1. Introduction
Formivera ("we", "us", "our") is operated by JLP Ventures AB (org. nr 559580-4948). We are committed to protecting the privacy of our users ("you"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.
Formivera acts as a data processor on behalf of construction consultancies (data controllers) who use our platform to manage their projects and client relationships. This policy covers both consultancy users and their end clients.
Our registered company details are available via Bolagsverket (the Swedish Companies Registration Office).
2. Data We Collect
Account Data: Name, email address, organization name, and role when you create an account.
Usage Data: Pages visited, features used, browser type, IP address, timestamps. Collected for product improvement and security.
Project Data: Data entered by consultancies about their projects and clients, including names, contract details, inspection findings, documents, invoices, and reports. This data is owned by the consultancy.
Payment Data: Processed by Stripe. We do not store credit card numbers. We store Stripe customer and subscription IDs for service delivery.
AI Processing Data: When generating briefings and reports, we send project data to the Anthropic API. Contract documents are processed for data extraction. No data is used to train AI models.
3. Legal Basis for Processing (GDPR Art. 6)
We process your personal data based on the following legal grounds:
Performance of contract (Art. 6(1)(b)): Processing necessary to provide the Formivera service you subscribed to — account management, project data, document generation, invoicing.
Legitimate interest (Art. 6(1)(f)): Platform security, fraud prevention, service improvement, and aggregated analytics. We balance our interests against your rights.
Legal obligation (Art. 6(1)(c)): Retention of financial records for 7 years per Swedish Bookkeeping Act (BFL 7 kap 2§).
4. How We Use Your Data
We use your data to: provide and maintain the service, process payments, send transactional emails (invoices, document deliveries, notifications), improve the platform, ensure security, and comply with legal obligations.
We do not sell your data. We do not use your data for advertising. We do not share your data with third parties except as described in this policy.
5. Data Storage & Security
Data is stored in the EU (Frankfurt, Germany) using Supabase (hosted on AWS eu-central-1). All data is encrypted at rest (AES-256) and in transit (TLS 1.3).
Access to production data is restricted to essential personnel with multi-factor authentication. We implement security headers (HSTS, CSP, X-Frame-Options) and rate limiting on all API endpoints.
6. Third-Party Services
We use the following sub-processors:
Supabase (database, authentication, file storage) — EU region, Frankfurt.
Vercel (hosting, serverless functions) — global edge network.
Stripe (payment processing) — PCI DSS Level 1 compliant.
Anthropic (AI briefings and report generation) — data processed per their API terms, not used for model training.
Resend (transactional email delivery).
Sentry (error tracking and diagnostics) — collects error stack traces, browser information, and pseudonymized IP addresses solely for debugging. Data is not used for profiling or advertising.
ConvertAPI / Baltsoft (Lithuania — DOCX to PDF conversion for documents sent to recipients).
Upstash (rate limiting — serverless Redis; processes IP addresses).
7. Your Rights (GDPR)
Under the EU General Data Protection Regulation, you have the right to: access your data, rectify inaccurate data, erase your data ("right to be forgotten"), restrict processing, data portability (export), object to processing, and withdraw consent.
To exercise these rights, use the data export and deletion features in your account settings, or contact us at privacy@formivera.se.
Data Export: Available in Settings. You can download your personal data directly in JSON and CSV format.
Data Deletion: Available in Settings. Deletion is immediate and permanent — your account and personal data are removed right away. Financial records are retained anonymized for 7 years per Swedish accounting law (BFL).
8. Data Retention
Active account data is retained while the account is active. Deleted accounts are anonymized or removed immediately upon request. Invoice and financial data is retained for 7 years per legal requirements. Audit logs are retained for 12 months. Database backups are retained for 7 days.
9. Cookies
We use essential cookies for authentication and session management. We use functional cookies for preferences (language, UI state). No advertising or tracking cookies are used.
10. Changes to This Policy
We may update this policy with 30 days notice via email and in-app notification. The latest version is always available at this page.
11. Supervisory Authority
The Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) is the supervisory authority for data protection in Sweden. You have the right to lodge a complaint with IMY if you believe your data is being processed unlawfully.
IMY: imy.se | dataskydd@imy.se
12. Governing Law
This Privacy Policy is governed by Swedish law and the EU General Data Protection Regulation (GDPR).
13. Contact
For privacy inquiries: privacy@formivera.se
Data processor: JLP Ventures AB (org. nr 559580-4948). When you use Formivera for your consultancy, you are the data controller for your clients' data, and we act as your data processor. For your own account data, we are the data controller.