How Value Cards handles your data

Last updated 11 October 2026

Value Cards asks people to say something personal, so this policy says in plain words what is collected, who can see it, where it is kept and for how long, and what you can ask of us. If anything here is unclear, write to valuecards@viktorcessan.com and you get an answer from a person.

1. Who is responsible

Value Cards is run by Cessan Lean and Agile Coaching AB, org. no. 559103-8699, Ribbylundsvägen 3, 137 41 Västerhaninge, Sweden, referred to as "we" below. You reach us at valuecards@viktorcessan.com.

Our role depends on how you use Value Cards.

When a team maps its values, the organisation that bought the team mapping is the controller of the team's data, and we are its processor. We handle the data on the organisation's instructions, under the data processing agreement in our terms.
When a coach, therapist or practitioner invites clients on the Practitioner plan, the practitioner is the controller of the clients' data, and we are the processor.
When you map your own values on your own, with or without the personal analysis, we are the controller of your data.
For account data, payments, invoices and the contact form, we are the controller.

2. What we collect

We collect only what the exercise and the service need.

Your name, as you want the team to see it, and your email address, which is used for your sign-in link, your invitation and the reminders.
Your role in the team, if the organiser or you add one.
How you sorted the cards, the five cards you chose, and the words you wrote about them.
Your answers about your teammates, which are your guesses about their cards, how working together with each of them feels, and any friction you describe.
The language you chose, when you locked in, and whether you gave consent to share any sensitive cards.
For buyers, the billing details that Stripe needs for the payment and the invoice. We never see or store your card number.
Technical logs of requests to the service, with the address they came from, which we keep for security and to find faults.

3. Cards about beliefs

Three of the 55 cards, Religion, Faith and Spirituality, can reveal a religious or philosophical belief, which the GDPR treats as a special category of personal data. These cards are private by default. They are never shown to the team, the manager or the practitioner unless you choose to show them, and you make that choice yourself at lock-in by giving explicit consent. You can withdraw that consent at any time before the map is revealed, and afterwards by deleting your mapping.

4. Who sees what

Nobody sees anyone else's cards before the map is revealed, the manager included. The reveal happens when the workshop starts, or when everyone has locked in if the team chose that. Until then the organiser sees only who has locked in.

When the map is revealed, the team sees each person's five cards, what they wrote about them, the value they said they compromise on, how they sorted the other cards, and where that places them between six pairs of opposites.
Any card can be kept out of the team map before lock-in, and Religion, Faith and Spirituality are kept out unless the person chooses to show them.
Guesses are shown only as totals. Nobody sees who guessed what about whom.
How working together feels is shown as one combined answer per pair, or only as patterns if the team chose that, so nobody sees exactly what one person said.
A friction someone describes carries their name and is visible to the whole team, only to the person it is about, or only to the person who wrote it, as that person chose.
The manager sees the same map as everyone else, at the same moment, and nothing more.
A practitioner sees a client's map when the client locks in, and nobody else does.
Value Cards is never used to select, rank or rate people, and nothing in it produces a score or a type for a person.

5. Why we process the data, and on what basis

To run the exercise and show the team map, which is the service you or your organisation asked for. For a team or a practitioner's clients, the organisation or practitioner decides the basis, usually its legitimate interest in team development or the person's consent. Taking part is always the person's own choice.
To draft the written summary for the manager, which is part of the team mapping and can be switched off by the team.
To create your account, send your sign-in links and reminders, and take payment, which is needed to perform our agreement with you.
To keep the service secure, find faults and keep accounts for seven years, which is our legitimate interest and our legal obligation under Swedish bookkeeping law.
To show sensitive cards to the team, only with your explicit consent.

6. Subprocessors

We use a small number of other companies to run the service. Each one receives only what it needs for its task.

Who	What for	What they receive	Where
one.com	Hosting of the service and the database	Everything stored in the service, encrypted	The EU
Stripe	Payments, VAT and invoices	The buyer's name, email, billing details and the purchase	The EU and the United States, under Stripe's standard contractual clauses
An email service with an EU region	Sending sign-in links, invitations and reminders	Your name, email address and the content of the email	The EU
Anthropic	Drafting the written summary of a team mapping	Only when the organizer has switched the summary on and acknowledged what is sent: the card combinations and the computed patterns, with people as codes such as PERSON_1 and Never names, email addresses, roles, locations or the company’s name, and what people wrote only if the organizer allows it	The United States, under Anthropic's standard contractual clauses, and the data is not used to train models

We will name the email service here before the service is launched. If we add or change a subprocessor, we update this page and tell business customers in advance as the data processing agreement says.

7. How long we keep data

A team's data is deleted twelve months after the workshop, unless the organiser chooses to keep it for a later mapping.
A personal mapping is kept as long as your account exists, so you can compare mappings over time.
An account and everything in it is deleted 30 days after you ask us to delete it, which gives you time to change your mind.
Invoices and the records bookkeeping law requires are kept for seven years.
Technical logs are kept for 90 days.
Backups are kept for 30 days and are then overwritten, so a deletion reaches the backups within that time.

8. Your rights

You can see, download and delete your own mapping and your account from your profile at any time, without asking anyone. When you delete a mapping it disappears from the team map as well, and nobody can bring it back, Value Cards included.

You also have the right to ask us for a copy of your data, to correct it, to restrict or object to how we use it, and to move it elsewhere. Write to valuecards@viktorcessan.com and we answer within a month. If we are the processor for your organisation, we may pass your request to your organisation, which is responsible for answering it, and we help it do so.

If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten, or to the data protection authority in your own country.

9. How we protect the data

Names, email addresses, sorts and everything people write are encrypted in the database, with the key kept outside the code. Everything travels over HTTPS. Sign-in links and invitation links are stored as hashes, and expire. Access to the servers is limited to the people who run the service, with keys rather than passwords.

10. Cookies

Value Cards uses Google Analytics to track how the site is used, so that its usability can be improved. Value Cards saves no behavioural tracking cookies of its own.

The only thing Value Cards itself keeps is whether you are signed in, while you are mapping your cards. Your language choice is remembered in your browser.

11. Children

Value Cards is made for workplaces and adults, and we do not knowingly collect data about anyone under 16.

12. Changes to this policy

When this policy changes, the date at the top changes with it, and if the change matters to you we tell you by email or in the app before it takes effect.

13. Contact

Cessan Lean and Agile Coaching AB, org. no. 559103-8699, Ribbylundsvägen 3, 137 41 Västerhaninge, Sweden. Email valuecards@viktorcessan.com.