Privacy Policy

What personal data we process in AIConscius, why, and what you can do about it.

AIConscius is a service provided by Ricardo Pedro Slagter, a Swedish sole trader (enskild firma), VAT ID SE730710535801, Trängsled Lilla 1, 355 95 Tävelsås, Sweden.

Contact: privacy@aiconscius.eu

Last updated: 2026-10-12

Who is responsible

Ricardo Pedro Slagter, a Swedish sole trader (enskild firma), is the controller for the personal data described here. AIConscius is one of the applications of this business. For the personal data you put into the workspace, about your own organisation or your clients, you are the controller and we act as your processor; the Data Processing Agreement governs that and forms part of the Terms of Service.

What we process

Account data. Email address, name if you provide one, authentication identifiers, and the organisation and role you hold in the workspace.

Content you enter. Descriptions of AI systems, roles, purposes, the answers you give during an assessment, evidence you upload, review decisions and the reasons recorded for them. This may contain personal data if you choose to put it there — for example, the name of a system owner or a reviewer.

Scan data. The website addresses and domains you ask us to scan, what the scan found there, and the decisions you take on each finding. If you tell us a scan missed something or reported something wrongly, we keep that without your name or account to improve the scanner.

Payment data. For paid plans: name, billing address, VAT number if you give one, plan, and payment status. Card details go straight to our payment provider; we never see or store them.

Operational data. Audit records of who changed what and when, which we keep deliberately: without them an assessment cannot be defended.

We do not sell personal data, and we do not use your content to train models.

Legal basis

Account, content, scan and payment processing rests on performance of the contract with you (Art. 6(1)(b) GDPR). Keeping invoices and payment records rests on our legal obligation under Swedish bookkeeping law (Art. 6(1)(c) GDPR). Audit records, security logging and abuse prevention rest on our legitimate interest in operating a defensible and secure service (Art. 6(1)(f) GDPR). Where we ask for consent — for example, to be named publicly as a design partner — you can withdraw it at any time without affecting anything else.

Who else is involved

We use these processors to run the service:

  • Hetzner Online GmbH, Germany: hosting of the application, its database and login. All account, content and scan data is stored here.
  • Stripe Payments Europe, Limited, Ireland: payments, invoices and receipts for paid plans. Receives payment data only.
  • OVH Hosting Limited (OVHcloud), Ireland: runs the language model for the optional deep check in the Compliance Scanner. Receives only the system description you type into that scanner. The model runs on OVHcloud servers in the EU; OVHcloud does not store the text or reuse it, including for training, and records only usage for billing.
  • Hostinger International Ltd, Cyprus: our e-mail. Sends account e-mails such as confirmation and password reset, and receives the e-mails you send us.

Only the optional deep check in the Compliance Scanner sends text to a language model: the description you type there goes to OVHcloud. Nothing else you store with us, such as scans, evidence or account data, is sent to a language model. If another feature ever does, we name the provider here before it is switched on.

Where data is processed

Within the EU/EEA. Exceptions: Stripe may transfer payment data to Stripe, Inc. in the United States; that transfer is covered by the EU-US Data Privacy Framework and the European Commission's standard contractual clauses. OVHcloud's group companies in Canada and the United Kingdom may access its systems remotely for maintenance and security; both countries are covered by an adequacy decision of the European Commission.

How long we keep it

Account data for as long as the account exists, and for a limited period afterwards to handle disputes. Invoices and payment records for seven years after the end of the year they belong to, as Swedish bookkeeping law requires. Your declaration at checkout that you buy for a business (business name, what it does, VAT numbers, which terms you accepted) until three months after your paid plan ends or your account is deleted, then we delete it; you can download it with your other data in Settings. Assessment content and its audit trail for as long as you keep the workspace, because an assessment without its history is not evidence. You can ask us to delete a workspace; we will tell you what we are legally required to retain and for how long.

Cookies and browser storage

We use no tracking, analytics or advertising cookies, and our fonts are served from our own domain. Your browser stores only what the service needs: your login session and your choices for theme and language.

Your rights

You can request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. Write to privacy@aiconscius.eu and we will respond within one month.

If you are unhappy with how we handled it, you can complain to the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY), or to the authority where you live or work.

Changes

When this policy changes materially we will update the date at the top and tell account holders. Superseded versions are kept so you can see what applied when.