Last updated: 24 July 2026
This English version is provided for convenience. In case of discrepancy, the Swedish version prevails.
1. Controller
Indexerly, Söderberga Allé 62, 168 62 Bromma ("we") is the controller for the processing described in this policy. Contact: kontakt@indexerly.com.
Important role distinction: For personal data contained in contract documents uploaded by our customers (e.g. names of counterparty contacts), the customer is the controller and Indexerly the processor. That processing is governed by our data processing agreement (DPA) with the customer, not by this policy. This policy covers processing where Indexerly is itself the controller: accounts, website, leads and billing.
2. Data we process
- Account data: name, email address, company and role of users of the service.
- Customer and billing data: organization details, invoicing address, payment references (card details are handled by our payment provider and never reach our systems).
- Leads: email address and the details you enter in the calculator or when booking an index audit.
- Usage data: technical logs required for operation and security (e.g. login timestamps). Our web analytics (Plausible) is cookie-free and does not collect personal data.
- Communication: email and support matters with us.
3. Purposes and legal bases
| Processing | Purpose | Legal basis |
|---|---|---|
| Account and login | Providing the service | Performance of contract (Art. 6(1)(b)) |
| Billing | Charging and bookkeeping | Contract and legal obligation (Art. 6(1)(c), Swedish Accounting Act) |
| Leads (calculator, audit) | Delivering requested material and following up | Legitimate interest (Art. 6(1)(f)) |
| Operational logs and security | Protecting the service and customer data | Legitimate interest (Art. 6(1)(f)) |
| Service communications to existing customers | Information about features and index releases | Legitimate interest; unsubscribe in every mailing |
We do not use personal data for automated decision-making with legal effects, and we never sell personal data.
4. Retention
Account data is kept while the account is active and deleted within 30 days of closure, except records retained under the Swedish Accounting Act (7 years). Lead data is deleted no later than 12 months after last contact if no customer relationship arises. Uploaded contract documents are deleted per the DPA and the customer's instructions — the customer can delete documents or the entire organization in the service at any time, upon which stored files are permanently removed.
5. Recipients and sub-processors
We never share personal data with third parties for their own purposes. The following providers process data on our behalf:
| Provider | Function | Processing location |
|---|---|---|
| Supabase | Database, authentication and file storage | EU |
| Vercel | Hosting of website and application | EU region for functions; global CDN for static content |
| Anthropic | AI analysis of contract text | See section 6; content is not used for model training and is not retained |
| Resend | Transactional email | See section 6 |
| Stripe | Payments and subscriptions | See section 6 |
| Plausible | Cookie-free web analytics | EU |
A current list is maintained on our security page.
6. Third-country transfers
Customer data (documents, extracted fields, calculations) is stored within the EU. Some providers (Anthropic, Vercel, Stripe, Resend) are US companies, which may entail limited transfers to the United States. Such transfers rely on the European Commission's Standard Contractual Clauses (SCCs) and/or the EU–U.S. Data Privacy Framework, with supplementary safeguards. Copies of the safeguards can be requested via kontakt@indexerly.com.
7. Security
Data is protected with encryption in transit (TLS) and at rest, row-level access control that technically isolates each organization's data, signed time-limited access links for documents, and logging that never contains contract content. Access to production data is restricted to authorized personnel.
8. Your rights
You have the right to request access to, rectification or erasure of your personal data, restriction of processing, data portability, and to object to processing based on legitimate interest. Contact kontakt@indexerly.com and we will respond without undue delay, at the latest within one month. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), www.imy.se.
If your request concerns personal data in documents uploaded by one of our customers, we will refer you to that customer (the controller) and assist the customer in honoring your rights.
9. Cookies
The website uses only strictly necessary cookies (e.g. login session and language preference). Our analytics (Plausible) uses no cookies and stores no identifiers. No cookie banner is therefore shown.
10. Changes
For material changes to this policy, we notify you by email or in the service before the change takes effect. The date of the latest update is stated above.