Privacy Policy for Svava

1. Who we are and what this policy covers

Svava AB (Swedish company registration number 559070-8995, Bjärka-Säby Tomta, 589 64 Sturefors, Sweden; "Svava", "we", "our" or "us") provides the Svava service ("Service"). This Privacy Policy explains how we collect, use, store, share and protect personal data when you use:

• The Svava web app at svava.app
• The Svava Chrome Extension ("Extension")
• Svava connectors: connections that let an AI assistant you use, such as Microsoft Copilot, Claude or ChatGPT, access Svava on your behalf through MCP

Separate notices apply to voice interviews and to how we describe data handling on svava.io.

1.1 Svava as controller and as processor

Svava is used by organizations. We are the controller for the personal data we need to run the Service, such as your account, sign-in and security data. When your organization uses Svava under an agreement with us, your organization is generally the controller for the content its users add to Svava (for example chat messages, attachments and organization data), and we process that content on its behalf under that agreement. If you use Svava through your employer, your employer's privacy information may also apply.

2. Information we collect

2.1 Data you provide

• Account and sign-in data: name, email address and password (stored only in hashed form by our authentication provider), and your organization and team memberships.
• Content: chat messages to Svava's AI assistants and profiles, files you upload, screenshots you capture with the Extension, and material you add to studies, sessions or organization libraries.
• Approvals for connected AI assistants: when you connect an AI assistant, which organization you approve and which permissions (scopes) you grant.

2.2 Data collected when you use the Service

• Extension page context: when you start an analysis in the Extension, the URL and title of the active tab and the visible content you choose to capture. This is limited to the tab and moment you trigger the feature.
• Session data: authentication tokens that keep you signed in.
• Connector data: for each connected AI assistant, a client registration (the name the assistant gives itself and its return addresses; for assistants that use a client secret, only a hash of that secret), and access and refresh tokens, which we store only as hashes.
• Technical logs: request metadata such as time, operation, status, error codes and IP address, used to operate and secure the Service.
• Settings: preferences such as language, selected assistant and capture settings. In the Extension these are stored locally on your device.

2.3 Data we do not collect

• General browsing history across tabs or over time (the Extension only reads the active tab when you trigger an analysis)
• Passwords or form data from websites you visit
• Location data, device identifiers or fingerprints
• Cookies from websites you visit
• Keystrokes or input outside the Svava interfaces

3. How we use your information

4. Connected AI assistants (MCP)

You can let an AI assistant, such as Microsoft Copilot (Cowork), Claude or ChatGPT, use Svava through MCP. This works as follows:

• You start and approve the connection. The assistant sends you to Svava's own sign-in page. You sign in, choose one organization and approve the requested permissions. We show which permissions are requested before you approve.
• Permissions are limited. Depending on what you approve, the assistant can list the profiles available in that organization, read and create your own profile chats, and start and read your own interviews and focus groups. It sees only what you can see in Svava, and access is checked on every request, including that you are still a member of the organization.
• What the assistant receives. When the assistant calls Svava, it receives the results of that call, for example profile names, chat replies or session results. This data then leaves Svava.
• The assistant's provider is responsible for its own processing. Microsoft, Anthropic, OpenAI or another provider of the assistant you use processes what it receives under its own terms and privacy policy, including how long it keeps the data and whether it is used to improve its models. Svava does not control this. Review the assistant's terms, or your organization's agreement with that provider, before connecting.
• You can revoke access at any time. On Svava's connection page you can see your connections and revoke them. A revoked connection stops working on its next request. You can also remove the connection in the assistant.

5. Data storage and location

• Databases and files: stored with Supabase in EU regions (AWS data centres in Sweden, Ireland or Germany, depending on your organization's environment).
• Web pages: svava.app and svava.io are served from servers operated by Hetzner Online.
• Extension: settings and sign-in tokens are stored locally using Chrome's storage APIs.

All data is transmitted over HTTPS/TLS and encrypted at rest by our infrastructure providers. Database access is restricted by row-level security, and service credentials are kept on the server side only.

6. Sharing and service providers

6.1 AI processing

To generate responses, relevant content is sent from our backend to AI model providers. We send only what the task needs: the message, relevant conversation context, attachments or screenshots you included, and relevant profile or study material. We do not send your password or authentication tokens.

6.2 Service providers

AI providers process data under their API terms and our agreements with them. Connected AI assistants (section 4) are not our service providers: you choose to share data with them.

6.3 We do not

• Sell your personal data
• Share your data with advertisers or use it for advertising
• Use your content to train AI models
• Let people read your data except as described in section 6.4

6.4 Human access

• With your consent: when you ask for support and authorize us to look at your data
• Security: when investigating abuse, fraud or security incidents
• Law: when required by valid legal process
• Aggregated and anonymized: for internal operations where no individual can be identified

7. Data retention

Data you share with a connected AI assistant, and data processed by AI providers, is also subject to their retention policies.

8. Your rights

• In the Service: view your history, delete conversations, sign out and revoke connected AI assistants.
• On request: access, export, correction or deletion of your data, and account closure.

If you are in the EU/EEA, you have the right to access, rectify, erase, restrict and object to processing, the right to data portability, and the right to lodge a complaint with a supervisory authority (in Sweden, Integritetsskyddsmyndigheten, IMY). California residents have the rights to know, access and delete personal information and to non-discrimination; we do not sell personal information. Where your organization is the controller, we will forward your request or help your organization answer it.

9. Chrome Extension permissions

10. Children

The Service is intended for work use and not for children under 13. We do not knowingly collect personal data from children. Contact us if you believe a child has given us personal data, and we will delete it.

11. International transfers

Our databases are hosted in the EU. Some service providers, such as AI model providers, may process data outside the EU/EEA. Such transfers rely on appropriate safeguards, such as the EU Commission's standard contractual clauses or an adequacy decision, together with data processing agreements.

12. Changes to this policy

We may update this policy. We will change the "Last updated" date, publish the new version on this page and, for significant changes, tell you in the Service.

13. Contact

Svava AB, registration number 559070-8995, Bjärka-Säby Tomta, 589 64 Sturefors, Sweden. For questions or requests about your personal data, email elia.morling@svava.io with the subject line "Privacy Request".