Privacy Policy

Last updated: September 30, 2026

1. Scope and who we are

This policy covers the free business diagnostic, Business Deep Dive, Daily Focus, accounts, reports, communications, subscriptions, and related services (the "Service") provided by:

TSwede AB Company registration number: 559266-1101 VAT number: SE559266110101 Lidavägen 3 141 91 Huddinge Sweden Telephone: +46 70 428 45 06 Email: contact@tswedebiz.com

TSwede AB is the data controller for personal data processed through the Service. In this policy, TSwede AB is referred to as "TSwedeBiz", "we", "us", or "our".

This policy primarily explains our processing under the EU General Data Protection Regulation (GDPR) and applicable Swedish data-protection law. It does not claim compliance with every privacy law in every country.

2. Age requirement

The Service is intended for individuals aged 18 or older. By purchasing or using the Service, you confirm that you are at least 18 years old.

We do not knowingly collect personal data from individuals under 18. If we discover that a person under 18 has used or purchased the Service without any consent required by applicable law, we may close the account, refund the purchase where appropriate, and delete the associated personal data, except where retention is required by law.

3. Information we collect

We may process:

• your email address, and optionally a telephone number if you provide one;
• your business name;
• your website address and social-media handles;
• answers and information you supply through the free diagnostic and Deep Dive interview;
• documents, links, or text you voluntarily submit;
• generated reports, Business Blueprints, Daily Focus priorities, and your related responses;
• account, subscription, and purchase status;
• communications, support requests, feedback, and meeting information;
• technical and usage information necessary to operate, secure, troubleshoot, and evaluate the Service;
• transaction information received from Stripe (see below); and
• relevant publicly available information discovered through online research about your business or its representatives, where you've given us a business name or channels to look up.

Your email address (or phone number, if that's what you use for Daily Focus) is used to save your progress, let you continue without starting again, connect your Deep Dive with Daily Focus, deliver your reports, and administer your account or subscription.

On payment information: Stripe processes your full card details — we never see or store them. We may receive transaction information from Stripe such as amount, currency, payment status, date, a customer reference, card type, and limited card-identification information (e.g. the last few digits).

On publicly available information: information that is publicly available online can still be personal data, particularly for sole traders and businesses closely tied to an identifiable individual. We treat it accordingly.

The Service researches your business online when you provide a business name or channels, to help build your diagnostic and report — this policy covers that processing as described above.

4. Information you should not provide

The Service uses external AI and technology providers to process information. Please do not submit information that must remain strictly confidential or that isn't necessary for the business analysis.

In particular, do not submit:

• unpublished inventions or technical information that may be patentable;
• trade secrets, confidential formulas, proprietary source code, manufacturing processes, or similar technical information;
• passwords, private keys, access credentials, or security codes;
• complete payment-card information;
• national identification numbers, passport details, or identity documents;
• health data or other sensitive personal data;
• confidential information about your customers, employees, contractors, or business partners;
• information covered by a confidentiality agreement or professional duty of secrecy; or
• information you are not authorised to share.

You are responsible for ensuring you have the right to provide any information you submit. Where possible, remove or anonymise names and other identifying details relating to your customers, employees, contractors, and other third parties.

If an idea may be patentable, get appropriate professional advice before disclosing technical details — you can describe the business problem, customer, market, and commercial objective without explaining exactly how the invention works.

Only provide information that's reasonably necessary for the analysis you're asking for.

5. Purposes and legal bases for processing

• Creating or administering your session, saving progress, running the diagnostic and interview, researching your business as requested, generating reports and priorities, and delivering the Service: performance of a contract, or steps you asked us to take before entering into one.
• Processing payments and administering subscriptions: performance of a contract.
• Retaining accounting and transaction records: compliance with a legal obligation.
• Sending reports, essential service notices, security notices, and transactional communications: performance of a contract, or compliance with a legal obligation.
• Security, fraud prevention, troubleshooting, protecting our legal rights, and investigating misuse: our legitimate interest, and, where applicable, compliance with a legal obligation.
• Analysing properly anonymised and aggregated insights during the beta period: our legitimate interest in evaluating and improving the Service. Once information is genuinely anonymous and can no longer reasonably identify a person or business, it's no longer personal data under GDPR.
• Authorised personnel reviewing an identifiable interview or report: your voluntary consent (see Section 8).
• Marketing communications: consent, where legally required. You can withdraw this at any time.
• Meeting scheduling, requested personal feedback, support, or coaching: performance of the service you asked for.

You may object to processing based on our legitimate interests by contacting contact@tswedebiz.com.

6. Anonymised insights during the beta period

During the beta period, TSwedeBiz may analyse anonymised and aggregated insights to understand common business challenges, evaluate how the Service performs, and improve its questions, reports, recommendations, and features.

Before information is used this way, we take reasonable steps to remove names, email addresses, contact details, business names, and other information reasonably capable of identifying you or your business.

Anonymised insights are not used to recreate or disclose your individual report or business idea. If information can still reasonably identify you or your business — through the idea itself, your circumstances, or other details — we don't treat or describe it as anonymous.

This is based on our legitimate interest in evaluating and improving the beta Service. You may object by contacting contact@tswedebiz.com. This does not involve a separate checkbox, and objecting does not change your price or access to the Service.

7. Optional review of your interview and report by Tracy J Hoffman

Separately, and only if you choose to, you can agree to let Tracy J Hoffman and authorised TSwedeBiz personnel review your identifiable interview responses and report, to evaluate and improve the beta Service. If Tracy identifies something worth discussing further and has the capacity, you may also receive personal feedback — this is never guaranteed.

This option is presented as an unticked checkbox in the Service. You can use the Service fully without selecting it, your price doesn't change either way, and you can withdraw your permission at any time by contacting contact@tswedebiz.com. Withdrawing stops future review; it doesn't make earlier, already-lawful review unlawful.

Only authorised personnel with a genuine need — which may include future TSwedeBiz coaches, employees, or contractors bound by confidentiality obligations — can access this material, and they may not use it for their own purposes.

This processing is based on your consent. We record your choice, the date, which version of this policy or consent text applied, and any later withdrawal.

8. Confidentiality

We treat non-public business information you submit as confidential. We don't disclose it except to authorised personnel and service providers where necessary to provide, secure, maintain, evaluate, or improve the Service, where you've requested another service such as personal feedback or coaching, or where disclosure is required by law.

Authorised personnel and service providers must handle your information in line with applicable confidentiality, contractual, and data-protection obligations.

This doesn't mean no third party ever processes your data — the Service necessarily relies on external processors, listed in Section 11. It also doesn't guarantee that no one else will independently develop a similar business idea.

9. AI processing and model training

TSwedeBiz does not sell your data or intentionally use your interview content or reports to train AI models. Information is disclosed only where necessary to provide, operate, secure, evaluate, or improve the Service, including to contracted technology and AI providers.

Information submitted for AI analysis is processed through Anthropic's commercial Claude API. Anthropic currently states that inputs and outputs from its commercial API services are not used for model training by default. Data may nevertheless be processed or retained temporarily for service operation, security, abuse prevention, or legal compliance, depending on Anthropic's applicable terms and our technical configuration.

We intend to use providers whose commercial terms protect your API data from model training by default, and to monitor material changes to those terms. Because the Service relies on third-party providers, we can't give an absolute guarantee about future changes to their services, policies, security, or legal obligations.

If a material provider change affects how your data is processed, we'll assess it and, where appropriate, change provider, configuration, or functionality, and update this policy.

We do not currently have a Zero Data Retention arrangement in place with Anthropic.

10. Service providers

We use the following processors, engaged under appropriate data-processing terms where GDPR requires them:

Provider	Purpose	Data involved
Anthropic	Generates your diagnostic, report, coaching content, and Daily Focus priorities; performs business research you request	Business information you provide, interview content, may involve processing outside the EU/EEA
Stripe	Payment processing and fraud prevention	Email, payment and transaction details (full card data handled entirely by Stripe)
Supabase	Database — stores your account, report, and subscription data (hosted in Frankfurt, Germany, EU)	All account and report data
Vercel	Hosts this website and the TSwedeBiz web app, and runs the server functions that pass your requests to our backend	Technical request data (such as IP address, browser type, pages requested) and the content of requests passing through; may involve processing outside the EU/EEA
Render	Hosts our backend server, which connects the app to Anthropic, Stripe, Supabase, HubSpot, and our email provider	Business information, interview content, and account data in transit; technical server logs; may involve processing outside the EU/EEA
Resend	Sends service emails, such as "your report is ready", booking links after purchase, and your Digital Communication Profile when you ask us to email it	Email address, name/business name, and the content of the email; may involve processing outside the EU/EEA
HubSpot	Customer relationship management	Email, business name, purchase status

Hosting: the website and web app are hosted by Vercel, our backend server by Render, and our database by Supabase (EU, Frankfurt).

Usage statistics: we record simple first-party usage events (for example which step of the app was reached and which campaign link brought you there) in our own Supabase database, to understand where people drop off. We do not use a third-party analytics provider, error-logging/monitoring provider, or a separate authentication provider — if we add any of these, we'll update this section. We don't use Google Workspace or Gmail to process your interview or report data; a Google Calendar link may be offered to you only as an external booking option that you choose to click.

We don't sell your personal data to third parties.

11. International data transfers

Some service providers may process personal data outside the EU/EEA. Where GDPR requires safeguards for an international transfer, we use an applicable adequacy decision, the European Commission's Standard Contractual Clauses together with supplementary measures where appropriate, or another legally recognised transfer mechanism.

Further information about applicable safeguards may be requested from contact@tswedebiz.com.

12. How long we keep your data

We retain personal data only for as long as necessary for the purposes in this policy:

• Account and active service information: while your account or the relevant Service remains active.
• Deep Dive interview answers, Business Blueprints, and generated reports: while needed to provide the Service, and for up to one year after your last activity.
• Daily Focus information: while your subscription is active, and for up to one year after cancellation or your last activity.
• Support communications and feedback: for up to one year after the matter is closed, unless a legal claim requires longer retention.
• Marketing information: until you withdraw consent, unsubscribe, or it's no longer required.
• Payment, tax, and accounting records: for the period required by applicable Swedish law.
• Security and technical logs: for the period configured in our production system, unless longer retention is reasonably necessary to investigate misuse, a security incident, or a legal claim.
• Data processed by external providers: according to their applicable retention periods and our contractual and technical settings.

When personal data is no longer required, it's deleted or irreversibly anonymised, except where we must retain it to comply with law, establish or defend legal claims, prevent fraud, or protect the Service. This may also affect information in backups, which are not deleted on the same immediate timeline as our live systems.

Not yet implemented: automated deletion or anonymisation after the retention period, and an advance email reminder (e.g. around 30 days) before deletion, are planned functionality we have not yet built. Until they exist, deletion is handled on request — contact contact@tswedebiz.com to request deletion or to keep your account active.

13. Security

We use technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss, or destruction, reviewed in light of the nature of the data, the processing involved, and the risks presented.

Access to identifiable interview responses and reports is limited to authorised personnel who need it for an approved purpose.

No online service can guarantee absolute security. If we become aware of a personal-data breach, we will investigate it and notify the relevant supervisory authority and affected individuals where required by applicable law.

14. Your rights under GDPR

You have the right to:

• access the personal data we hold about you;
• rectify inaccurate data;
• erase your data, subject to legal retention requirements;
• restrict certain processing;
• object, particularly to processing based on our legitimate interests;
• data portability, where applicable;
• withdraw consent at any time, where processing is based on consent;
• complain to Integritetsskyddsmyndigheten (IMY) or another competent supervisory authority; and
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects on you, where applicable.

Requests normally receive a response within one month. We may need to verify your identity first. Your rights depend on the circumstances and the applicable legal basis. Withdrawing consent doesn't affect processing that was already lawful, and we may need to retain some information despite a deletion request where the law requires it.

Supervisory authority: https://www.imy.se/

15. Automated analysis and your responsibility

The Service uses artificial intelligence to generate educational business analysis, reports, and priorities. It does not make legally binding decisions about you and isn't intended to produce decisions with legal or similarly significant effects.

You remain responsible for evaluating the output, verifying important information, seeking appropriate professional advice where necessary, and making your own business decisions.

16. Marketing and service communications

We distinguish between essential service messages (reports, payment confirmations, security notices, deletion notices, requested appointment communications) and optional marketing communications.

We never require marketing consent as a condition of using the Service. You can withdraw marketing consent at any time through an unsubscribe link or by contacting us.

17. Changes to this policy

We may update this policy from time to time. Material changes to how we use personal data will be communicated through an appropriate notice — such as email or an in-service notice — where required or reasonably appropriate. Continued use of the Service doesn't by itself constitute new consent where GDPR requires one.

18. Contact

Questions, privacy requests, objections, or complaints may be sent to:

TSwede AB / TSwedeBiz Lidavägen 3 141 91 Huddinge Sweden Email: contact@tswedebiz.com Telephone: +46 70 428 45 06

You may also lodge a complaint with the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten: https://www.imy.se/