Klarhimmel Data Processing Terms
These terms apply where Klarhimmel AB ("we") processes personal data on behalf of a business customer ("you") under Article 28 of the GDPR. You are the controller; we are your processor.
1. What we process for you
- Klar Builder. People: visitors to your published page who use its contact form. Data: name, email address, message. Why: to deliver the messages to you, and, when you ask the assistant, to summarise them and draft replies.
- Klar Agent. People: your guests or customers who use your chat. Data: what they write, the agent's answers, a session id, a salted hash of their IP address, and name and contact details when they ask to be contacted. Why: to answer them from your facts, hand them over to your staff and show you the conversations.
- Studio subscription. People: people whose data is in material you give us (for example your customers in a brief or a file). Data: what that material contains. Why: to do the work you ask for.
We process the data only for these purposes and on your documented instructions, which are these terms and what you set up in the product. If we think an instruction breaks data protection law, we tell you.
2. How long
- Messages to your published page: 180 days, then deleted
- Klar Agent conversations: 12 months, unless you choose a shorter or longer period at setup
- Studio material: for the agreement, then returned or deleted within 30 days
When the agreement ends we delete the data within 30 days, or return it first if you ask. Copies in our providers' backups are overwritten in their normal cycle.
3. Our obligations
3.1 Only people who need it for the work can access the data, and they are bound to confidentiality.
3.2 We keep the data secure: encrypted in transit and at rest with our hosting provider, sign-in protected access for staff, access limited per customer, and logging of administrative access.
3.3 We tell you without undue delay, and at the latest within 48 hours of becoming aware, if a personal data breach affects your data, with what we know and what we are doing.
3.4 We help you answer requests from the people concerned (access, correction, deletion) and with impact assessments and prior consultation where you need it, as far as we reasonably can.
3.5 We give you the information you need to show that these terms are followed, and allow an audit once a year with 30 days' notice, at your cost, done in a way that does not reveal other customers' data.
4. Subprocessors
4.1 You authorise the subprocessors on the list in section 5. We bind each of them to data protection terms at least as protective as these.
4.2 We tell you at least 30 days before we add or replace a subprocessor, by email and on this page. If you object on reasonable data protection grounds and we cannot meet the objection, you may end the affected service without cost.
4.3 Where a subprocessor processes data outside the EU/EEA, the transfer relies on the EU-US Data Privacy Framework where the provider is certified, otherwise on the EU Standard Contractual Clauses.
5. Subprocessor list
- Cloudflare, Inc. Products: all. What they do: hosting, database, file storage, sign-in, bot check, sending email, logs. Where: database and stored files in the EU; its network, caches and temporary copies of public web pages run globally.
- Google LLC (Gemini API). Products: all. What they do: the AI model that writes answers, pages and summaries. Where: outside the EU possible (US).
- Google LLC (Sign in with Google). Products: Klar Builder, Studio. What they do: sign-in when you choose Google. Where: US.
- Stripe Payments Europe, Ltd. Products: Klar Builder, Klar Agent, Studio. What they do: card payments, when card payment is offered. Where: EU, with transfers to the US.
6. Your obligations
You have a legal basis for the data you let us process, you tell the people concerned (for Klar Agent we give you a short ready text), and you do not put special categories of data or secrets into texts the agent answers from.
7. Liability and term
Liability follows section 11 of the Business Terms. These terms last as long as we process personal data for you.