Privacy policy
This page describes which personal data Kalvsvik Labs processes, why we do it, how long we keep it and what rights you have. It covers the website, the app and the network.
Last updated 21 October 2026
1Who we are
Kalvsvik Labs AB, Swedish company registration number 559567-6239, is the data controller for the processing described here, except where we say explicitly that we act as a processor for a customer.
Address Stockholm, Sweden. Questions about personal data go to kontakt@kalvsviklabs.com. Security matters go to sakerhet@kalvsviklabs.com and support to support@kalvsviklabs.com.
We follow the EU General Data Protection Regulation (GDPR) and the Swedish Data Protection Act (2018:218).
2When we are the controller and when we are a processor
What decides it is whose data it is and who decides what happens to it.
You as the customer are the data controller for everything in your account in the app. That is the tender packages, contracts and bills of quantities you upload, the names of clients and subcontractors in them, and what your users write. We process that data only on your instructions in the app, as a data processor, and a data processing agreement is part of the customer agreement.
Kalvsvik Labs is the data controller for the data about you as a customer (who has an account, licences and invoicing details), for visitors to the website, for anyone who books a demo, subscribes to the newsletter or writes in the help box, for subcontractors in Kalvsvik Network, for contact persons in public procurement notices, and for anyone who applies for a job with us.
3Which data we process
We do not collect more than we need in each situation. These are the situations and the data.
| Situation | Data | Source |
|---|---|---|
| Visitors to the website | Server logs with IP address, browser and the pages requested. No cookies, no tracking scripts. | Your browser |
| Book a demo | Name, email, phone, company, company size and location, and what you write in the message. | The form |
| The newsletter | Email address and when you subscribed. | The form |
| The help box | Email address if you leave it, what you write and our replies. | The help box |
| Users of the app | Name, email, role, organisation, password as a hash, two-step secret encrypted, signed-in devices, settings and a security log. | Your administrator and yourself |
| The customer | Company name, registration number, invoicing address, contact person, licences per month and AI usage. | The agreement and the app |
| Your documents (we are the processor) | Everything in the documents you upload or connect from SharePoint or OneDrive, the findings the AI makes in them and what you write about them. | You, as the controller |
| Subcontractor in Kalvsvik Network | Company, registration number, trades, counties, contact person with name, email and phone, and the bids you submit. | Yourself, or the contractor who invites you |
| Contact person at a client | Name, email and phone published in public procurement notices and tender packages. | TED, the Swedish procurement agency's open data and emails you forward |
| Job applicants | What you send with an open application. | Yourself |
We do not process special categories of personal data (such as health or trade union membership) on purpose. If a document you upload contains such data, you are responsible for that being allowed.
4Why, and on what legal basis
Every processing activity has a purpose and a legal basis in GDPR article 6.
| Purpose | Legal basis | What it means |
|---|---|---|
| Deliver the app to you | Contract (6.1 b) | Accounts, sign-in, roles, licences, invoicing and support to you as a customer. |
| Read your documents with AI | Your instructions, as a processor (article 28) | We process the content of the documents only to give you findings, summaries and answers in the app. |
| Reply to a demo request or a question in the help box | Legitimate interest (6.1 f) | You got in touch and we reply. We do not contact you about anything other than what you asked. |
| Send the newsletter | Consent (6.1 a) | You subscribed yourself and can unsubscribe at any time with the link in every issue. |
| Run Kalvsvik Network | Legitimate interest (6.1 f) and, when you joined yourself, contract (6.1 b) | Contractors should find subcontractors in the right trade and county, and you should receive requests that fit. |
| Show contact persons in procurements | Legitimate interest (6.1 f) | The data was published by the client so that suppliers can ask questions. We show it unchanged. |
| Keep the app secure | Legitimate interest (6.1 f) | Sessions, limits on sign-in attempts, a security log and error reports without personal data. |
| Accounting | Legal obligation (6.1 c) | Invoices and records are kept as the Swedish Accounting Act requires. |
| Recruitment | Legitimate interest (6.1 f) | We read your application and get back to you. |
Where the basis is legitimate interest, we have weighed our interest against yours. The data is data you already gave in a professional role, the processing is limited, and you can object, see Your rights below.
5Who receives the data
We never sell personal data and do not share it with anyone outside the table below, unless the law or an authority requires it. The vendors process the data on our behalf under data processing agreements, and for your documents they are our sub-processors. You are told before a new sub-processor is added.
| Vendor | What it does | Where | Entity |
|---|---|---|---|
| Vercel | Runs the app and the website. | Stockholm (arn1). Logs may be processed in the USA. | Vercel Inc., USA |
| Supabase | Database and file storage with versions. | Stockholm (eu-north-1) | Supabase Inc., USA |
| Anthropic | The AI model Claude reads excerpts of your documents and writes the answers. | USA. No training on your data, deleted within 30 days. | Anthropic Ireland, Limited (contracting entity) and Anthropic, PBC, USA |
| Resend | Sends the app's email: invitations, reminders and requests to subcontractors. | USA | Resend Inc., USA |
| Microsoft | Sign-in with a Microsoft account and reading SharePoint or OneDrive, only if you connect it. | EU | Microsoft Ireland Operations Ltd |
| Sign-in with a Google account if you choose it, and our own email. | EU | Google Ireland Ltd | |
| Sentry | Error reports from the app, without personal data, when enabled. | USA or EU | Functional Software, Inc., USA |
| Slack | Questions from the help box become threads in our internal Slack, so that we can reply to you. | EU | Slack Technologies Limited, Ireland |
| Fortnox | Invoices and accounting | Sweden | Fortnox AB |
Sign-in with Microsoft or Google only asks to see who you are (openid, email and profile). Reading SharePoint or OneDrive requires an administrator at your company to connect the folder, and then Kalvsvik may only read, never change.
In Kalvsvik Network, a subcontractor's contact details are shared with the contractors who send a request in the right trade and county. The contractor is the controller for what they themselves keep about you in their register.
6Transfers outside the EU and EEA
Hosting, database and files are in Stockholm. Some of the vendors are US companies, and data can then still be processed in the USA, for example logs at Vercel, email via Resend and error reports at Sentry.
Anthropic does not promise that processing happens within the EU. We therefore assume that the excerpts of your documents may be processed in the USA when the AI reads them. Anthropic does not use the data to train models and deletes inputs and outputs within 30 days under its terms for business customers.
For transfers to the USA we rely on the European Commission's standard contractual clauses in the vendor's data processing agreement, and where the vendor is certified under the EU-US Data Privacy Framework also on the Commission's adequacy decision. Email us if you want to see the agreements or our assessment of the transfers.
7How long we keep the data
We keep the data as long as the purpose remains, and no longer. In practice this is how long.
| Data | How long |
|---|---|
| Your documents and everything in your account | For as long as the agreement runs. When it ends you export everything as a zip file if you want, and then the company is deleted completely with all projects, files and versions. [Copies in backups disappear within 90 days. Confirm the period with Supabase.] |
| A single user | Deleted when you remove the account. The name on what they wrote is replaced with Deleted user. In the admin log the name is anonymised after 12 months. |
| Sessions | At most 30 days from sign-in, and 7 days without activity. Signed-in devices can be signed out at any time. |
| The security log in the app | For as long as the account exists. Deleted with the user. |
| Error reports (Sentry) | At most 90 days. |
| IP addresses | Kept only as a hash that cannot be read back, to stop too many attempts, and in Vercel's server logs for a few days. |
| Demo requests | 24 months after the request is marked as closed, so that we can come back to you if you asked us to. |
| The help box | 12 months after the last message. |
| The newsletter | Until you unsubscribe. The address is then removed immediately. |
| Subcontractor in Kalvsvik Network | For as long as you are a member. If you ask to leave, your data is deleted within 30 days. Requests and bids remain with the contractors, but without your name and contact details. |
| Contact person in a procurement notice | For as long as the procurement is shown in Kalvsvik Radar, at most 24 months after the tender deadline. |
| Job application | Until the recruitment is closed, at most 24 months if you agreed to us getting back in touch. |
| Invoices and accounting records | 7 years under the Swedish Accounting Act. |
9Your rights
Under the GDPR you have the right to
- know which data we hold about you and get a copy (access),
- have incorrect data corrected,
- have data deleted when it is no longer needed or when you withdraw consent,
- have processing restricted in certain cases,
- receive your data in a machine-readable format (data portability),
- object to processing based on legitimate interest, and always to direct marketing,
- complain to the Swedish Authority for Privacy Protection (IMY), imy.se.
If you are a user of the app, most of this is already there. You change your name and password under Settings, see your signed-in devices and sign them out, and your administrator exports the company's data as a zip file or deletes an account. If it concerns data in your employer's documents, contact your employer, who is the controller for them.
For everything else, email kontakt@kalvsviklabs.com. We reply within a month and may ask you to show who you are before we hand anything over.
10How we protect the data
Everything is encrypted in transit and at rest. No file has a public address; every download goes through the app, which checks permissions. Passwords are stored as hashes, two-step verification is available for every account and can be required for the whole company, and if our support views your account it is shown at the top of every page and logged.
If we discover an incident involving personal data, we report it to IMY within 72 hours where required, and tell those of you affected what happened and what we did.
11Changes to this policy
We update this page when something changes, for example when a vendor is replaced. The date at the top shows the latest version. Larger changes that affect you as a customer are announced in the app or by email before they take effect.
Questions about personal data
Email us if you want to know which data we hold about you, want to change or delete it, or have a question about this policy.