Privacy Policy

1. Who We Are

AIME is provided by ClayStack AB (org. nr. 559586-4876), Bygatan 3, 171 49 Solna, Sweden (“we”, “us”). If you have questions about how we process personal data, or want to exercise your rights, contact us at chris@aime-app.co or by post at the address above.

2. Our Two Roles

Our role depends on which data is concerned:

• Controller. For data about you as a customer or user – your account, your profile, billing, your contact with us and technical information about how the Service is used. This policy mainly describes that processing.
• Processor. For the content our customers put into AIME – for example documents and photos, personnel registers and certificates, QR site sign-ins, permit signatures and details of external reviewers. Here the customer (the company using AIME) is the controller, and we process the data only on the customer's behalf under our Data Processing Agreement.

So if you have signed in on a site, signed a permit, are listed in a company's personnel register or have been asked to review a document, the company using AIME is responsible for your data. Please contact that company first with questions and requests. If you contact us, we will help and pass your request on to the right company.

3. What Data We Process and Where It Comes From

Where we are the controller, we process:

• Account data: email address and password. The password is handled by our authentication provider and is not stored in plain text.
• Profile and company data: name, organisation and project name, company email, website, address and organisation number, contact person and phone number, logo, brand colour, certifications, country and trade, and the instructions and preferences for the AI that you enter. If you upload company documents to tailor the Service, we keep a summary of them. We also record when you were last active.
• Teams and partner programme: email addresses of people you invite to your team and their role. For members of our partner programme: name, email address, referral code and commission records.
• Payment data: Stripe customer and subscription IDs, plan, subscription status and invoices. Card details are handled only by Stripe – we never see or store them.
• Technical and usage data: IP address, browser information and request logs recorded by our hosting and database providers; cookieless, aggregated visitor statistics; and counters of AI requests.
• Communications: what you write to us, for example by email.

This data comes from you, from whoever invites you to a team, from Stripe (payment status) and – if you connect that integration – from Autodesk. An email address and password are needed to create an account, and payment details are needed for paid plans. Other profile fields are optional, but some features, such as company details on exported PDFs, do not work without them.

Content that you and your colleagues create or upload – including personal data about other people – is processed by us as a processor (see section 2). We do not use that content for our own purposes.

4. Why We Process Data and Our Legal Bases

• Providing the Service: creating and managing your account, storing your documents and settings, and carrying out the features you use, including AI analysis, generation and translation. Legal basis: contract (Art. 6(1)(b) GDPR).
• Subscriptions and payments: managing plans, payments and invoices through Stripe. Legal basis: contract.
• Bookkeeping: keeping invoices and payment records. Legal basis: legal obligation (Art. 6(1)(c)), the Swedish Bookkeeping Act (bokföringslagen 1999:1078).
• Service emails: emails about your account and the Service, such as reminders about expiring documents, invitations, approvals and information about your trial and upgrading. Legal basis: legitimate interest (Art. 6(1)(f)) in keeping you informed about the service you use. You can turn off trial and upgrade emails at any time on the Email preferences page, with your email app's unsubscribe button, or by contacting us. Emails needed for the Service to work, such as invitations and approvals, are still sent.
• Security and operations: preventing abuse and unauthorised access, limiting the number of AI requests, troubleshooting and keeping the Service stable. Legal basis: legitimate interest in a secure, working service.
• Improving the Service: understanding how features are used through aggregated visitor statistics. Legal basis: legitimate interest in developing the Service. You can object to this.
• Partner programme: managing referral codes and paying commission. Legal basis: contract with the partner, and legal obligation for the bookkeeping.
• Support: answering your questions. Legal basis: legitimate interest, or contract where the question concerns your subscription.
• Legal claims: establishing, exercising or defending legal claims. Legal basis: legitimate interest.

We do not currently rely on consent as a legal basis. Where we rely on legitimate interest, we have concluded that our interest outweighs the impact on your privacy, because the processing is limited and of a kind you would reasonably expect. Contact us if you would like to know more about that assessment. We do not sell personal data or use it for advertising.

5. AI Processing

AIME uses Anthropic's AI models (Claude) through Anthropic's API to analyse documents, produce drafts and translate. When you use these features, the documents you upload are sent in full, together with the text needed – such as document content and your AI instructions – to Anthropic PBC in the USA. If that material contains personal data about you or others, it is included.

Under Anthropic's commercial terms, inputs and outputs sent through the API are not used to train Anthropic's models, and those terms include a data processing addendum with the EU Standard Contractual Clauses. Anthropic may keep data for a limited period under its own terms, for example to detect misuse. See Anthropic's Privacy Policy.

Only upload sensitive personal data (such as health information) or national identity numbers where this is genuinely necessary and lawful. What the AI produces is always a draft for you to review (see section 10).

6. Recipients and Sub-processors

We use the following providers. They process data on our behalf – or, for customer content, as our sub-processors – and are bound by contracts that limit their use of it to providing their services to us.

For some purposes, such as fraud prevention and payment-services regulation, Stripe acts as an independent controller. Stripe's Privacy Policy applies to that processing.

Data is also shared when you choose to share it, for example when you share a document by link, send it for approval or invite a colleague – the recipient then sees what you share. We may also disclose data to authorities where the law requires it, and to advisers such as auditors, who are bound by confidentiality.

7. Transfers Outside the EU/EEA

Our database and file storage are located in the EU. Some of our providers are based in the USA (see the table above). Those transfers rely on the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework, where the provider is certified under it. Contact us if you would like more information about these safeguards or a copy of them.

8. How Long We Keep Data

• Account, profile and settings: for as long as the account exists. When you delete your account (Profile → Delete account), the account and its associated data and files are deleted.
• Content entered by customers (documents, files, personnel registers, sign-ins and signatures): for as long as the customer keeps it in their account. It is deleted when the customer removes it or deletes the account, as set out in the Data Processing Agreement.
• Accounting records (invoices, payments and commission records): seven years from the end of the calendar year in which the financial year ended, as required by the Swedish Bookkeeping Act. This applies even if the account has been deleted.
• Team invitations: for as long as the invitation or team membership exists.
• AI request counters: cleared after one hour.
• Emails to us: for as long as needed to handle the matter and any follow-up.
• Provider logs and backups: according to each provider's retention periods. Deleted data may therefore remain in backups for a period until they are overwritten.

9. Your Rights

Under the GDPR you have the right to:

• access the data we hold about you and receive a copy of it
• have inaccurate data corrected – you can change most of it yourself in your profile
• have data erased – you can delete your account yourself in your profile. Data we are required by law to keep, such as accounting records, is deleted when the retention period ends
• restrict processing, for example while we check whether data is accurate
• object to processing based on legitimate interest, such as visitor statistics and trial and upgrade emails
• data portability – receive the data you have provided in a structured, machine-readable format. You can download your data from the profile page (“Download my data”) or ask us for a copy by email
• withdraw consent – where processing is based on consent, you can withdraw it at any time, without affecting processing carried out before you withdrew it
• complain to a supervisory authority – in Sweden the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se, or the authority in the EU country where you live or work

To exercise your rights, contact us at chris@aime-app.co. We respond within one month. If a request is complex, this can be extended by a further two months; we will tell you if so. We may need to confirm your identity before disclosing data.

If your question concerns data that a company has entered about you in AIME, such as a sign-in or an entry in a personnel register, please contact that company. We will help the company respond to your request.

10. Automated Decision-Making

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. The AI features produce drafts, analyses and translations that a person reviews and decides on.

11. Security

We protect data with measures including encryption in transit (HTTPS/TLS), authentication and access control, row-level security in the database so that each account can only reach its own data, access-restricted file storage, least-privilege access for anyone with operational access, hard-to-guess links for sharing and site sign-in, limits on AI requests, and backups and logging at our providers. No service is free of risk, so only share document links with the people who should see them.

12. Personal Data Breaches

If a personal data breach occurs involving data we are responsible for, we will notify IMY within 72 hours where the law requires it. If the breach is likely to result in a high risk to you, we will also inform you without undue delay. Where a breach involves customer content, we will notify the customer concerned as set out in the Data Processing Agreement.

13. Cookies and Local Storage

We do not use tracking or advertising cookies. What we use is:

• Sign-in cookies (Supabase): necessary to keep you signed in. They are removed when you sign out.
• locale: remembers your language choice. Set when you switch language and lasts one year.
• aps_oauth_state: a temporary security cookie (10 minutes), set only when you connect your Autodesk account.
• Local storage in your browser (localStorage): remembers, for example, which items you have ticked in Radar checklists and whether you have dismissed a tip. This stays on your device.

Visitor statistics from Vercel Web Analytics are collected without cookies and reported in aggregate. Because we only use storage that is necessary for the Service or that you ask for, no cookie consent is required. When you pay on Stripe's checkout page, Stripe's own cookies and terms apply.

14. Children

AIME is intended for professionals and is not aimed at anyone under 18. We do not knowingly collect data about children for our own purposes. If a customer records data about minors, such as apprentices signing in on a site, the customer is responsible for that processing.

15. Changes to This Policy

We update this policy when the Service or the law changes, and the date at the top shows when it was last changed. For material changes we will notify you by email well before the change takes effect. If a change requires your consent, we will ask for it.

16. Contact

ClayStack AB, Bygatan 3, 171 49 Solna, Sweden · chris@aime-app.co

See also our Terms of Service and our Data Processing Agreement.