Privacy Policy

Steward ("we", "us") provides an AI-powered receptionist service that answers phone calls on behalf of businesses. Our contact address is support@stewardai.se.

We are the data controller for the personal data described in this policy.

We collect and process the following categories of personal data:

Account data — name, email address, and password when you create an account.

Business data — the name, description, and configuration of your AI receptionist.

Builder messages — the messages you write to the receptionist builder and the builder's replies, including any errors. We store these so we can troubleshoot problems you report with the builder.

Call data — phone numbers of callers, call transcripts, and any information callers share (e.g. name, preferred appointment time). Audio recordings are processed in real time and are not stored after the call ends.

Payment data — billing information processed by Stripe. We do not store card numbers on our servers.

Usage data - log files, IP addresses, and browser information collected automatically when you use the service.

Advertising data (only with your consent) - which ad or campaign you arrived from, and the sign-up, checkout and purchase events we share with Meta to measure our ads.

We process your personal data on the following legal bases under the GDPR:

- Contract (Article 6(1)(b)) — to provide and manage your account and the receptionist service.
- Legitimate interest (Article 6(1)(f)) — to improve our service, prevent abuse, and ensure security.
- Legal obligation (Article 6(1)(c)) — to comply with applicable laws such as accounting and tax regulations.
- Consent (Article 6(1)(a)) - for optional communications such as newsletters, and for measuring our ads with Meta. You may withdraw consent at any time.

We share data with the following third-party processors to deliver the service:

| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database and authentication | EU (Frankfurt) |
| 46elks | Phone calls and telephony | EU (Sweden) |
| OpenRouter | AI language processing | USA (SCCs applied) |
| ElevenLabs | Voice synthesis | USA (SCCs applied) |
| Deepgram | Speech-to-text transcription | USA (SCCs applied) |
| Stripe | Payment processing | USA/EU (SCCs applied) |
| Meta Platforms Ireland | Ad measurement (only with your consent) | EU/USA (EU-US Data Privacy Framework) |

Transfers to the USA are covered by Standard Contractual Clauses (SCCs) as required by GDPR Chapter V.

- Account data — retained for the duration of your account and deleted within 30 days of account termination.
- Caller data — the caller's phone number, the call transcript, the call summary and technical call logs are permanently deleted 14 days after the call. Missed-transfer callback requests are deleted after 14 days.
- Anonymous call statistics — the hour, approximate length and outcome of a call are kept for as long as the account exists. When the caller data is deleted, the exact time and length are also rounded, so the statistics contain no phone number or conversation content and cannot be linked to the caller.
- Builder messages — retained for 30 days, after which they are permanently deleted.
- Payment records — retained for 7 years as required by Swedish accounting law (Bokföringslagen).
- Log files — retained for 90 days.

Under the GDPR you have the following rights:

- Access — request a copy of the personal data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure — request deletion of your data ("right to be forgotten").
- Portability — receive your data in a machine-readable format.
- Restriction — ask us to limit how we use your data.
- Objection — object to processing based on legitimate interest.

To exercise any of these rights, email us at support@stewardai.se. We will respond within 30 days.

You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se.

When you contact us for support, or when we need to fix something on your behalf, a member of our team may temporarily access your account to view and adjust your AI receptionist's configuration — its settings, the builder, and its call and booking insights.

This access is scoped to your receptionist only. It never includes your payment details, billing information, or Stripe account — those are technically blocked and cannot be reached this way, regardless of what a staff member does.

To troubleshoot problems with the builder, a staff member may also read the messages you have written to the builder in the last 30 days, and its replies. This is only done when needed to resolve an issue, and, like account access, requires a recorded reason and is logged.

Every such access is time-limited (it ends automatically after 30 minutes), requires a staff member to record a reason before starting, and is logged — who accessed your account, when, and why. It does not use or require your password, and does not interrupt or sign you out of your own active session elsewhere.

We use strictly necessary cookies to keep you logged in (session cookies). With your consent, we also use the Meta Pixel and share sign-up, checkout and purchase events with Meta to measure which ads work. Your email address is hashed before it is sent. Without your consent, nothing is shared with Meta. See our full Cookie Policy for details.

We use industry-standard security measures including TLS encryption in transit, encrypted storage at rest, and access controls. No method of transmission over the internet is 100% secure, but we take reasonable precautions to protect your data.

We may update this policy from time to time. We will notify you by email or in-app notice before material changes take effect. The current version is always available at steward.se/integritetspolicy.

For privacy questions or to exercise your rights, contact us at support@stewardai.se.