Klarhimmel Privacy Notice
Who we are
This is the privacy notice of Klarhimmel AB (org.nr 559537-4553, Sveavägen 83, 113 50 Stockholm). Klarhimmel AB is the controller for what is described here; contact [email protected]. We collect the minimum we need to do the work, and we never sell your data.
Where we handle data on a business customer's behalf (messages to a customer's published page, a customer's guests in Klar Agent), that business is the controller and we are its processor; see "When a business is responsible" below.
When you contact us or visit klarhimmel.com
We collect your email address when you write to us; your name and company for project discussions; and the project details you share. When you send a form on this site, your email address and message are stored with Cloudflare, the site's host, until we copy them into our own records, usually within minutes, and then deleted there (after 7 days at the latest). This website uses Cloudflare Web Analytics, which counts visits without cookies. If you arrive by a link we tagged, for example from one of our LinkedIn posts, your browser tab remembers which link until you close it, and we count per day how many visits, pages, sign-ins and purchases each link brought. It is the same label for everyone who used that link, with no cookie, no identifier and no third-party tracker.
Legal basis: our legitimate interest in answering you and running our business, or steps before a contract you ask for.
Klar Builder: pages you build
When you describe your business, give us a web address, or let your own AI agent build, we store your words and the page we make. A page you don't keep is deleted after 7 days. If you press Keep it or Email me my page, we keep it for 30 days; when you sign in, it moves into your workspace and stays as long as your account does. Email me my page uses the address you type to send that one email, through Cloudflare from notify.klarhimmel.com; we don't store it unless you open the email's sign-in link, which signs you in with that address. That link works for 7 days and once.
What you write in the chat on our homepage is stored for 90 days so we can improve the answers; email addresses and phone numbers are masked before it is stored, and it is not linked to your IP address.
A small cookie (__Host-kh_build) ties a page you are building to your browser until you keep it or it is deleted. It is needed for the service to work.
Legal basis: performing the service you ask for; our legitimate interest in improving it (the chat log).
Your account at app.klarhimmel.com
When you create an account, you sign in with your email and a one-time code that Cloudflare sends you, or with your Google account. We don't store passwords or codes. We store your email, the ID your sign-in provider gives us, the name of your workspace, when you accepted our terms, and what you do in the portal: your projects, requests, documents, messages and what you ask the assistant. A sign-in lasts 24 hours and uses a sign-in cookie. We also note which tagged link you first came by, to learn which posts bring customers; it is deleted with your account.
To stop automated sign-ups, Cloudflare Turnstile checks your browser, and we count sign-ups per IP address. We store only a one-way hash of the address, and delete the counts after 48 hours.
Your account data stays as long as your account does. Invoices and bookkeeping records are kept for seven years, as Swedish accounting law requires.
Legal basis: the contract with your business; legal obligation (bookkeeping).
Klar Agent
If your business uses Klar Agent, we store the names and email addresses of the staff who sign in to the Klar Agent portal, and the texts and settings they make. Your guests' conversations are handled for your business, which is responsible for them (below).
The Studio subscription
For Studio clients we keep contact details of the people we work with, the agreement, the requests, files and messages in the client portal, and invoices. Material you give us about your own customers is handled for you as your processor.
The Snapshot
The Snapshot researches a company from public sources: its own website, which we read politely and within its robots.txt, and Google Search. It is about the company, not about people. We refuse a request that contains an email address, a phone number or a personal identity number, and we replace the names of private persons that a website mentions. We store the result in the EU, together with a daily-changing hash of your IP address (never the address itself) to limit how many Snapshots one visitor can run. The company-level results may be used to improve later Snapshots.
AI processing
The homepage chat, the portal assistant, Klar Agent, the Snapshot and our workflows use Google's Gemini models through Google's API. We send what's needed for the task: your message, the context of your workspace (projects, briefs, the Snapshot summary), public web content and, when you ask about them, messages visitors sent from your live page (first name and words only). Processing may take place outside the EU, under the EU-US Data Privacy Framework and the EU Standard Contractual Clauses. Results from public web lookups are cached for 30 days.
AI output can be wrong. Self-serve results are marked as made by the assistant; work we deliver to you is checked by a person.
When a business is responsible
Messages to a published page. When a page is live, its contact form sends visitors' messages to the page's owner. We store the visitor's name, email address and message so the owner can read them in their workspace, and delete them after 180 days. If the owner asks the assistant about them, it sends the visitor's first name and words to Gemini to summarise them and draft replies; email addresses and phone numbers are replaced first, and we never write to the visitor.
Guests of a business using Klar Agent. When you chat with a business's agent, the business decides what the chat is for and is responsible for your data; Klarhimmel runs the chat for it. Your messages and the answers are stored for the business, sent to Gemini to write the answer, and, if you ask to be contacted, your name and contact details are sent to the business's staff. Your IP address is stored only as a salted hash. Ask the business, or us, to see or delete what you wrote.
Our terms for this are the data processing terms at klarhimmel.com/legal/dpa.
Who else sees data
Cloudflare (hosting, database, files, sign-in, bot check, email, logs), Google (Gemini, Sign in with Google), and Stripe when you pay by card. The full list with locations is in section 5 of the data processing terms. We share data with authorities only when the law requires it.
Logs
Our hosting provider keeps technical logs of requests (time, address requested, IP address, errors) for troubleshooting and security, for up to 7 days.
Your rights
You may ask to see the data we hold about you, have it corrected or deleted, restrict or object to our use of it, and get it in a portable form. Write to [email protected]; we answer within 30 days. You may also complain to the Swedish Authority for Privacy Protection (IMY), imy.se.
Changes
We change this notice when what we do changes, and date each version. We tell account holders by email about changes that matter to them.