Privacy policy

Solutra AI AB · Last updated: 2 November 2026

Contents

1. Introduction
2. Controller and contact details
3. Our two roles: controller and processor
4. What personal data we process
5. Purposes and legal bases
6. Cookies and web analytics
7. AI processing and automated decision-making
8. Recipients and sub-processors
9. Transfers to third countries
10. How long we keep data
11. Security
12. Your rights
13. Complaints
14. Changes to this policy
15. Data from Google accounts
16. Contact

1. Introduction

Solutra AI AB (“Solutra”, “we”, “us”, “our”) builds and operates AI-based management systems for real estate agencies and other smaller businesses. We care about your privacy and process personal data in accordance with the EU General Data Protection Regulation (GDPR) and supplementary Swedish data protection legislation.

This policy describes how we process personal data when you:

• visit or use the website solutra.ai,
• contact us via a form, by email or by telephone,
• are a client, a prospective client or a contact person at a client, or
• interact with Solutra in any other way.

Section 3 also describes our position on personal data processed inside the systems we deliver to our clients.

2. Controller and contact details

Solutra AI AB
Company registration number: 559590-5596
Linta Gårdsväg 5A, 168 74 Bromma, Sweden
Email: info@solutra.se
Website: solutra.ai

We have not appointed a data protection officer, as our activities do not fall within the requirements of article 37 GDPR. Questions about the processing of personal data are answered by us at the address above.

3. Our two roles: controller and processor

It is important to distinguish two situations, because our responsibility differs between them.

3.1 When Solutra is the controller

We determine the purposes and means of the processing ourselves, and are therefore the controller, in relation to:

• visitors to solutra.ai,
• people who contact us via a form, by email or by telephone,
• prospective clients and their contact persons,
• contact persons at existing clients and partners,
• supplier contacts and applicants for positions with us.

This policy applies in full to that processing.

3.2 When Solutra is a processor

When we deliver and operate a system for a client, for example a CRM with AI teams for a real estate agency, that system processes personal data about the client’s own clients, buyers, sellers and counterparties.

For that data, our client is the controller and Solutra is the processor. This means that:

• we process the data only on the client’s documented instructions,
• we never use the data for our own purposes,
• the terms are set out in a separate data processing agreement between Solutra and the client,
• each client has its own logically and technically separated database; data is never shared between clients.

If you are a client, a buyer or a counterparty of a business that uses Solutra’s system and you wish to exercise your rights under the GDPR, you should contact that business in the first instance. If you contact us directly, we will forward your request to the correct controller and assist them in answering it.

4. What personal data we process

4.1 Data you give us

• Name
• Email address
• Telephone number
• Company, role and company registration or VAT number
• The content of messages, enquiries and information supplied for a proposal
• Correspondence by email, telephone or in meetings
• Information provided in connection with agreements and invoicing
• Questions you type into the chat on solutra.ai, with the page you asked from

4.2 Data we collect automatically

When you visit solutra.ai we count visits with Plausible, without cookies: page views per page, where the visit came from and the type of device, only in aggregate. We set no cookies, build no profiles of individual visitors and cannot follow you between different websites. See section 6.

Like every website, solutra.ai is served by a web server, and that server keeps technical logs of incoming requests, including IP address, time, requested address and browser type. The logs are used solely for operations, troubleshooting and information security, never for analytics or marketing, and are erased in accordance with section 10.

4.3 Data from third parties

In prospecting we may process publicly available business information, for example the name, role and contact details of decision-makers, taken from company websites, public registers and professional networks. That processing relies on legitimate interests and concerns professional contact details only. Many Spanish agencies are run by self-employed individuals; the information we give the agencies we call, in Spanish, is at solutra.ai/privacidad.

4.4 Data we do not process

We do not request and do not knowingly process:

• special categories of personal data under article 9 GDPR (for example health, ethnic origin, political opinions, religious beliefs, trade union membership, sexual orientation),
• national identity numbers, other than where required for contractual or accounting purposes,
• data about children under 18.

5. Purposes and legal bases

Where we rely on legitimate interests, we have carried out a balancing test and concluded that our interest outweighs the data subject’s interest in the processing not taking place. You always have the right to object to such processing, see section 12.

6. Cookies and web analytics

Solutra.ai sets no cookies. Visits are counted with Plausible, a cookie-free tool hosted in the EU that stores no personal data and cannot recognise you: that is why it needs no permission and runs for every visitor. We share no data with advertising networks.

The site stores nothing in your browser. Your choice of language is part of the address (/es/ for Spanish), not something kept on your device.

Beyond the Plausible script the site loads no third-party content: fonts, images and all other code are served from solutra.ai itself. Plausible is the single exception, and it is an EU service that uses your IP address momentarily to count the visit without storing it.

Full information is in our cookie policy.

7. AI processing and automated decision-making

Solutra’s services are built on AI agents that carry out tasks such as prospecting, client communication and administration. We think it is important to be clear about what that means.

7.1 How the AI processing works

Text processed by our agents, for example the content of an incoming message, is sent to an external language model provider for processing. The processing is momentary: the provider does not store the content for its own purposes and does not use it to train or improve its models.

7.2 How our systems improve over time

Our agents improve because we analyse outcomes and adjust instructions, rules and logic. That improvement happens at an aggregated and de-identified level, for example by measuring which kind of wording produces the best response rate.

We do not use personal data as training data for AI models. Data from one client’s system is never used to improve functionality for another client in a way that makes the underlying personal data available.

7.3 Automated decision-making

We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, within the meaning of article 22 GDPR.

Automated processing does occur, for example in the prioritisation of contacts and the generation of draft replies. Such processing forms a basis for a decision; the final assessment is made by a human. You always have the right to ask for human contact instead of automated handling. Contact us at info@solutra.se.

8. Recipients and sub-processors

We never sell personal data and never share it for third-party marketing.

To deliver our services we engage suppliers that process personal data on our behalf. We have entered into a data processing agreement with each of them.

Beyond these, data may be disclosed to:

• Public authorities, where we are obliged to do so by law or by a decision of an authority.
• Advisers, such as auditors and legal counsel, to the extent necessary.
• An acquirer, in the event of a restructuring or transfer of the business. You will be informed in advance in that case.

The website solutra.ai is served by a hosting provider, which receives the technical logs described in section 4.2.

A current list of sub-processors is provided to clients on request.

9. Transfers to third countries

Our main principle is that personal data shall be processed within the EU/EEA. Database and application operations are located within the EU.

Some suppliers are established in the USA, which means that transfers to a third country may occur. Such transfers take place only on the basis of appropriate safeguards under chapter V GDPR, that is:

• the European Commission’s adequacy decision (EU–US Data Privacy Framework), or
• standard contractual clauses supplemented by technical and organisational security measures.

You have the right to receive information on request about which safeguards are applied. Contact us at info@solutra.se.

10. How long we keep data

We keep personal data for as long as it is necessary for the purpose, or for as long as the law requires.

Data processed in client systems, where we are a processor, is erased in accordance with the client’s instructions and the data processing agreement in force between us.

11. Security

We work systematically with information security and apply, among other measures:

• Encryption of all traffic in transit (TLS) and encryption of stored data
• Isolation of each client’s data in a separate database instance with row-level access control
• Access control on a least-privilege basis and two-factor authentication for administrative access
• Automatic backups with regular restore testing
• Logging and monitoring of access to production environments
• Separate environments for development, testing and production
• A procedure for handling personal data breaches, including notification to the Swedish Authority for Privacy Protection within 72 hours where required

No transmission or storage can be guaranteed to be entirely secure. If a personal data breach occurs that is likely to result in a high risk to your rights and freedoms, we will inform you without undue delay.

12. Your rights

You have the following rights under the GDPR:

Access (art. 15): you can ask whether we process personal data about you and, if so, receive a copy of it.

Rectification (art. 16): you can ask for inaccurate data to be corrected and incomplete data to be completed.

Erasure (art. 17): you can ask for erasure, for example when the data is no longer needed or when you withdraw your consent. The right is not absolute; we may need to keep data under the Swedish Accounting Act or for legal claims.

Restriction (art. 18): you can ask for the processing to be restricted, for example while the accuracy of a piece of data is being checked.

Data portability (art. 20): for data you have provided yourself and that is processed on the basis of consent or a contract, you can receive it in a structured, commonly used and machine-readable format.

Objection (art. 21): you can object to processing based on legitimate interests. If you object to direct marketing, we stop immediately.

Withdrawal of consent (art. 7.3): if you have given consent you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

How to do it: contact us at info@solutra.se. We answer your request without undue delay and at the latest within one month. For complex or numerous requests the period may be extended by two months, in which case you will be informed within the first month. We may need to ask for additional information to verify your identity. Exercising your rights is free of charge.

13. Complaints

If you consider that we process your personal data in breach of applicable law, you have the right to lodge a complaint with the supervisory authority. Solutra AI AB is established in Sweden, so our lead supervisory authority is:

Integritetsskyddsmyndigheten (IMY)
Box 8114, 104 20 Stockholm, Sweden
imy@imy.se · +46 8 657 61 00 · imy.se

You may also lodge a complaint with the supervisory authority in the EU country where you live or work: in Spain, the Agencia Española de Protección de Datos (aepd.es).

We would appreciate it if you contacted us first, so that we have the chance to put right anything that has gone wrong.

14. Changes to this policy

We may update this policy, for example when legislation changes or when our services gain new functionality. The latest version is always published on solutra.ai with the date of the most recent update. In the event of material changes we inform affected clients by email.

15. Data from Google accounts

A user of Solutra's system can choose to connect their Google account to the system. The connection is made in the system's settings and requires the user to approve the permissions in Google's own consent screen. This section applies both to Solutra's own system and to the systems we deliver to clients, and describes which data from Google we access and what we do with it.

15.1 Data we access

• Gmail: reading email in the inbox and in sent mail (the gmail.readonly scope, and gmail.modify in Solutra's own system) and sending email on the user's behalf (gmail.send). None of the scopes include permanent deletion of email.
• Google Calendar: reading the user's calendars and events, and adding or changing events (the calendar.readonly and calendar.events scopes).
• Google Search Console: read access to statistics on organic search traffic for the websites where the account has been added as a user (the webmasters.readonly scope).

15.2 How the data is used

• To show the user's email in the system and link each message to the right client, lead or property, so that all contact with a client is visible in one place.
• To send email that the user has written or approved. No message is sent without the user pressing a button.
• To show the user's calendar in the system and add appointments and meetings booked there.
• To compile a monthly report on the website's search traffic for the client.

The data is used solely to provide and improve these features, which the user sees and uses in the system.

15.3 What we never do with the data

• We never sell it, and we never transfer it to advertising platforms, data brokers or other information resellers.
• We never use it for advertising, retargeting or building profiles for advertising purposes.
• We never use it to train or improve generalized AI or machine learning models, whether our own or anyone else's.
• No person at Solutra reads the content, except when the user has explicitly asked us to for a specific message, when it is necessary to investigate security issues or abuse, when required by law, or when the data has been aggregated and anonymized for internal operations.

15.4 Sub-processors

The data is stored in a database within the EU at Supabase, see section 8. When the user uses a feature that relies on a message's content, for example a suggested reply, the content is sent to our language model provider Anthropic for processing. The provider does not store the content for its own purposes and does not train its models on it, see section 7.

15.5 Retention, revocation and deletion

Stored email is kept for as long as the client agreement is in force and is then deleted according to section 10. The user can revoke Solutra's access at any time at myaccount.google.com/permissions, after which the system immediately stops retrieving data from the account. To have data that has already been stored deleted, contact info@solutra.se. We delete it within 30 days, unless the law requires us to keep it longer.

15.6 Google API Services User Data Policy

Solutra's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

16. Contact

Solutra AI AB
Linta Gårdsväg 5A, 168 74 Bromma, Sweden
info@solutra.se · solutra.ai

Last updated: 29 October 2026