This privacy policy describes the types of personal data Ginsi may process, the technical purposes for that processing, and how data subjects can exercise their rights. The policy does not constitute a data processing agreement and does not approve a general legal basis, retention period, transfer mechanism, or provider region. These details must be established and documented for the processing in question before real customer or respondent data is put into use.
1. Data controller
Ginsi AB (company registration no. 559581-0523), Stockholm, Sweden. Email: privacy@ginsi.se.
Ginsi AB is the data controller when Ginsi determines the purposes and means of processing, for example for its own account, security, and contact administration. When a customer organization determines the purposes and means and Ginsi processes data only in accordance with documented instructions, the customer is the data controller and Ginsi is the data processor. The exact allocation of roles and any data processing agreement must be established separately before such processing begins.
2. What data may be processed?
2.1 Organization users
- Organization name, registration number, and contact details
- Account information, invitations, roles, permissions, and preferences
- Survey content, responses, results, and analysis inputs belonging to the organization
- Selected session, security, and activity events where the respective function records them
- Subscription and product-access status, together with legacy Stripe identifiers and historical provider events retained for reconciliation and separate cleanup during account deletion. Ginsi does not store full payment-card details
The authentication provider handles login credentials. Ginsi's application does not store or display the user's password in plain text.
2.2 Respondents
The public response flow stores the survey identifier, responses, timing information, and technical completion status. It does not request the respondent's name or email address and does not store a raw IP address with the response. For rate limiting, the IP address is converted to a salted hash in a separate technical record.
Survey responses are therefore pseudonymous. Anonymity is not guaranteed. Free text written by respondents and attributes from specifically configured import paths may indirectly identify a person. Ginsi is designed to counteract the identification of individuals and to hide results for small groups, but this does not replace the customer's responsibilities for providing information and protecting data.
2.3 Website visitors
With your consent, Ginsi AB uses Google Analytics 4 on the public website at ginsi.ai to understand visits, referring websites and whether visitors open or submit a contact or demo enquiry. Google receives a browser identifier, the public page address without query parameters or fragments, a referring website origin, event timing and basic browser, device and approximate location information. The Google tag is not loaded before you agree.
Analytics does not run in signed-in workspaces, login, invitation or reset flows. We do not send form contents, names, email addresses or customer records to Google Analytics. Google Signals, advertising personalization, user-provided data collection and enhanced measurement are disabled. Optional account data sharing with Google is disabled.
Our legal basis for this website analytics is consent (Article 6(1)(a) GDPR). You can decline without losing access to the website or withdraw consent through Cookie settings in the footer or on the cookie policy page. Withdrawal stops future collection and removes this website’s Analytics cookies; it does not undo processing that was lawful before withdrawal.
Google processes Analytics data on our behalf under its data processing terms. Processing may take place outside the EU/EEA, including in the United States. Google describes its transfer safeguards, including the EU–US Data Privacy Framework and standard contractual clauses, in its linked transfer documentation. This is not a promise of EU-only storage.
Analytics cookies are configured for up to 60 days without renewal on each page load. User- and event-level data retention is set to two months, with renewal on new activity disabled. These controls do not set a deletion deadline for aggregated standard reports. Contact privacy@ginsi.se about access or deletion requests; we may need information that identifies your browser record.
Google data processing terms · Google transfer safeguards
Separately, the Ginsi application uses Vercel Web Analytics for page-view statistics. The application code excludes sensitive paths and paths containing tokens, removes query strings and fragments, and replaces survey identifiers in dashboard paths with a placeholder before an event is sent. Infrastructure providers may still process technical traffic metadata at the network level. See the cookie policy for information about cookies and local storage.
3. Legal bases
The applicable legal basis must be established for each processing activity before it is put into use. This policy does not approve contract, legitimate interests, consent, or legal obligation as a general basis for all use of Ginsi.
When Ginsi is the data controller, Ginsi is responsible for documenting the legal basis and, where required, carrying out a legitimate interests assessment or obtaining consent. When the customer organization is the data controller, the customer is responsible for the corresponding assessment and information to respondents. Live processing without a documented basis and the necessary agreements must not be activated. Contact privacy@ginsi.se for information about the basis applicable to a particular processing activity.
4. How may data be used?
Depending on the legally approved processing activity in question, data may be used to:
- administer accounts, invitations, roles, and product access
- create, distribute, and store surveys and responses on behalf of the customer organization
- calculate aggregates and generate the insights, recommendations, and notifications enabled for the organization
- send transactional messages
- protect the service through permission checks, rate limiting, and security monitoring
- reconcile and clean up legacy provider identifiers and historical events
- meet applicable legal obligations after the basis for processing and retention have been established
5. AI processing of data
5.1 What is processed
On enabled analysis paths, Ginsi may send survey inputs, aggregate statistics, and free text to Anthropic's API. Path-specific data minimization and sanitization are applied before transfer. Sanitization removes certain known patterns of direct identifiers but cannot guarantee that all indirectly identifying information is removed. Respondents should therefore avoid names and other personal data in free text.
5.2 Data minimization and limitations
The public response flow does not add a name, email address, or raw IP address to the survey response. It is nevertheless not possible to promise that direct or indirect personal data never reaches an analysis path, because a respondent may write such information in free text. The fields that may be processed and leave Ginsi must be documented and approved for each live path.
5.3 Automated analysis
Ginsi's configured analysis jobs may generate summaries, recommendations, warnings, and notifications. Availability and execution frequency depend on the enabled function, its data thresholds, and the organization's settings. Users can manage the notification settings offered by the function in question.
5.4 Purpose, legal basis, and impact assessment
The purpose of AI processing is to provide the agreed analysis functions. The allocation of roles, legal basis, and need for a data protection impact assessment must be assessed and documented for the intended use before real personal data is processed. This policy does not claim that a particular basis or impact assessment has already been approved.
5.5 Automated decision-making
The current technical paths generate analysis inputs and notifications; they do not themselves make binding decisions about an individual. The customer organization is responsible for human judgment and must not use Ginsi as the sole basis for decisions with legal or similarly significant effects without a separate, lawful, and documented assessment.
6. International transfers
Some provider paths may involve processing outside the EEA or in global infrastructure. The application code shows which technical services are called but does not establish the processing region, subcontractors, certification, retention period, or transfer mechanism.
Before real personal data is processed through such a path, the countries of processing, recipients, applicable transfer mechanism, and necessary supplementary safeguards must be verified and documented. The relevant information must be provided to data subjects and addressed in the necessary customer agreements. Contact privacy@ginsi.se for the assessment applicable to a particular processing activity.
7. Sharing and technical providers
The current implementation includes the following technical provider paths:
- Supabase — data storage and authentication
- Anthropic — AI analysis on enabled analysis paths
- Lettermint — transactional email
- Google Analytics — public website analytics after consent
- Vercel — web hosting and page-view analytics
- Cloudflare — traffic delivery and protection on parts of the infrastructure
- Stripe — legacy payment integration undergoing provider reconciliation. The event receiver is parked and processes no signed provider events. Historical event records are retained for reconciliation, and legacy provider identifiers are retained to locate the corresponding provider record during the separate cleanup at account deletion. These data do not select a billing solution or control product access
The list describes technical integrations that can be verified in the implementation. It does not constitute approval of subprocessors or a promise regarding region, certification, transfer mechanism, or the provider's retention period. These terms, together with any advance notice and right to object, must be addressed in a separate, approved data processing agreement before real customer data is processed.
8. Data retention and deletion
A final retention and deletion matrix for real customer data has not yet been approved. Before such processing begins, the matrix must specify the purpose, legal basis, retention period or objective deletion criteria, responsible owner, any legal hold, backup handling, and verifiable deletion for each data category.
- Account and organization data must be retained only for as long as needed for an approved account, security, contractual, or legal purpose
- Survey responses and analysis results must follow the period and deletion or anonymization procedure approved for the customer's processing
- Security, rate-limiting, notification, and activity data must have an explicit and technically enforced deletion period
- Accounting records and data under legal hold must be retained only to the extent and for the period required by applicable law
- The backup period and restoration behavior must be described only once the actual backup topology has been verified
For the existing owner-initiated account deletion, the end of a remaining legacy provider period is used where such a record exists; otherwise, the code schedules deletion after 30 days, or immediate deletion if the owner chooses it. The provider record does not indicate whether the organization has Ginsi's subscription and does not control product access. This describes the current technical deletion path, not an approved general retention period, contract termination, or offboarding process.
9. Roles under the GDPR
9.1 When Ginsi is the data processor
When a customer organization determines the purposes and means of a survey, the organization is normally the data controller. If Ginsi then processes data only in accordance with documented instructions, Ginsi is the data processor. The exact allocation of roles, instructions, and terms must be established in a separate approved agreement before processing begins. Neither this policy nor the public terms of service constitute that agreement.
9.2 When Ginsi is the data controller
Ginsi is the data controller for its own processing activities where Ginsi determines the purposes and means, such as certain account, security, contact, and business administration. The purpose, legal basis, and deletion must be documented for each processing activity.
10. Your rights under the GDPR
Depending on the processing and applicable law, you may have rights of access, rectification, erasure, restriction, data portability, and objection, as well as the right not to be subject to certain automated decisions. These rights are not limited by the fact that a survey response is pseudonymous.
The public response flow does not add direct identifiers to the survey response, but free text may indirectly identify a person. This may make it difficult to locate a particular response without additional information. If the customer organization is the data controller, the request should primarily be directed to that organization; Ginsi must assist in accordance with applicable law and an approved data processing agreement.
To exercise your rights, contact privacy@ginsi.se. We handle requests without undue delay and normally within one month at the latest. This period may be extended where permitted by law, and we may request the information necessary to verify identity and locate the relevant data.
Requests are assessed manually, and data is provided in the format required by the applicable right. This policy does not promise a complete organization export or delivery in a particular CSV or JSON format. Company export and contractual data return are separate matters that must be established before live customer processing.
11. Security
Ginsi uses technical safeguards where they can be verified in the current implementation:
- HTTPS/TLS for data transfer
- authentication and support for TOTP
- role-, tenant-, and need-based access controls, including RLS and restricted SQL permissions at the boundaries where they are implemented
- separate, salted hashing of IP identity for public rate limiting
- path-specific pseudonymization, aggregation, and sanitization before certain analysis calls
- logging of selected security-sensitive operations
This is not a claim that every table, operation, or provider is covered by the same control. Backup, restoration, incident procedures, and any customer notification time frames must be described only after the respective controls and responsibilities have been verified and approved.
12. Cookies and local storage
See our cookie policy for information about cookies, local storage, and page-view analytics.
13. Children and young people
Ginsi is a service for organizations and is not directed specifically at children. A customer intending to have minors respond to a survey must assess the information to be provided, legal basis, consent requirements, and other applicable safeguards before use. Contact privacy@ginsi.se if you believe Ginsi is processing data about a child so that the request can be assessed under applicable law.
14. Changes to this policy
We publish a new version and update date when the policy changes. If applicable law or an approved customer agreement requires specific information or renewed approval, this must be handled before the relevant change starts to apply.
15. Contact and complaints
Data protection questions: privacy@ginsi.se.
You have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) if you believe your data is being processed improperly: www.imy.se.
