|
Legal
Effective as of 2026-07-03. Version 1.0.
Chapter 1
Styrke is currently operated as a company in formation. Until Styrke AB (or an equivalent corporate form) is registered, Ebbe Andersson Mårtensson is the data controller for the processing described below, in his capacity as founder and business operator. Upon registration of the company, the company assumes responsibility, and this policy will be updated with the company registration number.
Contact: styrkeab@gmail.com
When you visit styrke.eu, we may process:
Information from an inquiry or meeting booking that does not result in a customer relationship is normally retained for no more than 12 months after the most recent contact. If you become a customer, our data processing agreement and general terms instead apply to the subsequent processing.
We use subcontractors to operate the website and manage meeting bookings, such as providers of hosting, meeting-booking tools, and email. They process information only on our behalf and subject to confidentiality. We never sell your information.
Some of our providers may process information in the United States. Such transfers take place only on the basis of a valid transfer mechanism, either because the recipient is certified under the EU-US Data Privacy Framework, or through the European Commission's Standard Contractual Clauses together with supplementary safeguards.
You have the right to request access to, rectification or erasure of, or restriction of processing of your information, as well as the right to object to processing and the right to data portability. Contact us at the address above to exercise your rights. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY).
Chapter 2
Privacy Policy for the Styrke product. Effective as of 2026-10-29. Version 1.2.
1.1 This privacy policy describes how Styrke ("Styrke", "we", "us") processes personal data about you when you visit our website, contact us, book a meeting with us, or use the Styrke service (the "Service").
1.2 Styrke currently operates as a company in formation and therefore has no company registration number. Until Styrke AB (or an equivalent company form) is registered, Ebbe Andersson Mårtensson is the data controller for the processing described below, in his capacity as founder and business operator. Upon company registration, the company automatically assumes responsibility, and this policy is updated with its registration number.
1.3 Styrke is the data controller for the processing described in this policy, that is, processing we carry out for our own purposes. When we process personal data on behalf of a customer within the Service, we instead act as a data processor, and that processing is governed by a separate data processing agreement between us and the customer.
1.4 We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and other applicable data protection legislation.
Ebbe Andersson Mårtensson, for Styrke (in formation)
Glödgarevägen 2
Email: styrkeab@gmail.com
If you have questions about how we process your personal data, or wish to exercise your rights under section 8, you can contact us at the address above.
We process personal data in the following situations:
Information: technical information such as IP address, browser type, device information, and information about how you use the website, to the extent you have consented to non-essential cookies (see section 7).
Purpose: to provide and secure the website and, where consent is given, to analyse and improve it.
Legal basis: our legitimate interest in providing a secure and functional website (Article 6(1)(f)), and your consent regarding non-essential cookies (Article 6(1)(a)).
Information: name, email address, telephone number, company name, job title, and the content of your inquiry.
Purpose: to handle your inquiry, arrange and hold meetings, and communicate with you about our services.
Legal basis: our legitimate interest in responding to and handling inquiries and conducting sales (Article 6(1)(f)), or taking steps at your request prior to a possible contract (Article 6(1)(b)).
Information: name, email address, job title, and information relating to administration of the customer relationship and your user account.
Purpose: to administer the agreement with the customer, provide and secure the Service, manage accounts and permissions, and communicate about the Service.
Legal basis: our legitimate interest in administering the customer relationship and providing the Service to the customer you represent (Article 6(1)(f)), and performance of the agreement with the customer (Article 6(1)(b)).
Information: name and email address.
Purpose: to send relevant information, newsletters, and offers concerning our services.
Legal basis: our legitimate interest in marketing our services to existing and potential business customers (Article 6(1)(f)), or your consent where required (Article 6(1)(a)). You can unsubscribe from communications at any time.
Information: information in records that we are required by law to retain, for example under the Accounting Act.
Purpose: to fulfil legal obligations, such as accounting and tax legislation.
Legal basis: legal obligation (Article 6(1)(c)).
4.1 We primarily collect personal data directly from you, for example when you book a meeting, contact us, or use the Service.
4.2 If you are a user at one of our customers, we may receive your information from the customer you represent, for example when a customer administrator invites you as a user.
4.3 To a limited extent, we may supplement information with information from publicly available sources, such as public company registers, in connection with sales and business communications.
5.1 We retain personal data only for as long as necessary for the purposes set out in this policy, or for as long as we are required by law to retain it.
5.2 The following periods apply as guidance:
5.3 When the personal data is no longer needed, it is deleted or anonymised.
6.1 We share personal data with providers that process information on our behalf (data processors), for example providers of operations, storage, email distribution, and AI functionality. They may process the information only in accordance with our instructions and subject to confidentiality.
6.2 Our main categories of providers include:
6.3 We may disclose personal data if required to do so by law, court order, or government decision, or to protect our rights.
6.4 We do not sell your personal data.
7.1 Some of our providers may process personal data in countries outside the EU/EEA, primarily the United States.
7.2 When such a transfer takes place, we ensure that a valid transfer mechanism under Chapter V of the GDPR is in place, either because the recipient is certified under the EU-US Data Privacy Framework, or because the transfer is made under the European Commission's Standard Contractual Clauses (SCCs) together with supplementary safeguards such as encryption and access restrictions.
7.3 You can contact us for more information about the safeguards applied and, where possible, to obtain a copy of the relevant clauses.
8.1 Under data protection legislation, you have the following rights concerning our processing of your personal data:
8.2 To exercise your rights, contact us using the details set out in section 2. We will respond to your request without undue delay and no later than within one month.
9.1 If you believe that we process your personal data in breach of applicable legislation, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), the supervisory authority in Sweden, or with the supervisory authority in the EU country where you live or work.
10.1 We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or other unlawful processing. These measures include encryption, access control, and logging.
11.1 We may update this privacy policy. The latest version is always available on our website. We will inform you appropriately of material changes, for example via the website or email.
12.1 Permissions we request. If you connect your Google account to Styrke, we request only the following:
12.2 How we use the information.
12.3 Storage. Google access tokens are stored encrypted (AES-256-GCM) in our database within the EU. Events from your calendar are stored in the same database.
12.4 Sharing and limitations. Google data is shared only with the data processors required for the functions above: operations, database, and AI language models. We never sell it, use it for advertising, or use it to create, train, or improve AI models. No one at Styrke reads it except with your explicit consent, when required for security reasons, or as required by law.
12.5 Revocation and deletion. When you disconnect Gmail or Google Calendar in Styrke, we revoke access through Google and delete the stored access tokens. Disconnecting Google Calendar also deletes the imported events and the customer events Styrke created from them. The same happens if Styrke detects at the next sync that you have revoked access through Google. You can revoke Styrke’s access to your Google account at any time at myaccount.google.com/permissions . If you want us to delete other data obtained from Google, contact us as described in section 2, and we will delete it without undue delay and within one month.
12.6 Limited Use. Styrke’s use and transfer to other apps of information received from Google APIs complies with Google API Services User Data Policy and Google Workspace API User Data and Developer Policy , including the Limited Use requirements.
Styrke requests permission to send email via Gmail on the user's behalf, read-only access to events in the user's primary Google Calendar, and the user's email address. Styrke cannot read, search or delete Gmail messages, and cannot create, change or delete calendar events. Email is sent from the user's account only with the user's approval: either the user approves the specific draft in Styrke, or the user's company has allowed Styrke to send certain kinds of email without approving each one, such as replies to certain incoming emails when Styrke is sufficiently confident, or fixed out-of-office replies. Everything Styrke sends is visible in Styrke afterwards. Calendar events (title, description, time, location and attendees) are imported when the user starts a sync, are visible only to that user by default, and are used as context for Styrke's AI features, which means they are processed by our AI model providers acting as data processors. OAuth tokens are encrypted at rest (AES-256-GCM) in a database in the EU. Google user data is never sold, never used for advertising, and never used to create, train or improve AI models. Disconnecting Gmail or Google Calendar revokes access at Google and deletes the stored tokens. Disconnecting Google Calendar also deletes the imported events and the customer events Styrke created from them, and the same happens if Styrke detects at the next sync that access has been revoked at Google. Users can revoke access at any time at myaccount.google.com/permissions, and can ask us to delete other data obtained from Google by contacting us at the address in section 2. Styrke's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Styrke (in formation) · Ebbe Andersson Mårtensson · Glödgarevägen 2 · styrkeab@gmail.com