Solutra AI AB · Last updated: 14 August 2026
1Introduction
Solutra AI AB (“Solutra”, “we”, “us”,
“our”) builds and operates AI-based management systems for real estate agencies
and other smaller businesses. We care about your privacy and process personal data in
accordance with the EU General Data Protection Regulation (GDPR) and supplementary Swedish
data protection legislation.
This policy describes how we process personal data when you:
- visit or use the website solutra.ai,
- contact us via a form, by email or by telephone,
- are a client, a prospective client or a contact person at a client, or
- interact with Solutra in any other way.
Section 3 also describes our position on personal data processed inside the systems we
deliver to our clients.
2Controller and contact details
Solutra AI AB
Company registration number: 559590-5596
Linta Gardsvag 5A, 168 74 Bromma, Sweden
Email: info@solutra.ai
Website: solutra.ai
We have not appointed a data protection officer, as our activities do not fall within the
requirements of article 37 GDPR. Questions about the processing of personal data are answered
by us at the address above.
3Our two roles: controller and processor
It is important to distinguish two situations, because our responsibility differs between
them.
3.1 When Solutra is the controller
We determine the purposes and means of the processing ourselves, and are therefore the
controller, in relation to:
- visitors to solutra.ai,
- people who contact us via a form, by email or by telephone,
- prospective clients and their contact persons,
- contact persons at existing clients and partners,
- supplier contacts and applicants for positions with us.
This policy applies in full to that processing.
3.2 When Solutra is a processor
When we deliver and operate a system for a client, for example a CRM with AI teams
for a real estate agency, that system processes personal data about the client’s own clients,
buyers, sellers and counterparties.
For that data, our client is the controller and Solutra is the processor. This
means that:
- we process the data only on the client’s documented instructions,
- we never use the data for our own purposes,
- the terms are set out in a separate data processing agreement between Solutra and the
client,
- each client has its own logically and technically separated database; data is never
shared between clients.
If you are a client, a buyer or a counterparty of a business that uses Solutra’s system and
you wish to exercise your rights under the GDPR, you should contact that business in the first
instance. If you contact us directly, we will forward your request to the correct controller
and assist them in answering it.
4What personal data we process
4.1 Data you give us
- Name
- Email address
- Telephone number
- Company, role and company registration or VAT number
- The content of messages, enquiries and information supplied for a proposal
- Correspondence by email, telephone or in meetings
- Information provided in connection with agreements and invoicing
4.2 Data we collect automatically
When you visit solutra.ai we collect no visitor statistics. We use no analytics tool,
set no cookies, do not measure which pages you visit and build no profiles of individual
visitors. We cannot follow you between different websites. See section 6.
Like every website, solutra.ai is served by a web server, and that server keeps technical
logs of incoming requests, including IP address, time, requested address and browser type. The
logs are used solely for operations, troubleshooting and information security, never for
analytics or marketing, and are erased in accordance with section 10.
4.3 Data from third parties
In prospecting we may process publicly available business information, for example the
name, role and contact details of decision-makers, taken from company websites, public
registers and professional networks. That processing relies on legitimate interests and
concerns professional roles exclusively, not private individuals.
4.4 Data we do not process
We do not request and do not knowingly process:
- special categories of personal data under article 9 GDPR (for example health, ethnic
origin, political opinions, religious beliefs, trade union membership, sexual
orientation),
- national identity numbers, other than where required for contractual or accounting
purposes,
- data about children under 18.
5Purposes and legal bases
| Purpose | Categories of data | Legal basis |
|---|
| Answering enquiries via the contact form or email |
Contact details, message content |
Legitimate interests (art. 6.1 f): being able to answer the person who contacts us |
| Preparing a proposal and preparing an agreement |
Contact and company details |
Steps prior to entering a contract (art. 6.1 b) |
| Delivering and supporting our services |
Contact details, contract details, user accounts |
Performance of a contract (art. 6.1 b) |
| Invoicing and accounting |
Name, company, payment details |
Legal obligation (art. 6.1 c), Swedish Accounting Act |
| Marketing and mailings to existing clients |
Name, email address |
Legitimate interests (art. 6.1 f) |
| Newsletters to others |
Name, email address |
Consent (art. 6.1 a) |
| Prospecting of potential business clients |
Professional contact details |
Legitimate interests (art. 6.1 f) |
| Operations, troubleshooting and information security |
Technical logs |
Legitimate interests (art. 6.1 f) |
| Establishing, exercising or defending legal claims |
Relevant data in the matter |
Legitimate interests (art. 6.1 f) |
Where we rely on legitimate interests, we have carried out a balancing test and concluded
that our interest outweighs the data subject’s interest in the processing not taking place. You
always have the right to object to such processing, see section 12.
6Cookies and web analytics
Solutra.ai sets no cookies without your consent. Visits are counted with
Plausible, a cookie-free tool hosted in the EU that stores no personal data and cannot
recognise you: that is why it needs no permission and runs for every visitor. Anything that
would set a cookie is held behind the consent box and runs only if you accept. We share no
data with advertising networks.
The site stores two items in your browser’s localStorage: your choice of language, held as
the two letters en or es, and your answer to the consent box. Neither
ever leaves your browser, neither contains an identifier, and neither can be used to recognise
or follow you.
Beyond the Plausible script the site loads no third-party content: fonts, images and all
other code are served from our own server. Plausible is the single exception, and it is an EU
service that uses your IP address momentarily to count the visit without storing it.
Full information is in our cookie policy.
7AI processing and automated decision-making
Solutra’s services are built on AI agents that carry out tasks such as prospecting, client
communication and administration. We think it is important to be clear about what that
means.
7.1 How the AI processing works
Text processed by our agents, for example the content of an incoming message, is sent to an
external language model provider for processing. The processing is momentary: the provider does
not store the content for its own purposes and does not use it to train or improve its
models.
7.2 How our systems improve over time
Our agents improve because we analyse outcomes and adjust instructions, rules and logic.
That improvement happens at an aggregated and de-identified level, for example by measuring
which kind of wording produces the best response rate.
We do not use personal data as training data for AI models. Data from one client’s
system is never used to improve functionality for another client in a way that makes the
underlying personal data available.
7.3 Automated decision-making
We do not take decisions based solely on automated processing that produce legal effects
concerning you or similarly significantly affect you, within the meaning of article 22
GDPR.
Automated processing does occur, for example in the prioritisation of contacts and the
generation of draft replies. Such processing forms a basis for a decision; the final assessment
is made by a human. You always have the right to ask for human contact instead of automated
handling. Contact us at info@solutra.ai.
8Recipients and sub-processors
We never sell personal data and never share it for third-party marketing.
To deliver our services we engage suppliers that process personal data on our behalf. We
have entered into a data processing agreement with each of them.
| Supplier | Purpose | Place of processing |
|---|
| Supabase Inc. | Database and storage | EU (Frankfurt) |
| Render Services, Inc. | Application operations and hosting | EU (Frankfurt) |
| Anthropic PBC | Language model processing (Claude API) | EU / USA |
| Resend | Transactional email | EU / USA |
| Google Ireland Limited | Email, documents and collaboration tools | EU / USA |
| Fortnox AB | Accounting and invoicing | Sweden |
| Wise Europe B.V. | Payment handling | EU |
Beyond these, data may be disclosed to:
- Public authorities, where we are obliged to do so by law or by a decision of an
authority.
- Advisers, such as auditors and legal counsel, to the extent necessary.
- An acquirer, in the event of a restructuring or transfer of the business. You will
be informed in advance in that case.
A current list of sub-processors is provided to clients on request.
9Transfers to third countries
Our main principle is that personal data shall be processed within the EU/EEA. Database and
application operations are located within the EU.
Some suppliers are established in the USA, which means that transfers to a third country may
occur. Such transfers take place only on the basis of appropriate safeguards under chapter V
GDPR, that is:
- the European Commission’s adequacy decision (EU–US Data Privacy Framework), or
- standard contractual clauses supplemented by technical and organisational security
measures.
You have the right to receive information on request about which safeguards are applied.
Contact us at info@solutra.ai.
10How long we keep data
We keep personal data for as long as it is necessary for the purpose, or for as long as the
law requires.
| Category | Retention period |
|---|
| Enquiries that do not lead to business | 24 months from the last contact |
| Client data during an ongoing agreement | For the term of the agreement |
| Client data after an agreement ends | 24 months, to be able to handle subsequent questions and claims |
| Accounting records | 7 years after the end of the calendar year in which the financial year ended (Swedish Accounting Act, ch. 7 s. 2) |
| Newsletter subscription | Until you unsubscribe |
| Technical and security logs | 90 days |
| Data in an ongoing legal dispute | Until the dispute is finally determined |
Data processed in client systems, where we are a processor, is erased in accordance with the
client’s instructions and the data processing agreement in force between us.
11Security
We work systematically with information security and apply, among other measures:
- Encryption of all traffic in transit (TLS) and encryption of stored data
- Isolation of each client’s data in a separate database instance with row-level access
control
- Access control on a least-privilege basis and two-factor authentication for
administrative access
- Automatic backups with regular restore testing
- Logging and monitoring of access to production environments
- Separate environments for development, testing and production
- A procedure for handling personal data breaches, including notification to the Swedish
Authority for Privacy Protection within 72 hours where required
No transmission or storage can be guaranteed to be entirely secure. If a personal data
breach occurs that is likely to result in a high risk to your rights and freedoms, we will
inform you without undue delay.
12Your rights
You have the following rights under the GDPR:
Access (art. 15): you can ask whether we process personal data about you and, if so,
receive a copy of it.
Rectification (art. 16): you can ask for inaccurate data to be corrected and
incomplete data to be completed.
Erasure (art. 17): you can ask for erasure, for example when the data is no longer
needed or when you withdraw your consent. The right is not absolute; we may need to keep data
under the Swedish Accounting Act or for legal claims.
Restriction (art. 18): you can ask for the processing to be restricted, for example
while the accuracy of a piece of data is being checked.
Data portability (art. 20): for data you have provided yourself and that is
processed on the basis of consent or a contract, you can receive it in a structured, commonly
used and machine-readable format.
Objection (art. 21): you can object to processing based on legitimate interests. If
you object to direct marketing, we stop immediately.
Withdrawal of consent (art. 7.3): if you have given consent you can withdraw it at
any time. Withdrawal does not affect the lawfulness of processing carried out before it.
How to do it: contact us at info@solutra.ai. We
answer your request without undue delay and at the latest within one month. For complex or
numerous requests the period may be extended by two months, in which case you will be informed
within the first month. We may need to ask for additional information to verify your identity.
Exercising your rights is free of charge.
13Complaints
If you consider that we process your personal data in breach of applicable law, you have the
right to lodge a complaint with the supervisory authority. Solutra AI AB is established in
Sweden, so our lead supervisory authority is:
Integritetsskyddsmyndigheten (IMY)
Box 8114, 104 20 Stockholm, Sweden
imy@imy.se · +46 8 657 61 00 · imy.se
You may also lodge a complaint with the supervisory authority in the EU country where you
live or work: in Spain, the Agencia Espanola de Proteccion de Datos (aepd.es).
We would appreciate it if you contacted us first, so that we have the chance to put right
anything that has gone wrong.
14Changes to this policy
We may update this policy, for example when legislation changes or when our services gain
new functionality. The latest version is always published on solutra.ai with the date of the
most recent update. In the event of material changes we inform affected clients by email.
15Contact
Solutra AI AB
Linta Gardsvag 5A, 168 74 Bromma, Sweden
info@solutra.ai · solutra.ai
Last updated: 14 August 2026
