How we handle personal data.

Brandspace is a service created by Edenvik. We are responsible for the personal data described in this policy when we decide why and how it is processed — for example your account and early-access details.

When an organisation stores material in its Brandspace, that organisation decides what is stored. For that material we process data on the organisation's behalf, under our agreement with them.

Questions about privacy: hello@brandspace.se.

• Account data — email, name, avatar and sign-in information. To provide your account and keep it secure. Legal basis: contract.
• Membership and roles — which Brandspaces and organisations you belong to and your role. To control access. Legal basis: contract.
• Invitations — invited email address, role and status. To let organisations invite people. Legal basis: legitimate interest of the inviting organisation.
• Early-access signups — email, company, role and source. To manage the private beta and contact you about access. Legal basis: consent, which you can withdraw at any time.
• Customer material — documents, images, logos, fonts, website content and brand content an organisation adds. To provide the service. Processed on behalf of that organisation.
• Logs — who changed what and when, which connected assistant read which approved content, and operator support access. For security, accountability and troubleshooting. Legal basis: legitimate interest. Logs do not contain document text, prompts or file contents.

When someone in a Brandspace starts an analysis — importing a document or website, generating AI Context or similar — the relevant material is sent through an AI gateway to the model providers listed below to perform that task.

When a connected assistant reads a Brandspace, Brandspace makes no AI calls of its own. It returns approved content to the client the organisation chose to connect. That client's processing is governed by the organisation's own agreement with its provider.

We do not use customer material to train AI models.

Our database, sign-in and private file storage are hosted in the EU (Ireland).

• Cloud infrastructure provider — database, sign-in and file storage (EU).
• AI gateway — routes analyses that users start to model providers.
• OpenAI and Google — model providers for those analyses. Processing may take place outside the EU; where it does, transfers rely on the providers' standard contractual clauses or equivalent safeguards.
• Email delivery provider — invitations and account email.

We do not sell personal data.

• Account and membership data — as long as the account exists.
• Customer material — as long as the Brandspace exists. A deleted Brandspace is closed immediately and permanently removed after a 30-day grace period, or immediately on request.
• Activity and connection logs — 24 months, then deleted automatically.
• Operator audit log — 5 years, then deleted automatically.
• Early-access signups — until the private beta ends or you ask us to remove you.
• Backups — deleted data can remain in backups until they expire.

You can ask for access to, correction of, or deletion of your personal data, ask us to restrict or stop processing, object to processing based on legitimate interest, and receive your data in a portable format. Organisations can export all their Brandspace content themselves.

Write to hello@brandspace.se. If your data is held on behalf of an organisation, we may refer you to them.

You can complain to the Swedish Authority for Privacy Protection (IMY), imy.se.

We only use what is strictly necessary to keep you signed in and remember basic preferences such as language. We do not use advertising or analytics cookies.

We update this policy when the service changes. Significant changes are communicated to account holders.