Privacy Policy

1. Who we are and what this policy covers

Abundly AI AB ("Abundly", "we") runs the Abundly platform, where businesses build and use AI agents. We are a Swedish company, corporate identity number 559437-5510, Norrtullsgatan 6, 113 29 Stockholm, Sweden.

Abundly is a service for businesses. Who decides what happens to personal data depends on whose data it is and why we hold it. This policy therefore has two parts:

• Part A (sections 2–3): data we are responsible for. We are the controller for account, sign-in, billing and usage data about everyone who uses Abundly, and for our website.
• Part B (sections 4–5): content we process for our customers. Our customers decide what their agents do with personal data. They are the controller, and we process the data on their behalf under our Data Processing Agreement ("DPA") or a DPA signed with them.

Sections 6–13 apply to both parts. Words such as "Subscriber", "Subscriber Content" and "Usage Data" have the meaning given in our Terms of Service.

2. Data we collect about everyone who uses Abundly

We collect the following about every user, whether they sign up themselves or are invited by a customer:

• Account data: name, email address, organisation, workspace, role and settings.
• Sign-in data: you sign in with Google, Microsoft or a one-time code sent to your email. We receive your name, email address and account identifier from Google or Microsoft. We do not store passwords.
• Billing data: billing name and address, VAT number, plan, invoices and payment status. Card details are handled by Stripe; we never see or store full card numbers.
• Usage Data: how the Services are used, such as login frequency, session length, features used, navigation and volume of activity, and anonymised descriptions of the type of task performed. Usage Data never includes the substance of your content.
• Log and security data: IP address, browser and device information, timestamps, and error and audit logs.
• Communications: support requests, feedback and other messages you send us. A support case can include content you choose to share with us.
• Website data: information collected through cookies and similar technologies on abundly.ai, as described in our cookie notice, and details you give us when you sign up for newsletters, events or courses.

3. How we use it and our legal bases

3.1 Purposes and legal bases

Where we rely on legitimate interests, you have the right to object (section 10).

3.2 Usage Data

Usage Data may be linked to individual users. We use it only to operate, support, develop and improve the Services. We share it outside Abundly only in aggregated and anonymised form from which neither our customers nor individual users can be identified.

3.3 No training on your content

We do not use your content, or any customer's content, to train, fine-tune or otherwise improve AI models. Neither do the AI providers we use (section 5).

3.4 No automated decisions

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

4. Content we process under the DPA

Our customers are the controllers of the personal data in their content. We process it only on their instructions, under our DPA or a DPA signed with them.

This covers everything in a customer's workspace: agent instructions, documents and files, conversations, agent memory and outputs, data agents read from or write to connected systems, and audio or files submitted for transcription. It also covers that content when a customer shares it with us in a support case.

For this content:

• The customer decides what is processed and why, and is responsible for having a legal basis and informing the people concerned.
• We do not use it for our own purposes, and neither we nor our sub-processors use it to train AI models.
• The customer chooses which AI providers and capabilities its agents use (section 5).
• If your personal data is in a customer's workspace and you want to exercise your rights, please contact that customer. If you contact us, we will pass your request on to them.

Part A still applies to the account, sign-in, billing and Usage Data of the customer's users.

5. AI providers and capabilities your agents use

To answer and act, your agents send prompts and the content they work on to an AI model provider. Depending on the provider used, this can take place outside the EU. Which provider new agents use by default, and which provider each agent uses, is shown and can be changed in your workspace settings.

Capabilities you turn on, such as web search, phone and SMS, speech-to-text and text-to-speech, document conversion and sandboxes, send the content they need to the provider of that capability. The current providers, what they process and where are listed on our sub-processor page.

We hold the contracts with these providers. They may not use your content to train their models, and we configure each one for the shortest retention it offers: no more than 30 days, and zero retention where available.

6. Who we share data with

We do not sell personal data. We share it only with:

• Service providers that run the platform and our business for us, such as hosting and databases, email delivery, our email and support inbox, internal communication and collaboration tools, and monitoring tools. They act on our instructions.
• AI model providers and capability providers your agents use, as described in section 5.
• Payment processors, which handle payments for us. Our payment provider, Stripe, also acts as an independent controller for fraud prevention and its own legal obligations, under its privacy policy.
• Advisers and authorities: lawyers, auditors and accountants under confidentiality, and authorities where the law requires it.
• Advertising partners, who receive data from our marketing cookies when you have consented and use it under their own privacy policies.
• A buyer or successor, if all or part of our business is sold or merged, under the same protections as in this policy.

7. International transfers

Our platform and its databases are hosted in the EU. Data leaves the EU/EEA mainly when your agents use an AI provider or capability located elsewhere, as listed on our sub-processor page. For each such transfer we rely on an adequacy decision of the European Commission, including the EU–US Data Privacy Framework where the recipient is certified, or on the Commission's standard contractual clauses. You can ask us for a copy of the safeguards used.

8. How long we keep data

You can export your content before you leave, using the export function in the Services.

Backups. Deleted data may remain in our backups until they expire: no later than nine months after deletion for database backups, and no later than 180 days for file backups. Backups are encrypted, used only to restore the platform after a failure, and never used to bring deleted data back into the live service. Enterprise customers may have agreed different periods in their own DPA.

9. Security

We run an information security management system certified under ISO/IEC 27001. Data is encrypted in transit (TLS 1.2 or higher) and at rest. Access to production systems is limited to named staff, follows least privilege and uses multi-factor authentication. Customer workspaces are logically separated, and our systems are monitored continuously.

If a personal data breach affects data we control, we notify the Swedish Authority for Privacy Protection (IMY) and, where required, the people affected. For Part B data we notify the customer within 72 hours, or sooner where agreed.

Please report security issues to security@abundly.ai.

10. Your rights

For data we control, you can ask us to:

• give you access to your personal data and a copy of it;
• correct inaccurate data;
• delete your data;
• restrict our processing;
• give you your data in a portable format;
• stop processing based on legitimate interests, including all marketing;
• withdraw any consent you have given, without affecting earlier processing.

We answer within one month. Some rights are limited by law, for example where we must keep billing records. For Part B data, see section 4.

You can complain to the Swedish Authority for Privacy Protection (IMY) or the data protection authority where you live or work.

11. Children

Abundly is not for anyone under 18. We do not knowingly collect data from children, and we delete it if we learn we have.

12. Changes to this policy

We will tell you about material changes before they take effect, by email or in the Services, and state the date they apply from. The date at the top shows when the policy was last updated.

13. Contact

Abundly AI AB, Norrtullsgatan 6, 113 29 Stockholm, Sweden.

Privacy questions and requests: support@abundly.ai.
Security reports: security@abundly.ai.