Privacy Policy

What personal data we process in AIConscius, why, and what you can do about it.

AIConscius is a service of AISocius AB (in formation). Company registration details will be published here once incorporation is complete.

Contact: privacy@aisocius.com

Last updated: 2026-07-25

Draft — not yet in force. AISocius AB is in formation and this text has not been reviewed by a qualified lawyer. It describes what we intend to do and what the product actually does today, so that it can be checked before anything is sold. Do not rely on it as a contract.

Who is responsible

AISocius AB is the controller for the personal data described here. AIConscius is one of its applications. If you are an advisor using AIConscius to assess systems for your own clients, you are normally the controller for the client data you enter, and we act as your processor for it — a data processing agreement governs that relationship and must be in place before you upload client material.

What we process

Account data. Email address, name if you provide one, authentication identifiers, and the organisation and role you hold in the workspace.

Content you enter. Descriptions of AI systems, roles, purposes, the answers you give during an assessment, evidence you upload, review decisions and the reasons recorded for them. This may contain personal data if you choose to put it there — for example, the name of a system owner or a reviewer.

Operational data. Audit records of who changed what and when, which we keep deliberately: without them an assessment cannot be defended.

We do not sell personal data, and we do not use your content to train models.

Legal basis

Account and content processing rests on performance of the contract with you (Art. 6(1)(b) GDPR). Audit records, security logging and abuse prevention rest on our legitimate interest in operating a defensible and secure service (Art. 6(1)(f) GDPR). Where we ask for consent — for example, to be named publicly as a design partner — you can withdraw it at any time without affecting anything else.

Who else is involved

We use processors to run the service. As of the date above these are our hosting provider, our database and authentication provider, and, where a feature uses a language model, the model provider serving that feature.

To be completed before launch: the named list of subprocessors, their location, and what each one receives. Naming them accurately requires the final production deployment to be fixed; publishing a list we then change would be exactly the sort of unverified claim this product exists to avoid.

Where data is processed

We intend to keep processing within the EU/EEA. Where a subprocessor operates outside it, we will name the country and the transfer mechanism here rather than assert EU-only processing in general terms. Until that list is final, treat this section as a statement of intent, not a guarantee.

How long we keep it

Account data for as long as the account exists, and for a limited period afterwards to handle disputes and meet Swedish bookkeeping obligations. Assessment content and its audit trail for as long as you keep the workspace, because an assessment without its history is not evidence. You can ask us to delete a workspace; we will tell you what we are legally required to retain and for how long.

Your rights

You can request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. Write to privacy@aisocius.com and we will respond within one month.

If you are unhappy with how we handled it, you can complain to the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY), or to the authority where you live or work.

Changes

When this policy changes materially we will update the date at the top and tell account holders. Superseded versions are kept so you can see what applied when.