Privacy policy
This policy describes how we process personal data. It is a TEMPLATE awaiting legal approval before publication (B2) – but it already reflects how the system works: EU data, input wash before the LLM and deletion within 90 days.
1. Data controller
We are the data controller for the processing of personal data in the service. Contact for privacy questions is via /support.
2. What data we process and why
- Contact details (name, email, phone) – to create and administer account and agreement.
- Bookkeeping and case data you provide – to deliver the service (closing, controls, answers).
- Usage data (logins, logs with a trace ID) – for security and troubleshooting.
3. Legal basis
- Contract – to fulfil our agreement with you.
- Legitimate interest – for security, troubleshooting and improving the service.
- Legal obligation – where the law requires certain processing (e.g. the Bookkeeping Act).
4. Storage, EU and input wash
- All personal data is stored within the EU/EEA.
- Sensitive data (personal numbers, email, phone, account numbers) is washed/masked before the text leaves the system towards a language model – the wash happens before the call.
- Logs are washed automatically: no personal data or account numbers in the log stream.
- Retention: during the agreement plus the period the Bookkeeping Act requires; on termination data is deleted within 90 days at the latest (queued automatically).
5. Your rights
- Access to and correction of your data.
- Deletion ("right to be forgotten") – request via /support; queued automatically.
- Data portability and objection to certain processing.
- If you complain you can contact the Swedish Authority for Privacy Protection (IMY).
This is a template awaiting legal approval (B2). It describes how the system actually works today.