Privacy Policy
Last updated 30 October 2026.
This Privacy Policy describes the processing of personal data by Solvigo AB in connection with visits to solvigo.ai, enquiries, recruitment and client relationships. It sets out the purposes and legal bases for processing, applicable retention periods and the rights of data subjects.
1. Data controller
Solvigo AB (org.nr 559529-3647), Valhallavägen 140, 114 59 Stockholm, Sweden is the data controller for the processing described here.
Solvigo has appointed a Data Protection Officer. Privacy enquiries, requests and complaints may be submitted to info@solvigo.ai for direct referral to the Data Protection Officer.
2. Enquiries
Contact form submissions, including name, email address and any company details, telephone number or message provided, are processed solely to respond to and follow up on enquiries. Processing is based on pre-contractual steps requested by the data subject (GDPR art. 6(1)(b)) and our legitimate interest in responding to enquiries (art. 6(1)(f)).
Submissions are stored in our own systems and in Google Workspace, both hosted within the EU, and are accessible only to Solvigo personnel on a need-to-know basis. Correspondence is retained for the duration of the enquiry and deleted when no longer required for that purpose.
If you subscribe to our newsletter, we process your email address, what you agreed to and when you signed up. We use the address only to send the newsletter. Processing is based on your consent (GDPR art. 6(1)(a)), which you can withdraw at any time by emailing us or through the unsubscribe link in each issue. When you withdraw it, we delete your address.
3. Recruitment
If you apply for a position with us we process your application, CV, interview notes and any other information you choose to send. The legal basis is our legitimate interest in assessing candidates and taking steps prior to a possible employment contract (art. 6(1)(b) and (f)).
Recruitment data is retained for two years from the application date to allow consideration for suitable vacancies. Applicants may request earlier deletion at any time.
4. Client and business relationships
If you work for one of our clients, or we are in a commercial dialogue with your organisation, we process ordinary business contact details and our correspondence with you. The legal basis is performance of a contract (art. 6(1)(b)) or our legitimate interest in managing the client relationship (art. 6(1)(f)).
Contracts and related records are kept for the duration of the engagement plus ten years, under the Swedish Limitations Act. Invoices and other accounting records are kept for seven years, as the Swedish Bookkeeping Act requires.
5. Processing on behalf of clients
Where Solvigo develops or operates systems on behalf of a client, the client determines the purposes of processing and acts as data controller. Solvigo acts as processor in accordance with the client’s documented instructions and the applicable data processing agreement.
Processing carried out on behalf of a client is governed by that client’s privacy policy. Data subject requests should be addressed to the relevant controller. Requests received by Solvigo will be forwarded to the controller, whom we will assist in responding.
6. Cookies and analytics
Google Tag Manager manages our analytics and advertising tags. Google Consent Mode starts with analytics and advertising storage denied. Google tags may send cookieless measurement signals before you make a choice or if you reject cookies. Analytics cookies are enabled only when you allow Analytics. Meta and LinkedIn advertising tags require your separate Marketing consent. Declining these choices does not affect website functionality.
Analytics and marketing cookies are used only with your consent (art. 6(1)(a)), as required by the GDPR and Swedish electronic communications law. Withdrawing consent does not affect processing that took place before.
Your choice is stored on this browser for 12 months, after which we ask again. Use Cookie settings below to change or withdraw your choices. On withdrawal, we update the consent state and attempt to remove relevant first-party measurement cookies. Withdrawing Marketing consent also reloads the page to stop previously loaded advertising tags. We cannot remove cookies belonging to other domains.
The website uses the following cookies and similar storage technologies:
| Name | Set by | Purpose | Duration | Requires consent |
|---|---|---|---|---|
| solvigo_consent | Solvigo (localStorage) | Remembers your cookie choice | 12 months | No, strictly necessary |
| solvigo-scroll:* | Solvigo (sessionStorage) | Restores your place on a page when you navigate back | Browser session | No, functional, no tracking |
| _ga | Google Analytics | Distinguishes visitors (random ID, not your identity) | 2 years | Yes |
| _ga_* | Google Analytics | Keeps session state for this site | 2 years | Yes |
| _fbp, _fbc, _gcl_*, LinkedIn cookies | Marketing providers | Advertising measurement and attribution | Varies by provider and configuration | Yes, Marketing |
Marketing consent enables advertising measurement for Google, Meta and LinkedIn. Cookie names and lifetimes depend on the tags and settings used by those providers. Their policies explain their processing: Google, Meta and LinkedIn.
Where advertising tags collect data on our website, we may be jointly responsible with the provider for that collection. Each provider is responsible for its own further processing, as described in its policy.
Links from ads and campaigns may contain campaign parameters and click identifiers. We keep them while you move on to our contact page so that an enquiry can be attributed to a campaign, in line with your cookie choices.
7. Server logs
Website infrastructure records technical request logs, including IP address, timestamp, requested page and browser user agent. Logging is independent of analytics consent and is necessary to operate and secure the website.
The legal basis is our legitimate interest in the availability and security of our services (art. 6(1)(f)). These logs are not used to profile you and are not combined with analytics data. They are rotated automatically after 30 days.
8. Recipients
We do not sell personal data. Website measurement data may be shared with the analytics and advertising providers described in section 6, according to your cookie choices and the consent behaviour explained there. Names entered in forms, email addresses and message contents are not sent in our website tracking events.
The following service providers process personal data on our behalf under data processing agreements:
| Provider | What it is used for | Where |
|---|---|---|
| Google Cloud Platform | Cloud infrastructure, compute, storage, databases | EU (Stockholm) |
| Google Workspace | Email, documents, calendar | EU |
We engage further providers in delivering services to our clients. Clients receive an up-to-date sub-processor list on request, and at least 30 days’ notice before we engage a new sub-processor or materially change how an existing one is used.
Personal data is otherwise disclosed only where required by law.
9. International transfers
We process personal data primarily within the European Economic Area.
Analytics and advertising providers may process data outside the European Economic Area, including in the United States. Such transfers rely on an adequacy decision, such as the EU–US Data Privacy Framework, or on standard contractual clauses.
10. Retention periods
| What | How long |
|---|---|
| Contact form submissions and correspondence | Duration of the enquiry, followed by deletion |
| Newsletter subscriptions | Until you unsubscribe |
| Job applications | 2 years from application |
| Client contracts and agreements | Duration of the engagement + 10 years |
| Invoices and accounting records | 7 years (Swedish Bookkeeping Act) |
| Analytics data | 2 months (Google Analytics user-level data) |
| Advertising measurement data | As set by each advertising provider |
| Server and access logs | 30 days |
| Data in systems we run for clients | Duration of the contract + 30 days, then deleted or returned |
When a retention period expires, data is deleted securely. Data held in automated backup rotations is not individually purged; those backups expire on their own schedule within 30 days.
11. Security measures
We encrypt personal data at rest (AES-256) and in transit (TLS 1.3). Access is role-based and granted on a need-to-know basis, multi-factor authentication is required for remote access, and access to production systems is logged and reviewed periodically. Backups are encrypted.
All personnel are bound by confidentiality obligations and complete data protection training.
12. Automated decision-making
We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you.
Our AI systems provide decision support. Recommendations are subject to human review before action is taken. Any change to this practice will be reflected in this policy before implementation, including the rights to obtain human intervention, express a point of view and contest a decision.
13. Data subject rights
Under the GDPR, data subjects may request access, rectification, erasure, restriction of processing and data portability. They may object to processing based on legitimate interests and withdraw consent at any time through the cookie settings or by email.
Write to info@solvigo.ai. Requests are answered within 30 days. For complex or extensive requests, this period may be extended by up to 60 days. Any extension and its reasons will be communicated within the initial 30-day period.
Identity verification may be required before a request is processed to prevent unauthorised disclosure. Where a request cannot be fulfilled, including due to statutory retention requirements, the scope and reasons for refusal will be provided.
You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se.
14. Personal data breaches
We maintain an incident response plan. If a personal data breach occurs and it is likely to result in a risk to individuals, we notify the Swedish supervisory authority within 72 hours as required under art. 33, and we notify affected individuals directly where the risk is high (art. 34). Clients are notified without undue delay, within the timeframe specified in the applicable agreement.
15. Policy amendments
This policy will be updated to reflect changes to data collection or processing purposes. Where changes affect cookie consent, renewed consent will be requested.