LAST UPDATED: APRIL 19, 2026
Privacy
This page explains what we collect when you scan a domain on agent.opensverige.se and why. Short, honest, no legalese.
What we collect
When you scan a domain we store: the domain name, the results of the technical checks, a hashed version of your IP address (SHA-256), a timestamp, and the AI-generated summary. We don't store names, emails or accounts: the scanner requires no sign-up.
Why
Domain and results are stored so you can return to your report and share it. Hashed IP is used for rate limiting (abuse protection): we can't reverse it to a real IP, but because it can still be linked to you it legally counts as pseudonymised personal data (CJEU, Breyer ruling).
AI summary
The summary above the check results is generated by Anthropic's Claude model based on the technical checks. It is not legal advice. We label it clearly as AI-generated, in line with EU AI Act article 50 (applies from August 2, 2026).
Sub-processors
Hosting: Vercel (US/EU). Database: Supabase (EU, Frankfurt). AI analysis: Anthropic (US). Semantic search: Exa (US). Fetching: Firecrawl (US). Meeting bookings: Cal.com (EU). Transfers to the US rely on the EU-US Data Privacy Framework.
Web analytics
We use Vercel Web Analytics, which counts page views without cookies and without tracking you across sites. No cookie banner is required because we don't use cookies for tracking.
Cookies
We set no cookies of our own. If you book a meeting via Cal.com, their embed sets cookies when you interact with the calendar: Cal.com is the controller for that.
Retention
Scan results and hashed IPs are deleted automatically after 90 days (can be extended on Builder/Pro tiers). You can request earlier deletion of a specific domain's results: email info@opensverige.se.
Automated decision-making and profiling
The service makes automated technical assessments (green/yellow/red badge) of domains: not of individuals directly. For legal persons (companies), the decision is outside GDPR Art. 22 scope. For sole traders or a freelancer's portfolio (where the domain is linked to a natural person), the badge assessment may qualify as an automated decision producing legal or similarly significant effects (Art. 22). In such cases you have the right to request human review, express your point of view and contest the result: email info@opensverige.se. We do not profile visitors or build behavioural patterns over time.
Your rights
Under GDPR you have the right to access, rectification, erasure, restriction, portability and objection. For automated decisions (Art. 22) you also have the right to human review. Complaints can be lodged with IMY for GDPR matters and with PTS (Swedish Post and Telecom Authority) for AI Act matters (per SOU 2025:101).
Contact
Controller: OpenSverige. Contact: info@opensverige.se. We reply as soon as we can: we're a community, not a support desk.