Privacy Policy
Last updated: 2026-08-04
This Privacy Policy explains how Sandskogen AI Aktiebolag ("rek.ai", "we", "us", or "our") collects, uses, and protects personal data when you visit or interact with rek.ai (the "Website"). We are committed to protecting your privacy and processing your data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and other applicable data protection laws.
This policy covers personal data collected when you visit or interact with the Website. It does not cover personal data we process on behalf of our customers as part of the rek.ai recommendation service, that processing is governed by the data processing agreement between rek.ai and each customer, and is described in the customer's own privacy notice.
This policy also covers personal data relating to users of the rek.ai administration interface (dashboard.rek.ai), where rek.ai acts as data controller. This is distinct from the processing of our customers' website visitors, which rek.ai carries out as a data processor under a data processing agreement with each customer.
1. Data Controller
The data controller responsible for processing your personal data is:
Sandskogen AI Aktiebolag
Org. nr: 559145-2494
Email: privacy@rek.ai
Data protection enquiries: dpo@rek.ai
2. What Personal Data We Collect
We collect different categories of personal data depending on how you interact with the Website:
| Category | Data collected | Source |
|---|---|---|
| Contact information | Name, email address, company name, and any other information you provide through our contact or demo request forms | Directly from you |
| Usage data | Pages visited, referral source, visit duration, browser type, country (no IP addresses stored) | Plausible Analytics |
| Cookies & tracking data | See Section 7 below | Set via HubSpot on the Website |
| Technical data | IP address, requested URL, browser and device information processed transiently in server and request logs when the Website is delivered to you | Automatically, via our hosting provider Vercel |
| Administrator account data | Name, email address, phone number, role and permissions, authentication credentials (password in hashed form, TOTP secret), login timestamps, session data, IP address at sign-in, records of administrative actions | Directly from you or from your organisation |
3. Why We Process Your Data (Purposes and Legal Basis)
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Responding to enquiries and processing contact or demo request forms | Legitimate interest (Art. 6(1)(f)), to manage business communications |
| Sending marketing communications and newsletters (where applicable) | Consent (Art. 6(1)(a)) |
| Analysing website traffic and usage patterns | Legitimate interest (Art. 6(1)(f)), to improve the Website |
| Providing, securing and administering access to the rek.ai administration interface | Legitimate interest (Art. 6(1)(f)), to deliver the service to our customer and to protect accounts against unauthorised access |
4. Third-Party Services
We use the following third-party services that may process personal data on our behalf:
| Service | Purpose | Data location | Privacy information |
|---|---|---|---|
| Plausible Analytics | Privacy-friendly website analytics. No cookies, no personal data stored | EU | Data policy |
| HubSpot, Inc. | Contact form handling, lead attribution, and marketing communications | EU/US (with Standard Contractual Clauses) | Privacy policy |
| Vercel Inc. | Hosting and content delivery of the Website (rek.ai), including processing of IP addresses and request logs required to serve the Website | Global edge network, including the US (with Standard Contractual Clauses) | Privacy policy |
| Google Cloud EMEA Limited | Hosting of the rek.ai administration interface (dashboard.rek.ai) | EU (Frankfurt, europe-west3) | Privacy notice |
Each third-party service processes data in accordance with their own privacy policy and under a Data Processing Agreement (DPA) where required by GDPR.
5. International Data Transfers
Some of our third-party service providers may transfer personal data to countries outside the EU/EEA, including the United States (HubSpot, Vercel). Vercel Inc. is a US company and delivers the Website through a global edge network, which means that technical data such as IP addresses may be processed outside the EU/EEA. Google Cloud EMEA Limited stores and processes administration interface data within the EU, but is part of a US-owned group and may therefore be subject to US legislation, including the CLOUD Act. Where transfers or access from outside the EU/EEA may occur, they are safeguarded by appropriate mechanisms such as the European Commission's Standard Contractual Clauses (SCCs) or an adequacy decision, in accordance with Chapter V of the GDPR.
6. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes described in this policy:
- Contact form submissions: retained for up to 24 months after the last interaction, unless you become a customer (in which case data is retained for the duration of the business relationship plus any legally required retention period, such as bookkeeping obligations).
- Analytics data: Plausible Analytics does not store personal data or IP addresses. Anonymous and aggregated statistics are retained indefinitely.
- Cookies: see Section 7 for individual cookie lifespans.
- Administrator accounts: account data is retained for the duration of the customer relationship and deleted within 30 days of the account being deactivated. Sign-in and administrative activity logs are retained for 30 days.
7. Cookies and Tracking Technologies
We use cookies and similar technologies on the Website. Plausible Analytics, our primary analytics tool, does not use cookies and does not collect personal data. However, HubSpot may place cookies on your device. These are only set with your consent.
When you first visit the Website, a cookie consent banner allows you to accept or decline non-essential cookies. You can reopen the banner and change your preferences at any time using the Update your cookie preferences button on our Cookie Policy page.
For a complete list of all cookies used on this Website, including their names, purposes, and durations, please see our Cookie Policy.
8. Your Rights
Under the GDPR, you have the following rights regarding your personal data:
- Right of access: request a copy of the personal data we hold about you.
- Right to rectification: ask us to correct inaccurate or incomplete data.
- Right to erasure: request deletion of your personal data ("right to be forgotten").
- Right to restrict processing: ask us to limit how we use your data.
- Right to data portability: receive your data in a structured, machine-readable format.
- Right to object: object to processing based on legitimate interest.
- Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, please contact us at privacy@rek.ai or dpo@rek.ai. We will respond within one month of receiving your request. Where necessary, this period may be extended by up to two further months, taking into account the complexity and number of requests. We will inform you of any such extension within one month of receiving the request.
If you believe that our processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority. In Sweden, the supervisory authority is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY): www.imy.se.
9. Automated Decision-Making
We do not engage in automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR) in connection with this Website.
10. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of data in transit (TLS/HTTPS), access controls, and regular security reviews of our systems and sub-processors. For more details on our security measures, see our Security page.
Access to the administration interface requires multi-factor authentication (TOTP or SMS) and is subject to role-based access control.
11. Children's Privacy
The Website and our services are intended for business users. We do not knowingly collect personal data from individuals under the age of 16. If you believe we have inadvertently collected data from a child, please contact us and we will promptly delete it.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.
13. Contact Us
If you have questions about this Privacy Policy or how we handle your personal data, please contact us:
Email: privacy@rek.ai
Data protection enquiries: dpo@rek.ai
Sandskogen AI Aktiebolag, org. nr 559145-2494