Privacy Policy
Last updated: 2026-05-13
This Privacy Policy explains how Sandskogen AI Aktiebolag ("rek.ai", "we", "us", or "our") collects, uses, and protects personal data when you visit or interact with rek.ai (the "Website"). We are committed to protecting your privacy and processing your data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and other applicable data protection laws.
This policy covers personal data collected when you visit or interact with the Website. It does not cover personal data we process on behalf of our customers as part of the rek.ai recommendation service — that processing is governed by the data processing agreement between rek.ai and each customer, and is described in the customer's own privacy notice.
1. Data Controller
The data controller responsible for processing your personal data is:
Sandskogen AI Aktiebolag
Org. nr: 559145-2494
Email: privacy@rek.ai
Data protection enquiries: dpo@rek.ai
2. What Personal Data We Collect
We collect different categories of personal data depending on how you interact with the Website:
| Category | Data collected | Source |
|---|---|---|
| Contact information | Name, email address, company name, and any other information you provide through our contact or demo request forms | Directly from you |
| Usage data | Pages visited, referral source, visit duration, browser type, country (no IP addresses stored) | Plausible Analytics |
| Cookies & tracking data | See Section 7 below | Set via HubSpot on the Website |
3. Why We Process Your Data (Purposes and Legal Basis)
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Responding to enquiries and processing contact or demo request forms | Legitimate interest (Art. 6(1)(f)), to manage business communications |
| Sending marketing communications and newsletters (where applicable) | Consent (Art. 6(1)(a)) |
| Analysing website traffic and usage patterns | Legitimate interest (Art. 6(1)(f)), to improve the Website |
4. Third-Party Services
We use the following third-party services that may process personal data on our behalf:
| Service | Purpose | Data location | Privacy information |
|---|---|---|---|
| Plausible Analytics | Privacy-friendly website analytics. No cookies, no personal data stored | EU | Data policy |
| HubSpot, Inc. | Contact form handling, lead attribution, and marketing communications | EU/US (with Standard Contractual Clauses) | Privacy policy |
Each third-party service processes data in accordance with their own privacy policy and under a Data Processing Agreement (DPA) where required by GDPR.
5. International Data Transfers
Some of our third-party service providers (HubSpot) may transfer personal data to countries outside the EU/EEA, including the United States. Where such transfers occur, they are safeguarded by appropriate mechanisms such as the European Commission's Standard Contractual Clauses (SCCs) or an adequacy decision, in accordance with Chapter V of the GDPR.
6. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes described in this policy:
- Contact form submissions: retained for up to 24 months after the last interaction, unless you become a customer (in which case data is retained for the duration of the business relationship plus any legally required retention period, such as bookkeeping obligations).
- Analytics data: Plausible Analytics does not store personal data or IP addresses. Anonymous and aggregated statistics are retained indefinitely.
- Cookies: see Section 7 for individual cookie lifespans.
7. Cookies and Tracking Technologies
We use cookies and similar technologies on the Website. Plausible Analytics, our primary analytics tool, does not use cookies and does not collect personal data. However, HubSpot may place cookies on your device. These are only set with your consent.
When you first visit the Website, a cookie consent banner allows you to accept or decline non-essential cookies. You can reopen the banner and change your preferences at any time using the Update your cookie preferences button on our Cookie Policy page.
For a complete list of all cookies used on this Website, including their names, purposes, and durations, please see our Cookie Policy.
8. Your Rights
Under the GDPR, you have the following rights regarding your personal data:
- Right of access: request a copy of the personal data we hold about you.
- Right to rectification: ask us to correct inaccurate or incomplete data.
- Right to erasure: request deletion of your personal data ("right to be forgotten").
- Right to restrict processing: ask us to limit how we use your data.
- Right to data portability: receive your data in a structured, machine-readable format.
- Right to object: object to processing based on legitimate interest.
- Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, please contact us at privacy@rek.ai or dpo@rek.ai. We will respond within one month of receiving your request. Where necessary, this period may be extended by up to two further months, taking into account the complexity and number of requests. We will inform you of any such extension within one month of receiving the request.
If you believe that our processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority. In Sweden, the supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY): www.imy.se.
9. Automated Decision-Making
We do not engage in automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR) in connection with this Website.
10. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of data in transit (TLS/HTTPS), access controls, and regular security reviews of our systems and sub-processors. For more details on our security measures, see our Security page.
11. Children's Privacy
The Website and our services are intended for business users. We do not knowingly collect personal data from individuals under the age of 16. If you believe we have inadvertently collected data from a child, please contact us and we will promptly delete it.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.
13. Contact Us
If you have questions about this Privacy Policy or how we handle your personal data, please contact us:
Email: privacy@rek.ai
Data protection enquiries: dpo@rek.ai
Sandskogen AI Aktiebolag, org. nr 559145-2494