Privacy Policy
This Privacy Policy explains how AInstein Apps ("we", "us", "our") collects, uses, shares, and protects personal data when you visit our websites or use our applications. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable Swedish data-protection law.
1Who we are (Data Controller)
The data controller responsible for your personal data is:
- Robert Vintervind, trading as AInstein Apps (sole trader)
- Ögärdsvägen 20, Viskafors, Sweden
- General enquiries: [email protected]
- Privacy & data requests: [email protected]
2What data we collect
Depending on how you interact with us, we may collect the following categories of personal data:
| Category | Examples |
|---|---|
| Account data | Name, email address, password (hashed), company name, chosen subscription tier |
| Billing data | Billing name and address, VAT number, transaction history. Card details are processed directly by Stripe and never stored on our servers. |
| Usage & content data | Content you submit to our tools (e.g. URLs to analyse, documents, invoices, projects), feature usage, and the AI-generated output produced for you |
| Technical data | IP address, browser type, device information, log data, and approximate location derived from IP |
| Communications | Support messages, emails, and any information you choose to share with us |
| Cookies & similar | Session and preference cookies; analytics identifiers where enabled (see Section 9) |
3How and why we use your data (legal bases)
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and managing your account; providing the services you request | Performance of a contract (Art. 6(1)(b)) |
| Processing payments and managing subscriptions | Performance of a contract (Art. 6(1)(b)) |
| Sending service, security, and transactional emails | Performance of a contract / legitimate interests (Art. 6(1)(b)/(f)) |
| Improving, securing, and maintaining our services | Legitimate interests (Art. 6(1)(f)) — our interest in keeping the service secure and improving quality using aggregated/pseudonymised usage data, which we have assessed is not overridden by your rights given the B2B nature of the service and your right to object |
| Marketing emails and newsletters | Consent (Art. 6(1)(a)) — withdrawable at any time |
| Meeting legal, accounting, and tax obligations | Legal obligation (Art. 6(1)(c)) |
4AI processing
Several of our applications use artificial-intelligence models to generate analysis, text, and recommendations. When you use an AI feature, your submitted content is sent to our AI model sub-processors (see Section 6) to produce your requested output. The legal basis for this is performance of your contract (Art. 6(1)(b)). We do not use your private content to train our own or any third-party foundation models, and we use these providers under their business/enterprise API terms, under which they are contractually prohibited from using your content to train their models. Providers may process limited data for security and abuse monitoring as described in their own terms. AI output may be inaccurate or incomplete and is provided for your review, not as a final automated decision (see Section 10a).
5How long we keep your data
- Account data: for as long as your account is active, and then deleted or anonymised within 90 days of account closure, unless a longer period is legally required.
- Content you submit to AI features & the resulting output: kept for as long as needed to provide the relevant feature and your account/project, and deleted or anonymised within 90 days of account closure.
- Billing & accounting records: retained for up to 7 years to meet Swedish bookkeeping law (Bokföringslagen).
- Support communications: up to 24 months.
- Technical logs & cookie/analytics data: typically up to 12 months.
6Who we share data with (sub-processors)
We share personal data only with service providers who help us operate, and only as necessary. Each is bound by a data-processing agreement. Our main categories of sub-processors are:
| Provider | Purpose |
|---|---|
| Stripe | Payment processing and subscription billing |
| Anthropic (Claude) | AI text and analysis generation |
| OpenAI | AI text and analysis generation (selected features) |
| Cloudflare | DNS, security, and content delivery |
| Our hosting infrastructure | Application and database hosting on dedicated servers within the EU/EEA |
We do not sell your personal data. We may disclose data where required by law or to protect our legal rights.
7International transfers
Our core infrastructure and email delivery are operated within the EU/EEA. Where a sub-processor (for example, an AI or payment provider) processes data outside the EEA, such transfers are protected by appropriate safeguards, including the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework.
8How we protect your data
We use technical and organisational measures appropriate to the risk, including encryption in transit (TLS), hashed passwords, access controls, and regular backups. No system is completely secure, but we work to protect your data and to notify you and the relevant authority of any qualifying personal-data breach without undue delay.
9Cookies
We use strictly necessary cookies that are essential to operate our services (for example, to keep you logged in). We use analytics cookies (such as Google Analytics) only after you give consent through our cookie banner; until you consent, non-essential cookies are not set and analytics do not run. You can give, refuse, or withdraw consent at any time via the cookie settings on our site. Consent given through browser settings alone is not relied upon as valid consent. Analytics cookies may transfer data to providers outside the EEA under the safeguards described in Section 7.
10Your rights under the GDPR
If your personal data is processed by us, you have the right to:
- Access the personal data we hold about you;
- Request correction of inaccurate or incomplete data;
- Request erasure ("right to be forgotten");
- Restrict or object to certain processing;
- Data portability (receive your data in a structured, machine-readable format);
- Withdraw consent at any time, where processing is based on consent;
- Lodge a complaint with a supervisory authority.
To exercise any of these rights, email [email protected]. We will respond within one month. You also have the right to complain to the Swedish supervisory authority, the Integritetsskyddsmyndigheten (IMY) — imy.se.
10aAutomated decision-making
We do not make decisions that produce legal or similarly significant effects concerning you based solely on automated processing within the meaning of Article 22 GDPR. Our AI features generate outputs from your inputs for you or your organisation to review and use; a human remains responsible for any consequential decision. If this changes, we will update this policy and tell you in advance.
11Children
Our services are intended for business users and are not directed at children under 16. We do not knowingly collect personal data from children.
12Changes to this policy
We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the latest version. Material changes will be communicated where appropriate.
13Contact
Questions about this policy or your data? Contact us at [email protected].