Privacy policy

Who is responsible for your data

Kodivo is a Swedish sole trader (enskild firma) that runs the website kodivo.se and the client portal app.kodivo.se, and is the data controller for the personal data collected there. That means that we decide why and how the data is processed, and that we are the ones you turn to if you have questions.

You can reach us at kontakt@kodivo.se.

This policy covers kodivo.se, the accounts in the client portal and the contact we have with you directly. For the assistants we build and run for clients, the client is the data controller and Kodivo is the data processor. The same applies to the conversations, statistics and contact details the client sees in the client portal. That processing is governed by the data processing agreement between us and the client, see when we build assistants for businesses and the client portal.

This is a translation of our Swedish policy. If the two versions differ, the Swedish version applies.

Information we collect

We only collect what we need in order to answer you and carry out our work. In practice it comes down to four things.

• Information you provide yourself. Name, email address, telephone number, company information and whatever you choose to write in a message, in the contact form, in the booking chat or in the chat.
• Technical data from the web server. When your browser requests a page, the server at our hosting provider automatically notes things such as the IP address, the time, which page was requested and which browser you use. Every web server does this, and the data is used for operations and security. We have no visitor measurement installed on kodivo.se, that is, neither Google Analytics nor any similar tool, and we do not build a profile of your visit.
• Technical information the site needs in order to work. For example, your browser remembering that you have already seen the opening animation, and the chat widget holding together when you change page. All of it is listed under cookies and local storage.
• Information about your account in the client portal. If your company has invited you, we receive your email address, your name if you provide it, which company you belong to and what role you have. We also record when you log in, and keep an activity log of what is done in the portal, for example when a conversation is opened or a detail is changed.

We never ask you for sensitive personal data, that is, data about health, religion, political opinions, trade union membership or the like. Do not write such data in the chat or in a message to us.

How we use your information

We use your information only in order to:

• answer your questions or messages
• communicate about potential collaborations, projects or services
• improve the experience on the website and in the chat
• send relevant information to the company you are interacting with via the chat
• give you and your company access to the client portal, and send emails that belong to it, for example invitations, new passwords and notice of a new monthly report
• protect the client portal against unauthorised access, and be able to see who did what if something needs to be investigated
• meet requirements that the law places on us, for example accounting rules

We will never sell, rent out or share your personal information with third parties without your consent. We do not profile you, and we do not make any automated decisions that have legal consequences for you.

Legal basis for the processing

The GDPR requires every processing operation to rest on a legal basis. We rely on four:

• Consent. When you write to us of your own accord in the chat or in a form. You can withdraw your consent at any time.
• Legitimate interest. When we keep the website running and protect it against misuse, that is, the technical logs of the web server. Also when you, as an employee of a client, get an account in the client portal, and when we keep an activity log of the portal. This is needed for the service your company has bought to work and be protected. We have weighed our interest against your privacy and therefore collect as little as possible.
• Performance of a contract, or steps taken prior to entering into a contract. When we discuss or carry out an assignment for you.
• Legal obligation. When the law requires us to keep something, for example accounting records.

The chat on the website

On kodivo.se you can talk to an AI assistant of the same kind as the ones we build for our clients. What you write there is handled in the same way as a message to us.

The chat only starts if you have agreed to it, see cookies and local storage. When it starts, before you have written anything, the chat widget's program is loaded from the platform and a session is opened there. An ID for your browser and the language of the page are sent at that point. Everything you then write is sent to the platform and stored as a conversation log in our account there.

The information is sent to the technical platform we use to run the assistant. The platform processes the data on our behalf and in accordance with our instructions, and does not use it for its own purposes. We use it to ensure correct functionality, data security and the delivery of messages.

When we build assistants for businesses

Kodivo sells to companies and organisations, not to private individuals. When we build an AI assistant for a client and the assistant is used on the client's own website, the client is the data controller for the conversations with its visitors. Kodivo then processes the data on the client's behalf, as a data processor.

What the assistant may access, which subprocessors are used and how long the conversations are kept is set out in the agreement with each client. If you are a visitor to such a website, you will find the company's own privacy policy there.

The platform that runs the assistants uses language models from external AI providers to formulate the answers. Email addresses, phone numbers, personal identity numbers and similar data are masked before the message is used any further. How that works is described on the security page.

The client portal app.kodivo.se

Our clients log in at app.kodivo.se to see how their AI assistant is used. An account can only be obtained through an invitation, and whoever logs in only sees their own company’s data.

Kodivo is the data controller for the accounts. For everything concerning the client’s visitors, the client is the data controller and Kodivo the data processor. This is how visitor data is processed in the portal:

• Statistics about the conversations. The number of conversations, messages and visitors, and for each conversation the time, country, type of device and number of messages. What was written is not stored by us.
• Whole conversations, when someone opens them. The text is fetched from the platform at that moment and is not stored by us. Email addresses, phone numbers, personal identity numbers, card numbers, links and similar data are masked before the text is shown. Every time someone opens a conversation, it is logged.
• AI analysis of the conversations. An AI service from an external provider reads each conversation, with the same data masked, and writes a short summary, a topic and an assessment of whether the assistant was able to help. The provider may not use the data to train its models. The assessment is automatic and can be wrong. It is only used to improve the assistant, never for decisions about an individual visitor.
• Leads. Contact details that a visitor chooses to leave in the chat in order to be contacted are stored, so that the client can see them and follow up.
• Monthly reports. A draft is written with the help of AI, and we read and edit it before the client sees it.
• Company information and change requests. What the client enters. Changes to the company information are reviewed by us before they reach the assistant.
• The test chat. The client’s own trial conversations with the assistant. We only store the response time and whether something went wrong, not what was written.

Emails from the portal, that is, invitations, new passwords and notices of new reports and requests, are sent through our email provider.

Cookies and local storage

kodivo.se sets no cookies. What is stored lives in your browser's local storage (localStorage and sessionStorage), which is covered by the same rules as cookies. We use no storage for marketing or visitor tracking, and we do not follow you between different websites.

The first time you visit the site you choose between Accept all and Necessary only. You can change your choice at any time under Cookie settings, which you will also find in the footer.

Necessary storage is always used, because the page does not behave as you expect without it. None of it leaves your browser:

• Your cookie choice. So that we do not ask again on every visit. Kept for twelve months.
• The state of the page. That you have already seen the opening animation, and whether the chat widget is open and which tab is showing. Removed when you close your browser.

The chat requires your consent. It only starts if you choose Accept all, or agree directly in the chat widget. The following is then stored:

• The platform's ID for your browser, and your sound setting if you change it. Kept until you clear site data or choose Necessary only.
• The platform's session data for the ongoing conversation. Removed when you close your browser.
• A random ID from us, which is sent to the platform to keep your conversations together. It contains nothing about you and is replaced when you start over in the chat.
• A copy of your chat history. It lives only in your browser, so that you can read earlier conversations under the History tab. The copy clears itself after 30 days, and you can clear it yourself with the button in the same tab.

If you choose Necessary only, the chat does not start and nothing is sent to the platform. If you agreed earlier, the IDs, the session data and the history copy are deleted from your browser when you change your choice. Conversations already sent remain in our account with the platform. If you want us to delete them, just get in touch, see your rights.

Until the chat has started, the website does not fetch any files from other servers. Everything the page needs in order to be displayed is hosted on our own domain, so your IP address is not passed on simply because you open a page. When the chat starts, its program is loaded from the platform, and your IP address then reaches the platform's servers.

The client portal app.kodivo.se does not set any cookies either and has no visitor measurement. When you log in, your login is stored in the browser’s local storage, so that you do not have to log in again on every page. It is necessary for the portal to work and is removed when you log out. Short on-screen notices and the demo mode are kept in sessionStorage and disappear when you close the tab.

You can also block and delete stored site data in your browser settings.

Who may have access

What you send to us is only accessible to us, and to the company you are talking to when the chat sits on a client's website. In addition, we engage a small number of suppliers that process data on our behalf:

• the web host that runs kodivo.se and app.kodivo.se
• the database and login service behind the client portal, which has its servers in the EU
• the platform that runs the AI assistant, and the AI providers whose language models the platform uses
• the form service that receives what you send in the contact form and the booking chat and forwards it to our email
• the AI provider that analyses the conversations in the client portal and helps with the drafts of the monthly reports
• our email provider

Anyone with an account in the client portal only sees data about their own company.

The suppliers process the data on our behalf and may only use it in order to perform the service for us. The platform that runs the assistant processes the data on servers in the USA. The transfer relies on the European Commission’s standard contractual clauses as a safeguard, and they cover personal data from the EEA, including the conversation logs from the chat. The AI provider that analyses the conversations may process the data outside the EEA. The transfer then relies on the European Commission’s standard contractual clauses or on the Commission’s adequacy decision for the USA (EU-U.S. Data Privacy Framework). If any other processing takes place outside the EU and the EEA, it does so with the same kind of safeguards.

We may also need to disclose data if a public authority requires it on the basis of law.

How long we keep the information

We do not keep data for longer than we need it.

• Messages and enquiries that do not lead any further. Up to twelve months, so that we can follow up on an earlier contact.
• Data linked to an assignment. For as long as the collaboration is ongoing, and thereafter for as long as the law requires. Accounting records are kept for seven years.
• The technical logs of the web server. For as long as our hosting provider keeps them for operations and security. We do not read them in order to analyse visitors, and we compile no visitor statistics from them.

In the client portal, these periods apply:

• Account in the client portal. For as long as your company wants you to have access. The account is removed when the client asks us to, and at the latest when the agreement ends.
• The activity log. Twelve months.
• Data about each conversation. Time, country, device, number of messages, topic and the AI’s assessment are kept for 13 months, so that the statistics can be compared with the same month the year before.
• The AI summaries. 35 days.
• The conversation text itself. Not stored by us. It is kept by the platform for as long as the agreement with the client specifies, and deleted when the agreement ends.
• Leads. Until the client removes them in the client portal or asks us to delete them, and at the latest when the agreement ends.
• The test chat log and technical logs from collecting statistics. Between 30 and 90 days.
• Monthly reports, company information and change requests. For as long as the agreement is in force.

If you would like us to delete something sooner, all you need to do is get in touch.

Security

kodivo.se is SSL secured with HTTPS, which means that the traffic between your browser and the website is encrypted. You can see this from the padlock in the address bar.

Information you provide is stored securely and is accessible only to those who need it for their work. No technical solution is entirely without risk, but we choose suppliers and procedures on that basis. Should an incident nevertheless occur and involve a risk to you, we report it to the Swedish Authority for Privacy Protection (IMY) and inform you when the law requires it.

The client portal requires a login, and the rule that a client only sees its own data is enforced in the database, not just in the interface. The keys to the platform are stored encrypted and are never sent to the browser.

If someone writes a piece of sensitive information in the chat window, it is masked before the message is used further. What is caught, and where the line is drawn, is set out on the page about security and privacy.

Your rights

You have the right to:

• find out what data we hold about you, and request a copy of it
• have incorrect or incomplete data corrected
• ask us to delete your personal information
• request that we restrict the processing while a matter is being looked into
• object to processing that we base on legitimate interest
• receive the data you have provided yourself in a machine readable format, and have it transferred to someone else
• withdraw a consent you have given, at any time, without this affecting processing that has already taken place

To exercise these rights, simply send an email to kontakt@kodivo.se. It costs nothing, and we normally reply within one month.

If your question concerns a conversation with another company’s assistant, or contact details you left there, please turn first to that company. They are the data controller, and we help them answer you.

If you are not satisfied with how we have handled your data, you have the right to complain to the Swedish Authority for Privacy Protection (IMY), which is the supervisory authority in Sweden. Their contact details are available at imy.se.

Links to other websites

On kodivo.se there are links to other sites, for example the founders’ profiles on LinkedIn. When you click through, that site’s own privacy policy applies, not ours. We are not responsible for how others handle your data.

Children and young people

The website is aimed at companies and professionals, not at children. We do not knowingly collect data about children under the age of thirteen. If you are a guardian and believe that your child has given data to us, get in touch and we will delete it.

Changes to this policy

We may update this privacy policy when needed, for example if we start using a new tool. Any changes will be published here with a new date at the top. If a change concerns something material, we will inform you in a clearer way than that.

Contact

If you have questions about this privacy policy or about how we handle your data, get in touch at kontakt@kodivo.se. We are happy to answer.