Privacy Policy

1. Who is responsible for your data

Swedish Embedded AB is the controller of the personal data described here. Our full company details are on the company details page.

This policy covers sven.swedishembedded.com, with the sven app and its API, and agentsven.com, the site the sven agent is downloaded from.

For anything in this policy -- including a request to see, correct or erase your data -- write to info@swedishembedded.com.

We have not appointed a data protection officer. If that changes, this section will name them.

Company details

2. What we process, why, and on what legal basis

Each purpose below has its own legal basis. We do not rely on one blanket basis for everything.

Your account and your organisation

Name, email address, and which organisations you belong to. Processed to give you an account and to run the service you asked for. Basis: performance of a contract with you.

Buying credit

Purchase amounts, invoices, billing address, VAT number, and the payment method reference. Processed to take payment, issue the invoice and keep the accounts. Basis: performance of a contract, and a legal obligation for the accounting records.

Your consent when you buy

Which version of these documents you accepted, that you asked for compute to start straight away, that you acknowledged what that costs, the time, the network block your request came from, and the browser you used. Processed so that both sides can prove what was agreed. Basis: a legal obligation to confirm the agreement on a durable medium, and our legitimate interest in being able to evidence it.

What you send to the models

The messages and inputs you send, and what the models answer. Processed only to answer you, by us and by the provider that runs the model you chose. By default your account uses only models whose provider keeps nothing once it has answered; an administrator of your account can also allow models whose provider may keep inputs under its own terms. Conversations are stored so you can return to them. Requests to the API are not stored, except that an answer is kept for 1 day so a retried request can be answered without a second charge. We do not use any of it to train models. Basis: performance of a contract.

Searching the web

When sven searches the web for a task, the search terms go to our search provider, without your name or account. Basis: performance of a contract.

Visiting agentsven.com

That site sets no cookies and loads nothing from other sites. Its server records each request -- network address, page, browser and time -- in logs kept for 30 days. Basis: our legitimate interest in keeping the site available and secure.

Checks we are required to make

Where the law requires us to verify who a customer is, or to check them against sanctions lists, we process the identity data needed for that. Basis: a legal obligation. Refusing to supply it means we cannot open or keep your account.

Running and securing the service

Sign-in events, network addresses, error and security logs. Basis: our legitimate interest in keeping the service available and in preventing fraud and abuse, balanced against your interest in not being monitored beyond that.

Support

Whatever you send us when you ask for help. Basis: performance of a contract, and our legitimate interest in answering you.

Optional cookies

Analytics and marketing cookies, if you agree to them. Basis: your consent, which you can withdraw at any time and as easily as you gave it.

Cookie policy

3. Who else sees your data

We do not sell personal data, and we do not share it for anybody else's marketing. The organisations below process data on our behalf, or alongside us, because the service cannot work without them:

Stripe Payments Europe, Limited (Ireland), and Stripe, Inc. (United States)

Payments, invoicing and refunds. Stripe processes payment data on our instructions, and separately acts as a controller in its own right for fraud prevention and for its own legal and regulatory duties -- including automated fraud scoring of a payment. Card details are entered on Stripe's own pages and never reach sven.

Clerk, Inc. (United States)

Accounts, sign-in and organisation membership. Holds your name, your email address and your sign-in activity.

Mailgun Technologies, Inc. (United States)

Sending the service emails you receive from us -- purchase confirmations, and balance reminders.

Model providers

The companies that run the models we do not run ourselves. They receive what you send to one of their models and return its answer. By default they keep nothing afterwards; models whose provider may keep data are used only if an administrator of your account allows them. Some are established outside the EU.

Brave Software, Inc. (United States)

Web searches sven makes while it works. Receives the search terms, not who asked.

Amazon Web Services

Runs the servers this site, agentsven.com and the database are on, in Stockholm, Sweden.

Authorities, when we must

Tax authorities, and law enforcement or supervisory authorities where we are legally required to answer them.

4. Data that leaves the EU

Some of the organisations above, including some model providers, are established outside the EU, mostly in the United States, so some of your data is transferred there.

For those transfers we rely on the European Commission's EU-US Data Privacy Framework adequacy decision where the recipient is certified under it, and on the European Commission's Standard Contractual Clauses as an independent backstop in every case. We rely on both rather than on the adequacy decision alone, because that decision is under legal challenge and we do not want a transfer to become unlawful the day it is decided.

You can ask us for a copy of the safeguards that apply to a specific transfer by writing to info@swedishembedded.com.

5. How long we keep it

Different rules demand different periods for the same account, and they genuinely disagree: data protection law says keep as little as possible for as short as possible, Swedish bookkeeping law requires accounting material to be kept for seven years, and the anti-money-laundering rules require five years from the end of a business relationship. The schedule below is how we reconcile them.

Where two periods apply to the same record, the longest period that a law actually requires wins for that record -- and only for that record. Everything else in the same account is erased on its own shorter schedule rather than being kept alive by association. If you ask us to erase your data we do so, except for the records a statute requires us to keep, and we tell you which ones those were.

Account, organisation and membership records

While the account exists, then 12 months after it is closed.

Invoices, purchases, refunds and other accounting material

7 years from the end of the calendar year the record belongs to, as Swedish bookkeeping law requires. This period overrides an erasure request.

Purchase-consent records

7 years, matching the invoice they evidence -- the invoice on its own does not show what was agreed. The network block and browser stored alongside are deleted after 3 years, which is as long as they could be useful for a dispute.

Identity checks we are required to make

5 years from the end of the business relationship, as the anti-money-laundering rules require, and longer only where an authority tells us to keep them.

Playground conversations

While the account exists. Archiving a conversation hides it from the list; it does not delete it.

Answers kept for retried API requests

1 day, then deleted.

Usage history

While the account exists. The part of it that supports an invoice is kept for the 7 years above.

Security and error logs

90 days, then deleted.

Support correspondence

3 years from the last message in the conversation.

Your cookie choices

365 days, after which we ask again.

6. Your rights

You can ask us to give you a copy of your data, correct it, erase it, restrict what we do with it, or hand it to another provider in a portable form. You can object to processing we base on a legitimate interest, and we will stop unless we have compelling grounds that override your objection.

Where we rely on your consent -- optional cookies, and marketing -- you can withdraw it at any time, and withdrawing it is exactly as easy as giving it was. Withdrawing consent does not make what we did before it unlawful.

To use any of these, write to info@swedishembedded.com. We answer within one month.

If you think we have got this wrong you can complain to the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY), at imy.se, or to the authority in the EU country you live or work in. You can complain to them without asking us first.

Change your cookie choices

7. Automated decisions

Our payment processor scores payments automatically for fraud, and a payment it scores badly can be declined. That is the only automated decision in the service that can have a real effect on you. If a payment of yours is declined that way, write to us and a person will look at it.

We do not profile you for advertising, and we do not make automated decisions about who may use the service.

8. Data we did not get from you

If somebody invites you into their organisation, we receive your email address from them in order to send the invitation. If you accept, this policy applies from that point. If you do not, we delete the invitation and the address with it.

Our payment processor also tells us the result of its own checks on a payment. We do not receive the underlying card data.

9. Changes to this policy

When this policy changes we publish the new version with a new version date. Where a change materially affects you, we tell you before it takes effect.