Solutra AI AB · Last updated: July 31, 2026
1Introduction
Solutra AI AB ("Solutra", "we", "us", "our") develops and operates AI-based operating
systems for smaller companies. We care about your privacy and process personal data in
accordance with the EU General Data Protection Regulation (GDPR) and supplementary Swedish
data protection legislation.
This policy describes how we process personal data when you:
- visit or use the website solutra.se,
- contact us via form, email or phone,
- are a customer, potential customer or contact person at a customer, or
- otherwise interact with Solutra.
The policy also describes, in section 3, how we handle personal data processed
in the systems we deliver to our customers.
2Data controller and contact details
Solutra AI AB
Company registration number: 559590-5596
Linta Gårdsväg 5A, SE-168 74 Bromma, Sweden
Email: info@solutra.se
Website: solutra.se
We have not appointed a data protection officer, as our business is not covered by the requirements of
article 37 GDPR. Questions about data processing are answered by us at the address above.
3Our two roles: controller and processor
It's important to distinguish two situations, because our responsibility differs.
3.1 When Solutra is the data controller
We determine the purposes and means of processing ourselves, and are therefore
the data controller, for:
- visitors to solutra.se,
- people who contact us via form, email or phone,
- potential customers and their contact persons,
- contact persons at existing customers and partners,
- supplier contacts and job applicants.
This policy applies in full to those processing activities.
3.2 When Solutra is the data processor
When we deliver and operate a system for a customer, for example a CRM with AI agents for
a real estate agency, the system processes personal data about the customer's own customers, prospective buyers,
sellers and counterparties.
For this data, our customer is the data controller and Solutra
the data processor. This means that:
- we process the data only according to the customer's documented instructions,
- we never use the data for our own purposes,
- the terms are governed by a separate data processing agreement between Solutra and the customer,
- each customer has their own logically and technically separated database — data is never shared
between customers.
If you are a customer, prospective buyer or counterparty of a company using Solutra's systems and want
to exercise your rights under the GDPR, you should first contact that company. If you contact
us directly, we forward your request to the correct data controller and assist them
in answering it.
4What personal data we process
4.1 Data you provide to us
- Name
- Email address
- Phone number
- Company, role and registration number
- Content of messages, inquiries and quote materials
- Correspondence via email, phone or meetings
- Data provided in connection with contracts and invoicing
4.2 Data we collect automatically
When you visit solutra.se we keep anonymous visitor statistics using Plausible. It
sets no cookies, stores no personal data and cannot recognise you — neither between
two visits nor across different sites. We see how many people read a page, roughly where
the visit came from and which buttons are pressed, never who pressed them. See section 6.
Like every website, solutra.se is reached via a web server, which keeps technical logs of
incoming requests, including IP address, timestamp, requested address and browser type. The logs
are used solely for operations, troubleshooting and information security, never for analytics or
marketing, and are deleted per section 10.
4.3 Data from third parties
In prospecting we may process publicly available company data, such as names,
roles and contact details of decision-makers from company websites, public registers and
professional networks. The processing rests on legitimate interest and concerns professional roles exclusively,
not private individuals.
4.4 Data we do not process
We do not request and do not knowingly process:
- special categories of personal data under article 9 GDPR (e.g. health, ethnic
origin, political opinions, religious beliefs, trade union membership, sexual orientation),
- national identity numbers, other than where required for contract or accounting purposes,
- data about children under 18.
5Purposes and legal basis
| Purpose | Categories of data | Legal basis |
|---|
| Answer inquiries via the contact form or email |
Contact details, message content |
Legitimate interest (art. 6(1)(f)), being able to answer whoever contacts us |
| Prepare quotes and contracts |
Contact and company details |
Pre-contractual measures (art. 6(1)(b)) |
| Deliver and support our services |
Contact details, contract details, user accounts |
Performance of a contract (art. 6(1)(b)) |
| Invoicing and accounting |
Name, company, payment details |
Legal obligation (art. 6(1)(c)), the Swedish Accounting Act |
| Marketing and mailings to existing customers |
Name, email address |
Legitimate interest (art. 6(1)(f)) |
| Newsletter to others |
Name, email address |
Consent (art. 6(1)(a)) |
| Prospecting of potential business customers |
Professional contact details |
Legitimate interest (art. 6(1)(f)) |
| Operations, troubleshooting and information security |
Technical logs |
Legitimate interest (art. 6(1)(f)) |
| Establish, exercise or defend legal claims |
Data relevant to the case |
Legitimate interest (art. 6(1)(f)) |
Where we rely on legitimate interest we have carried out a balancing test and assessed that
our interest outweighs the data subject's interest in the processing not taking place. You
always have the right to object to such processing, see section 12.
6Cookies and web analytics
Solutra.se sets no cookies at all. For visitor statistics we use Plausible, a
cookie-free tool hosted in the EU that stores no personal data and builds no profiles.
We share no data with ad networks.
Two items are kept in the browser's own storage: a started order form and a
campaign code if you arrived through an ad link. They sit on your device, not with us, and
the form draft reaches us only when you send it yourself. Both are listed in our
cookie policy, section 4.
Fonts, images and all other code are served from our own server. The only request that goes
outside it is the statistics script above, and that is also the only time your IP address reaches
anyone else when you visit the page.
Full details are in our Cookie policy.
7AI processing and automated decision-making
Solutra's services are built on AI agents performing tasks such as prospecting,
customer communication and administration. We consider it important to be clear about what this
means.
7.1 How the AI processing works
Text processed by our agents, for example the content of an incoming message,
is sent to an external language model provider for processing. The processing is momentary:
the provider does not store the content for its own purposes and does not use it to train or
improve its models.
7.2 How our systems improve over time
Our agents improve as we analyze outcomes and adjust instructions, rules and
logic. This improvement happens at an aggregated and de-identified level, for example by measuring
which kind of phrasing gets the best reply rate.
We do not use personal data as training data for AI models. Data from one
customer's system is never used to improve functionality for another customer in a way that
makes underlying personal data accessible.
7.3 Automated decision-making
We do not make decisions based solely on automated processing that have legal
effects on you or similarly significantly affect you, within the meaning of
article 22 GDPR.
Automated processing occurs in the form of, for example, contact prioritization and
generation of draft replies. Such processing is decision support — the final judgment
is made by a human. You always have the right to request human contact instead of automated
handling. Contact us at info@solutra.se.
8Recipients and subprocessors
We never sell personal data and never share it for third-party marketing.
To deliver our services we engage providers who process personal data on
our behalf. We have data processing agreements with all of them.
| Provider | Purpose | Place of processing |
|---|
| Supabase Inc. | Database and storage | EU (Frankfurt) |
| Render Services, Inc. | Application hosting and operations | EU (Frankfurt) |
| Anthropic PBC | Language model processing (Claude API) | EU / USA |
| Resend | Transactional email | EU / USA |
| Google Ireland Limited | Email, documents and collaboration tools | EU / USA |
| Fortnox AB | Accounting and invoicing | Sweden |
| Wise Europe B.V. | Payment processing | EU |
Beyond these, data may be disclosed to:
- Authorities, when required by law or a decision by an authority.
- Advisors, such as auditors and legal counsel, to the extent needed.
- Acquirer, in the event of a restructuring or transfer of the business. You
will be informed in advance in that case.
A current list of subprocessors is provided to customers on request.
9Transfers to third countries
Our main principle is that personal data should be processed within the EU/EEA. Database and
application hosting are located within the EU.
Some providers are established in the USA, which means transfers to third countries may
occur. Such transfers only take place with appropriate safeguards under chapter V
GDPR, that is:
- an EU Commission adequacy decision (EU–US Data Privacy Framework), or
- standard contractual clauses supplemented with technical and organizational
security measures.
You have the right to receive, on request, information about the safeguards applied. Contact us
at info@solutra.se.
10How long we keep data
We keep personal data as long as necessary for the purpose, or as long as the law
requires.
| Category | Retention period |
|---|
| Inquiries that don't lead to business | 24 months from the last contact |
| Customer data during an active agreement | For the duration of the agreement |
| Customer data after the agreement ends | 24 months, to be able to handle subsequent questions and claims |
| Accounting records | 7 years after the end of the calendar year in which the financial year closed (Swedish Accounting Act, ch. 7 § 2) |
| Newsletter subscription | Until you unsubscribe |
| Technical and security logs | 90 days |
| Data in an ongoing legal dispute | Until the dispute is finally resolved |
Data processed in customer systems, where we are the processor, is deleted according to the customer's
instructions and the data processing agreement between us.
11Security
We work systematically with information security and apply, among other things:
- Encryption of all traffic in transit (TLS) and encryption of stored data
- Isolation of each customer's data in a separate database instance with row-level access control
- Least-privilege access control and two-factor authentication for
administrative access
- Automatic backups with regular restore testing
- Logging and monitoring of access to production environments
- Separate environments for development, testing and production
- A procedure for handling personal data incidents, including notification to
the supervisory authority within 72 hours where required
No transfer or storage can be guaranteed to be completely secure. If a personal data incident
occurs that is likely to lead to a high risk to your rights and freedoms, we inform you
without undue delay.
12Your rights
You have the following rights under the GDPR:
Access (art. 15), You can ask whether we process personal data about
you, and if so receive a copy of the data.
Rectification (art. 16), You can request that inaccurate data be corrected and that incomplete
data be completed.
Erasure (art. 17), You can request erasure, for example when the data is no longer
needed or when you withdraw your consent. The right is not absolute — we may need to keep
data under the Accounting Act or for legal claims.
Restriction (art. 18), You can request that processing be restricted, for example while
the accuracy of a record is being verified.
Data portability (art. 20), For data you provided yourself, processed on the basis
of consent or contract, you can receive it in a structured, commonly used and machine-readable
format.
Objection (art. 21), You can object to processing based on legitimate interest.
If you object to direct marketing, we stop immediately.
Withdrawal of consent (art. 7(3)), If you have given consent you can withdraw it at any
time. Withdrawal does not affect the lawfulness of processing carried out before it.
How to: Contact us at info@solutra.se. We
answer your request without undue delay and within one month at the latest. For complex or numerous
requests the period may be extended by two months — in that case you are informed within the first
month. We may need to ask for additional information to confirm your identity. Exercising
your rights is free of charge.
13Complaints
If you believe we process your personal data in breach of applicable law, you have the right to
lodge a complaint with the supervisory authority:
The Swedish Authority for Privacy Protection (IMY)
Box 8114, SE-104 20 Stockholm
imy@imy.se · +46 8 657 61 00 · imy.se
We'd appreciate you contacting us first, so we get the chance to fix any
shortcomings.
14Changes to this policy
We may update this policy, for example due to changed legislation or new
features in our services. The latest version is always published on solutra.se with its
last-updated date. For material changes we inform affected customers by email.
15Contact
Solutra AI AB
Linta Gårdsväg 5A, SE-168 74 Bromma
info@solutra.se · solutra.se
International inquiries: info@solutra.ai
Last updated: July 31, 2026
