Lovey AB (“Lovey”, “we”, “us”, “our”) is a Swedish company providing a premium AI workspace. This privacy notice explains how we collect, use, store, and protect personal data when you use our services or visit lovey.se.

This is a GDPR-oriented privacy notice prepared for the Lovey platform. It has not been reviewed by legal counsel and does not constitute legal advice. The controller details, sub-processor list, retention periods, and lawful-basis analysis must be verified before publication.

We intend to process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR) and applicable Swedish data protection law.

1. Who is the data controller?

Lovey AB is the intended data controller for personal data processed in connection with the Lovey platform and website. [Controller address, organisation number, and DPO contact must be confirmed before publication.] Contact: hello@lovey.se.

2. What personal data we collect

Account data

When you create an account we collect: name, email address, authentication credentials (managed via Clerk), and profile image (optional).

Usage data

We collect information about how you use the platform: studio sessions, interaction counts, and error events. This data is aggregated and used to improve the service and provide usage analytics to organisation administrators.

Technical data

We automatically collect: IP address, browser type and version, operating system, referring URL, and session identifiers. This data is used for security monitoring and service operation.

Content data

Content you submit to Lovey — documents, prompts, and AI outputs — is stored in your organisation's isolated data context. We do not read, sell, or use this content to train AI models.

3. Lawful basis for processing

[All lawful bases must be confirmed per processing purpose before publication.]

Contract performance — processing necessary to deliver the Lovey service under our Terms of Service.
Legitimate interests — security monitoring, fraud prevention, and service improvement, balanced against your rights.
Legal obligation — where we are required to process data to comply with applicable law.
Consent — for optional communications such as our newsletter. You may withdraw consent at any time.

4. How we use your data

To provide, operate, and improve the Lovey platform.
To authenticate your identity and protect your account security.
To provide organisation administrators with aggregated usage analytics.
To send transactional communications (account notices, security alerts).
To send marketing communications where you have opted in (newsletter).
To comply with legal obligations and respond to lawful requests.

5. Data retention

[Exact retention periods per data category must be confirmed before publication.] We intend to retain account data for as long as your account is active, plus 30 days after account deletion to allow recovery. Usage and audit logs are intended to be retained for 12 months. You may request early deletion at any time (see Your rights below).

6. Data sharing and transfers

We do not sell personal data. We share data only with:

Clerk — authentication infrastructure, operating under a Data Processing Agreement.
Replit — hosting infrastructure within the EU.
Legal authorities — where required by Swedish or EU law.

[Full sub-processor list with DPA links must be confirmed before publication. International transfer safeguards (SCCs or adequacy decision) must be documented per processor.]

Data is not intentionally transferred outside the EEA without adequate safeguards.

7. Your rights under GDPR

Access — obtain a copy of your personal data.
Rectification — correct inaccurate data.
Erasure — request deletion of your personal data.
Restriction — limit processing in certain circumstances.
Portability — receive your data in a machine-readable format.
Object — object to processing based on legitimate interests.
Withdraw consent — at any time, without affecting the lawfulness of prior processing.

To exercise these rights, contact hello@lovey.se. We will respond within one month. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten — IMY) at imy.se or your local supervisory authority.

8. Cookies

We use strictly necessary cookies for authentication and session management (via Clerk). We do not use advertising or tracking cookies. You cannot opt out of strictly necessary cookies without losing access to the service. [Cookie audit and banner requirements must be confirmed before publication if any non-essential cookies are introduced.]

9. Security

We implement appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS 1.3), tenant data isolation, role-based access control, and regular security review. See our Security page for details.

10. Automated decision-making

[Disclose any automated decision-making or profiling before publication.] We do not currently use automated decision-making that produces legal or similarly significant effects on individuals.

11. Changes to this notice

We may update this notice from time to time. We will notify you of material changes via email or a prominent notice in the platform. The “Last updated” date at the top of this page always reflects the current version.

12. Contact

For any privacy questions or to exercise your rights: hello@lovey.se.