Privacy Policy

Introduction

This Privacy Policy explains how Reinversed AB ("Reinversed") collects and uses personal data when individuals visit the website, create an account, purchase a subscription, contact Reinversed, or use the Service where Reinversed acts as data controller.

This Privacy Policy does not govern personal data that Reinversed processes only on behalf of a business customer as processor under the Data Processing Agreement.

Controller

Reinversed acts as controller for personal data processed for website operations, account administration, identity and fraud checks, support, billing, service analytics, security monitoring, legal compliance and direct business communications. Reinversed acts as processor or sub-processor where it processes Customer Personal Data on behalf of a business customer within the Service. Customers remain responsible for determining their own legal basis, role and notices in relation to End Users and connected data sources.

Categories of personal data

Reinversed may process the following categories of personal data:

• account and identity data, such as name, email address, organisation, role, and login identifiers;
• billing and transaction data, such as billing address, VAT number, invoices, subscription plan, payment status, and order records;
• usage and technical data, such as IP address, browser, device information, timestamps, logs, diagnostics, and security events;
• support and communications data, such as emails, tickets, feedback, and support history;
• marketing data, such as preferences, consent status, and campaign interactions; and
• cookie-related data, as described in the Cookie Policy.

Payments are processed by Stripe or another payment provider. Reinversed does not store full payment-card numbers.

Purposes and legal bases

Reinversed processes personal data to:

• provide, operate, secure, and support the Service;
• manage accounts and subscriptions;
• process payments and meet accounting and tax obligations;
• communicate with customers;
• analyse and improve the Service;
• prevent fraud, abuse, and security incidents; and
• comply with legal obligations and protect legal rights.

Where GDPR applies, the legal basis is contract, legitimate interests, consent, or legal obligation depending on the purpose.

AI-related processing

Reinversed may use Usage Data and aggregated or de-identified data to operate, secure, and improve the Service.

Reinversed does not use Customer content to train or fine-tune foundation models or Reinversed models unless the relevant customer expressly opts in, except where strictly necessary for support, incident investigation, abuse prevention, security, or legal compliance.

Reinversed applies privacy-by-design and risk assessment processes when introducing materially new personal-data processing activities and carries out data protection impact assessments where required by applicable law.

Recipients

Reinversed may share personal data with hosting, infrastructure, AI-model, support, analytics, communications, payment, and professional-service providers, customer-enabled integrations, public authorities where legally required, and a buyer or successor in a corporate transaction.

A current sub-processor and key service-provider list is available at www.reinversed.com and is updated when material changes are made. That page identifies the provider, service category, typical processing purpose and whether international transfers may occur.

International transfers

Reinversed aims to host data within the EU or EEA where practicable. Where personal data is transferred outside the EU or EEA, Reinversed relies on adequacy decisions or appropriate safeguards such as Standard Contractual Clauses.

Retention

Reinversed keeps personal data only for as long as necessary for the purposes for which it was collected, including service delivery, security, support, legal compliance, accounting and dispute resolution. As a general retention framework: account and subscription records are kept for the duration of the customer relationship and up to 24 months thereafter; security logs are typically kept for up to 12 months unless a longer period is required for incident investigation; support records are typically kept for up to 24 months after closure; billing and accounting records are kept for the period required by Swedish law, typically seven years; and Customer Personal Data processed under the DPA is deleted or returned after termination in accordance with the applicable contract and backup retention cycle. Personal data may be retained longer where required by law, to establish or defend legal claims, or where a documented security need applies.

Security

Reinversed maintains appropriate technical and organisational measures designed to protect personal data, including access controls, authentication, monitoring, incident response, and encryption where appropriate.

Rights

Subject to applicable law, individuals may request access, rectification, erasure, restriction, objection, portability, or withdrawal of consent.

Requests may be sent to privacy@reinversed.com. If Reinversed processes the data only as processor for a business customer, the request may be referred to that customer.

Complaints

Individuals may lodge a complaint with the Swedish Authority for Privacy Protection (IMY).

Automated decision-making

Reinversed does not make decisions producing legal or similarly significant effects about individuals based solely on automated processing for its own controller purposes.

Changes

Reinversed may update this Privacy Policy from time to time. Material changes affecting users' rights or use of personal data will be communicated by reasonable means where required.

Contact

Questions about this Privacy Policy may be sent to privacy@reinversed.com.