GDPR Compliance

Compliance Status

1. What GDPR Means for You

The General Data Protection Regulation (GDPR) is the EU's comprehensive data protection law that gives you control over your personal data. As a Swedish-based service under Swedish Authority for Privacy Protection (IMY) supervision, we're fully committed to GDPR compliance and Swedish data protection standards.

2. GDPR Principles in Practice

3. Swedish Data Sovereignty

Why it matters: Unlike services storing data in the US or globally, GlennGPT keeps 100% of your data within Sweden under Swedish and EU jurisdiction.

4. Your GDPR Rights

GDPR grants you comprehensive rights over your personal data. Here's how to exercise them with GlennGPT:

Right	What You Can Do	How to Exercise
Access	Request a copy of all your data	Account settings → "Export Data" or email privacy@aisamtal.se
Rectification	Correct inaccurate data	Update directly in account settings
Erasure	Request deletion of your data	Account settings → "Delete Account" or email privacy@aisamtal.se
Restriction	Limit how we process your data	Contact privacy@aisamtal.se with specific restrictions
Portability	Receive data in machine-readable format	Use "Export" feature (JSON format provided)
Object	Object to specific processing activities	Email privacy@aisamtal.se with objection details

Response Time: We respond to all rights requests within 30 days. Most account-based actions take effect immediately.

Note on Erasure: When you delete your account, most data is removed without undue delay (typically within 30 days). Billing records are retained for 7 years as required by Swedish accounting law. Anonymized usage statistics may be retained for service improvement.

5. Legal Basis for Processing

Every data processing activity requires a legal basis under GDPR. Here's ours:

Contract Performance (Article 6(1)(b))

Processing necessary to provide the service:

• Account management and authentication
• Processing AI chat requests and storing conversation history
• Billing, payment processing, and subscription management
• Customer support

Legitimate Interests (Article 6(1)(f))

Processing necessary for business operations, balanced against your rights:

• Service improvement and optimization (anonymized analytics)
• Fraud detection and security monitoring
• System maintenance and technical operations

Legal Obligations (Article 6(1)(c))

Processing required by Swedish or EU law:

• Accounting and tax records (7 years per Swedish accounting law)
• Responding to lawful authority requests
• Data breach notifications to IMY and affected users

Consent (Article 6(1)(a))

Optional processing requiring explicit opt-in:

• Marketing communications
• Product research and user surveys
• Optional feature data collection

You can withdraw consent at any time through account settings or by contacting privacy@aisamtal.se.

6. Our Data Processors and Sub-Processors

Under GDPR Article 28, we maintain contracts with all processors and sub-processors who handle your personal data on our behalf. You have the right to request information about our processors—contact us at privacy@aisamtal.se. Key processor categories are also described in our Privacy Policy.

Swedish/EEA Data Processors (No International Transfer)

Our primary data processors handle your data exclusively within Sweden or the European Economic Area:

• AI Inference Provider: Swedish-based AI infrastructure for primary chat functionality
• Payment Processor: EU-based payment processing for subscriptions
• Hosting Provider: Swedish data center infrastructure

Legal Basis: GDPR Article 28 - These processors act on our behalf under written contracts that meet Article 28 requirements.

Cloud AI Sub-Processors (Optional Feature)

When Applicable: Only when you actively select a cloud AI model provided through the platform in Pro or Max subscription plans. If you only use Swedish-hosted models, this section does not apply to you.

Key Protections:

• All sub-processors are bound by GDPR-compliant Data Processing Agreements
• International transfers protected by Standard Contractual Clauses (SCCs) and adequacy frameworks where available
• Limited data retention periods (varies by provider)
• Contractually prohibited from using your data to train AI models
• Required to implement Article 32 security measures

Sub-Processor Change Notification:

In accordance with GDPR Article 28(2), if we plan to add, remove, or replace a cloud AI sub-processor:

• We will email you at least 30 days before the proposed change
• You have the right to object to the proposed change
• If you object, you may switch to Swedish-hosted models or terminate your subscription without penalty

Third-Party Integrations (BYOK - Not Sub-Processors)

When you connect your own API key from a third-party AI provider ("Bring Your Own Key"), these providers are NOT our sub-processors under GDPR Article 28 because you have a direct contractual relationship with the provider. The provider's own privacy policy and terms apply to their processing of your data.

Self-Hosted Analytics (No Third-Party Processor)

We use self-hosted, cookie-free analytics on our own Swedish infrastructure. Because this is self-hosted and collects only anonymized, aggregate data (no personal identifiers), it does not involve any third-party data processor. We do not engage marketing platforms or other third-party processors that access your personal data. See our Privacy Policy for complete details.

7. Security & Data Protection

We implement comprehensive technical and organizational measures per GDPR Article 32:

8. Data Breach Procedures

In accordance with GDPR Articles 33-34, we have established breach detection and notification procedures:

Our Response Timeline

• 0-24 hours: Immediate detection, containment, and investigation
• Within 72 hours: Notification to Swedish supervisory authority (IMY)
• Without undue delay: Direct notification to affected users if high risk to rights and freedoms

User Notification Includes: Description of breach, likely consequences, measures taken/proposed, and contact point for questions.

Detection Methods: Continuous automated monitoring, automated anomaly detection, and regular security assessments.

9. Privacy by Design & Default

GDPR Article 25 requires privacy to be built into services from inception. We implement this through:

Privacy by Design

• Privacy considerations integrated into technical architecture decisions
• Security reviews before deploying new features
• Data protection impact assessments when required by GDPR Article 35 (high-risk processing)

Privacy by Default

• Minimal data collection by default
• Strictest privacy settings as default configuration
• No marketing emails without explicit opt-in
• Automatic session timeouts for security

10. International Data Transfers

Primary Processing: All core data processing occurs in Sweden (application, database, AI inference) and the EU (payment processing). Both are EU/EEA jurisdictions requiring no additional safeguards.

Limited Third-Country Transfers: When sub-processors involve data transfers outside EU/EEA, these are protected by:

• Standard Contractual Clauses (SCCs) approved by European Commission
• Adequacy frameworks where available (such as EU-US Data Privacy Framework)

Optional Cloud AI Models: When you select third-party cloud AI providers in Pro/Max subscriptions, conversation data may be transferred outside the EU/EEA. We protect these transfers through: (1) Standard Contractual Clauses requiring providers to protect data to European standards, (2) Provider participation in adequacy frameworks where available (such as EU-US Data Privacy Framework), (3) Contractual guarantees that your data is never used for AI training. See our Privacy Policy for current provider details.

11. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or significantly affects you (GDPR Article 22). AI-generated content results from your direct prompts, not autonomous decisions about you.

12. Supervisory Authority

As a Swedish company, our lead supervisory authority is:

If you have concerns about our data practices that we haven't resolved, you have the right to lodge a complaint with IMY or your local data protection authority.

13. Contact & Exercise Your Rights