# Privacy, terms and support

This page summarises the Swedish documents in English. The Swedish documents
are the binding versions:

- [Integritetspolicy](https://fentlig.se/integritet) (privacy policy)
- [Användarvillkor](https://fentlig.se/villkor) (terms of service)
- [Underbiträden](https://fentlig.se/underbitraden) (subprocessors)
- [Personuppgiftsbiträdesavtal](https://fentlig.se/dpa) (data processing
  agreement)
- [Säkerhet](https://fentlig.se/sakerhet) (security)

Fentlig AB, org.nr 559557-6827, is the controller for the processing described
here.

## When you connect an AI assistant

You sign in to Fentlig and approve what the assistant may read. The assistant
reads procurement data (notices, buyers, suppliers, statistics, tender documents
and the requirements extracted from them) and your workspace's bevakningar
(saved searches). It cannot change anything. The connection applies to the
workspace you chose when you approved it.

**What we store:** your approval (which assistant, which workspace, which
permissions, and when), the time-limited access keys the assistant uses, and
the number of calls per day. If you also approve that the assistant may see who
you are, your name and email address are given to it; the consent screen says
so.

**What we do not store:** the searches the assistant makes for you, such as
search terms and filters. The log records that a call was made, not what was
searched for. Your conversation with the assistant never reaches us.

**Who receives it:** the answers go to the assistant you chose. Its provider,
for example Anthropic or OpenAI, processes them under the agreement you or your
organisation has with that provider, and is responsible for that processing.
The assistant is not Fentlig's subprocessor.

**Removing a connection:** under **Inställningar > Assistenter** (Settings >
Assistants) you see your connections and can remove them. The assistant's
access keys are deleted at once, and its next call is refused.

**How long:** the approval and access keys are kept until you remove the
connection, or until your account or the workspace is deleted. Expired access
keys are deleted within 30 days. The daily call counts are kept as long as the
workspace's content.

## When you use an API key

**What we store:** the key's name, who created it, when it was last used, and
the number of calls per day. The secret itself is stored only as a hash.

**How long:** until the key is revoked or expires, at most one year unless it is
renewed.

Keys belong to your account, which is responsible for how they are stored and
used. Fentlig may revoke a key that is misused or has leaked. Keys stop working
when access ends.

## Where the data is processed

Everything your account enters, the database and the backups are in Sweden.
The analysis of public documents runs in the EU. The privacy policy lists the
exceptions and the subprocessors, with their locations.

## Data from public procurements

Procurement notices and documents contain the names of contact persons. The
privacy policy says how Fentlig handles them and what rights those people
have.

## Support

Write to [info@fentlig.se](mailto:info@fentlig.se) for questions about the API
or the MCP server, for privacy requests, and to report suspected unauthorised
access.