Legal · GDPR

Privacy policy

Your privacy matters to us. Here's how we collect, use and protect your information.

Last updated: 04/09/2026

Data controller

Axelsson Graphics, Långgatan 13, 547 38 Vetlanda, Sweden.
Email: hej@axelsson.graphics
We are the controller for the data described in this policy. When we build and operate AI agents for clients, we act as a processor on the client's behalf under a separate data processing agreement.

This policy covers the axelsson.graphics website and our products AxG AI Agent and AxG AI Store Assistant (the e-commerce store assistant).
AxG AI Agent: answers questions from customers or internal staff based on the sources you connect, such as page content, price lists, documents and procedures.
AxG AI Store Assistant: answers product, stock, shipping and order questions in your store based on the product data and store information you connect.
For both products you are the data controller for the data your visitors and staff provide, and we act as your processor under a data processing agreement.

Contact details: name, company name, email address and phone number when you get in touch or place an order.
Chat data: the messages you send to our AI agent plus technical metadata (timestamp, language).
Customer data: account information, subscription status and payment status (card details are handled solely by Stripe — we never see them).
Technical data: your IP address in hashed form to block automated login attempts, plus anonymised visit statistics if you have consented to cookies.
We do not collect special categories of personal data (e.g. health, religion, political opinion) and ask you not to send such data in the chat.

Responding to enquiries and delivering our services — legal basis: contract (Art. 6(1)(b)).
Invoicing, accounting and subscription management — legal basis: legal obligation (Art. 6(1)(c)) and contract.
Operations, troubleshooting, security and abuse prevention — legal basis: legitimate interest (Art. 6(1)(f)).
Visit analytics and ad campaign measurement — legal basis: consent (Art. 6(1)(a)), which you can withdraw at any time.
Information about similar services to existing customers — legal basis: legitimate interest, with an opt-out in every message.

Enquiries and email correspondence: up to 24 months after the last contact.
Customer and contract data: for the term of the agreement and thereafter as required by Swedish accounting law (7 years for supporting records).
Chat logs: up to 90 days, after which they are deleted or anonymised.
Security logs with hashed IP addresses: up to 30 days.
Cookie consent: 12 months, then we ask again.

Lovable Cloud / Supabase — hosting, database and authentication (EU).
Google Cloud (Dialogflow CX) — the AI agent's language model and response handling.
Google Ireland Ltd (Google Analytics 4 and Google Ads) — visit statistics and ad measurement, only after your consent.
Stripe Payments Europe Ltd — payments and subscriptions.
We never sell your data and share it only with the suppliers needed to deliver the service, or where required by law.

Some suppliers (Google, Stripe) may process data in the United States.
Such transfers rely on the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework.

All traffic is encrypted with TLS and data is stored encrypted at our suppliers.
Database access is governed by row-level security (RLS) — you can only reach your own data.
We protect against automated login attempts and cryptographically verify all payment notifications.

Necessary cookies are required for login and security and cannot be switched off.
Analytics and marketing cookies (Google Analytics 4, Google Ads) are only loaded after you accept them.
You can change or withdraw your consent at any time via the “Cookie settings” link in the footer, or by clearing cookies in your browser.

Access: you have the right to know what data we hold about you and to receive a copy.
Rectification and erasure: you can have inaccurate data corrected and request that your data be deleted.
Restriction and objection: you can ask us to restrict processing or object to processing based on legitimate interest, including direct marketing.
Data portability: you can receive the data you provided in a machine-readable format.
Withdraw consent: you can withdraw consent at any time without affecting processing carried out beforehand.
Complaints: you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), Box 8114, 104 20 Stockholm, imy@imy.se.

You have the right to request that we remove your personal data from our systems at any time.
Use the form further down this page, or send a request directly to hej@axelsson.graphics.
We process your request within 30 days and confirm by email once your data has been deleted.

If you have questions about our privacy policy or how we handle your data, contact us at hej@axelsson.graphics or Axelsson Graphics, Långgatan 13, 547 38 Vetlanda, Sweden.

★

Fill in the form below and your email client will open with a ready-to-send request. We process your request within 30 days.