Privacy Policy

1. Introduction

Sensa AI AB ("we", "us", "our") is committed to protecting your privacy and personal data in accordance with the EU General Data Protection Regulation (GDPR) and Swedish Data Protection Act (Dataskyddslagen 2018:218).

This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our Service.

Data Controller: Sensa AI
Email: support@getsensa.io
Privacy Contact: privacy@getsensa.io

2. Personal Data We Collect

2.1 Data You Provide Directly

When you create an account and use our Service, we collect:

• Account Information: Email address, password (hashed), display name
• Organization Information: Organization name, role within organization
• Profile Data: Avatar image (optional), user preferences, language settings
• Communication Data: Support requests, feedback, correspondence

2.2 Data Collected Automatically

• Usage Data: Features accessed, messages sent, documents processed, timestamps
• Technical Data: IP address, browser type and version, device information, operating system
• Audit Logs: All actions within the system (for security, compliance, and accountability)
• Performance Data: Error logs, crash reports, API response times

2.3 Data You Upload or Process

Important: When you upload documents or process data through our Service, this data belongs to your organization (you are the Data Controller). We process this data on your behalf as a Data Processor.

• Documents: Insurance claims, policies, evidence packs, and other files you upload
• Extracted Data: Information extracted from documents via AI processing
• Chat Messages: Conversations with our AI assistant, including queries and responses
• Structured Data: Tables, cells, columns created in tabular reviews

3. Lawful Basis for Processing (GDPR Article 6)

We process your personal data based on the following lawful bases:

3.1 Contract Performance (Art. 6(1)(b))

Processing necessary to provide the Service you signed up for, including account management, authentication, and service delivery.

3.2 Legal Obligation (Art. 6(1)(c))

Processing required by Swedish and EU law, including:

• Tax and accounting requirements (Bokföringslagen)
• Anti-money laundering regulations
• Data breach notification obligations

3.3 Legitimate Interest (Art. 6(1)(f))

Processing necessary for our legitimate interests, including:

• Security monitoring and fraud prevention
• Service improvement and analytics
• Technical troubleshooting and support
• Business intelligence and product development

We have balanced these interests against your rights and determined that processing is necessary and proportionate.

3.4 Consent (Art. 6(1)(a))

Where required, we obtain your explicit consent, such as for:

• Marketing communications (which you can withdraw at any time)
• Optional features that require additional data processing

4. How We Use Your Personal Data

We use your personal data for the following purposes:

4.1 Service Provision

• Authenticate and manage your account
• Process AI requests and generate analyses
• Store and retrieve your documents
• Provide customer support
• Send service-related communications (password resets, security alerts)

4.2 Security and Compliance

• Detect and prevent fraud, abuse, and security incidents
• Maintain comprehensive audit logs for accountability
• Enforce our Terms of Service
• Comply with legal obligations and respond to law enforcement requests

4.3 Service Improvement

• Analyze usage patterns to improve features
• Conduct research and development
• Perform quality assurance testing
• Generate anonymized analytics and statistics

Note: We do NOT use your uploaded documents or processed data to train AI models or for any purpose other than providing the Service to you.

5. Data Sharing and Disclosure

5.1 Sub-Processors

We share data with the following sub-processors who assist in providing the Service:

• OpenAI (USA): AI processing (GPT-5 model). Data Processing Agreement in place. Transfer basis: EU-US Data Privacy Framework and Standard Contractual Clauses.
• Supabase (USA): Database hosting and authentication. Data Processing Agreement in place. Transfer basis: Standard Contractual Clauses and appropriate safeguards.

All sub-processors are contractually required to implement appropriate security measures and process data only as instructed by us.

5.2 Legal Requirements

We may disclose your data if required by Swedish or EU law, including:

• Court orders or legal process
• Requests from Integritetsskyddsmyndigheten (IMY) or other regulatory authorities
• Protection of our rights, property, or safety
• Prevention of fraud or criminal activity

5.3 Business Transfers

If Sensa AI is involved in a merger, acquisition, or asset sale, your personal data may be transferred. We will provide notice and ensure the new entity honors this Privacy Policy.

5.4 No Selling of Data

We do NOT sell, rent, or trade your personal data to third parties for marketing purposes.

6. International Data Transfers

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA), specifically the United States.

Safeguards: We ensure adequate protection through:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• EU-US Data Privacy Framework (for certified organizations like OpenAI)
• Technical and organizational measures (encryption, access controls)
• Data Processing Agreements with all processors

You may request copies of the safeguards by contacting privacy@getsensa.io.

7. Data Security

We implement industry-standard security measures to protect your personal data:

7.1 Technical Measures

• Encryption: All data encrypted at rest (AES-256) and in transit (TLS 1.3)
• Access Control: Row-level security, multi-factor authentication, role-based access
• Network Security: Firewalls, intrusion detection, DDoS protection
• Secure Development: Code reviews, security testing, vulnerability scanning

7.2 Organizational Measures

• Employee confidentiality agreements
• Security training and awareness programs
• Incident response procedures
• Regular security audits and penetration testing
• Data minimization and pseudonymization where possible

7.3 Data Breach Notification

In the event of a data breach affecting your personal data, we will notify you and Integritetsskyddsmyndigheten (IMY) within 72 hours as required by GDPR Article 33, providing:

• Nature of the breach and categories of data affected
• Likely consequences of the breach
• Measures taken to address the breach
• Recommended actions for affected individuals

8. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes described in this Policy:

• Account Data: Retained while your account is active, plus 30 days after account deletion
• Uploaded Documents: Retained while your account is active, deleted 30 days after account deletion
• Audit Logs: Retained for 7 years (required by Swedish accounting law - Bokföringslagen)
• Financial Records: Retained for 7 years (tax and accounting obligations)
• Support Correspondence: Retained for 3 years
• Usage Analytics: Aggregated and anonymized after 24 months

You may request deletion of your data at any time (subject to legal retention requirements) by contacting privacy@getsensa.io or using the account deletion feature.

9. Your Rights Under GDPR

You have the following rights regarding your personal data:

9.1 Right of Access (Art. 15)

You may request a copy of all personal data we hold about you. We will provide this within 30 days at no charge (unless the request is manifestly unfounded or excessive).

9.2 Right to Rectification (Art. 16)

You may correct inaccurate or incomplete personal data through your account settings or by contacting us.

9.3 Right to Erasure / "Right to be Forgotten" (Art. 17)

You may request deletion of your personal data. We will comply unless we have a legal obligation to retain it (e.g., tax records, audit logs required by law).

9.4 Right to Restriction of Processing (Art. 18)

You may request that we limit how we process your data in certain circumstances, such as while verifying data accuracy.

9.5 Right to Data Portability (Art. 20)

You may request your data in a machine-readable format (JSON, CSV) and transfer it to another service. This feature is available in your account settings under "Export Data".

9.6 Right to Object (Art. 21)

You may object to processing based on legitimate interests. We will stop processing unless we have compelling legitimate grounds that override your interests.

9.7 Right to Withdraw Consent (Art. 7(3))

Where processing is based on consent, you may withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.

9.8 Right to Lodge a Complaint

You have the right to lodge a complaint with the Swedish Data Protection Authority (Integritetsskyddsmyndigheten):

Integritetsskyddsmyndigheten (IMY)
Box 8114
104 20 Stockholm, Sweden
Phone: 08-657 61 00
Email: imy@imy.se
Website: www.imy.se

How to Exercise Your Rights

To exercise any of these rights, contact us at:

• Email: privacy@getsensa.io

We will respond within 30 days and may request additional information to verify your identity.

10. Cookies and Tracking

10.1 Strictly Necessary Cookies

We use essential cookies for authentication and security. These cannot be disabled as they are necessary for the Service to function:

• Session Cookies: Maintain your login session
• Security Cookies: Detect fraud and abuse
• Preferences: Remember your language and display settings

10.2 Analytics (Optional)

With your consent, we may use analytics to improve our Service. You can opt out in Settings.

10.3 No Third-Party Advertising

We do NOT use advertising cookies or share data with advertising networks.

11. Children's Privacy

Our Service is not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us at privacy@getsensa.io, and we will delete it promptly.

12. Automated Decision-Making and Profiling

AI-Generated Outputs: Our Service uses AI to analyze documents and generate insights. However:

• We do NOT use AI for automated decision-making that produces legal effects or similarly significantly affects you (GDPR Article 22)
• All AI outputs are advisory and require human review and validation
• We do NOT engage in profiling for marketing or behavioral prediction
• You have the right to obtain human intervention, express your point of view, and contest AI-generated decisions

Important: If you use our AI outputs in your own decision-making processes affecting individuals, YOU are responsible for ensuring GDPR compliance, including transparency and safeguards for automated decisions.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or Service features.

Notification: We will notify you of material changes by:

• Email to your registered email address
• Prominent notice in the Service
• At least 30 days before changes take effect

Your continued use of the Service after changes become effective constitutes acceptance. If you do not agree with changes, you may terminate your account.

14. Contact Information

For questions or concerns about this Privacy Policy or our data practices, contact:

Email: privacy@getsensa.io
Support: support@getsensa.io

Response Time: We will respond to all privacy inquiries within 30 days.

15. Data Processing Agreement (DPA)

If you are processing personal data through our Service (i.e., you are a Data Controller and we are your Data Processor), a separate Data Processing Agreement is available upon request at privacy@getsensa.io. The DPA includes:

• Subject matter, nature, and purpose of processing
• Types of personal data and categories of data subjects
• Your instructions to us regarding data processing
• Our obligations regarding security, confidentiality, and sub-processors
• Data subject rights assistance
• Data breach notification procedures
• International data transfer mechanisms
• Audit rights and compliance verification