction, erasure, restriction of processing, and portability, and you may object to processing.
Because your employer is the controller of your data, direct those requests to them — they decide, and we act on their instruction. You are welcome to contact us at support@stan.today and we will pass the request on and help your employer answer it.
Contact
Stan Solutions ApS
Istedgade 23, 4. tv, 1650 København V, Denmark
CVR 44546310
support@stan.today