Privacy policyHow we handle personal data in Verkio.

This is a translation. If it differs from the Swedish version, the Swedish version applies. Verkio is run by North Coast Education AB, which is the controller of the data described here. Our contact details are at the bottom of the page.

We process only what is needed to run Verkio and keep the service secure.

• Account: email address, name, which organisations you belong to and your role in them. If you sign in with Microsoft, we receive your name and email address from Microsoft.
• Trial: the company name and the email address that started the trial.
• Payment: the company's name, address, VAT number and billing email, which plan the organisation has and what it has paid. You give card details directly to Stripe, and we never see the card number.
• Sign-in and security: IP address, browser and the times of sign-ins and other events in the account.
• Usage: who has done what in Verkio, for example who approved a risk, and how much the AI assistant has been used.
• Contact: name, email address, company and what you write when you contact us or register your interest. When you register your interest, we also store a code derived from your IP address, so that no one can send an unlimited number of registrations. The address cannot be recovered from the code.
• Agreements: when you sign an agreement with us in Verkio, we store your name, job title and email address, and when, from which IP address and with which browser the agreement was opened and signed. This also applies if you sign without having a Verkio account.
• Visits to the website: if you accept analytics cookies, Google Analytics collects which pages you visit, how you found us, roughly where you are and which device and browser you use. Never in the app.

• To give you and your organisation access to Verkio. Legal basis: the contract with your organisation and our legitimate interest in giving its users access.
• To keep the service secure and detect misuse. Legal basis: legitimate interest.
• To monitor costs and limits, for example the AI quota during a trial. Legal basis: legitimate interest.
• To take payment and send invoices. Legal basis: the contract with your organisation, and the Swedish Accounting Act (bokföringslagen) for invoices and payments.
• To reply when you contact us and to email you about your account, for example before a trial ends. Legal basis: legitimate interest.
• To enter into agreements with customers and be able to show what was agreed and who signed. Legal basis: the agreement, and our legitimate interest in being able to prove it if it is disputed.
• To see how the website is used and improve it. Legal basis: your consent, which you can withdraw at any time on the cookies page.

We never sell personal data and do not use it for advertising.

Machine descriptions, documents, risks and chats belong to your organisation. Where they contain personal data, for example a name on a drawing or the person responsible for a measure, your organisation is the controller and we are the processor. We then process the data in accordance with the terms and only to provide Verkio.

We at Verkio do not read your content. If you need help, an admin in your organisation can give us read access for a limited time, and every visit is logged.

We do not train any AI models on your content. Approved risks are shared anonymously with other customers, so that the assistant can suggest them for similar machines. Before that, an AI model removes names of companies, products and people and details that could identify you, and a person at Verkio reviews every text. No other customer can see where a risk came from.

A customer's admin can turn off sharing on the Organisation page. What the organisation has shared then stops being shown to others. We keep the anonymised version, so that it comes back if sharing is turned on again, and delete it when the risk or the organisation is deleted. During a trial, approved risks are always shared, and what has been shared remains when the trial is deleted, because it cannot be linked to you.

When you use the assistant, the parts of your material needed for the question are sent to an AI model. The provider does not store the material and does not train its models on it.

The database, files and search index are in Stockholm, and the servers that process them are there too.

Some of our suppliers are US companies, and the AI models may run outside the EU. When personal data is transferred to a country outside the EU and EEA, it is protected by the European Commission's standard contractual clauses or by the EU–US Data Privacy Framework.

We use suppliers that process data on our behalf, and only on our instructions:

• Supabase: database, sign-in and file storage.
• Vercel: hosting of the website and the app, and routing of requests to AI models.
• AI providers, for example Anthropic: answers and suggestions from the assistant.
• An email service: sign-in codes and other emails from Verkio.
• Stripe: payment, invoices and VAT. Stripe also processes the data to prevent fraud, and is itself responsible for that.
• Google: visitor statistics for the website, if you have accepted analytics cookies.

Authorities receive data only when the law requires it.

• Account: for as long as you have an account. You can ask us to delete it at any time.
• Trial: if you do not become a customer, we delete the organisation and its content 30 days after the trial has ended.
• Customers: we delete the organisation's content 30 days after the agreement has ended, unless we have agreed otherwise.
• Change history: as long as the content it relates to.
• Contact and registrations of interest: no more than two years after the most recent contact.
• Visitor statistics: 14 months in Google Analytics.
• Invoices and payments: seven years, as the Swedish Accounting Act requires.
• Signed agreements, with the signatures and the log of when they were sent, opened and signed: ten years after the organisation has been deleted, as they may be needed if the agreement is disputed. Agreements that were never signed are deleted with the organisation.

Deleted data may remain in backups for a short time before it is overwritten.

In the app, Verkio uses only necessary cookies: so that you can sign in, and to remember which organisation you are working in, whether the sidebar is expanded and which notices you have closed.

On the website, we use analytics cookies from Google Analytics if you accept them. We do not use any cookies for advertising.

Which cookies these are, how long they last and how to change your choice are set out on the cookies page.

You have the right to know what data we hold about you, to have errors corrected and to have data erased. You can also ask us to restrict processing, object to it and receive your data in a machine-readable format.

If it concerns content your organisation has uploaded, contact the organisation first. We help it respond.

Email us if you want to exercise your rights. If you are not satisfied with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se.

We update the policy when the service or the law changes, and the date at the top shows when that last happened. For significant changes, we email users.