This Privacy Policy explains how Kaorad Technology AB (“Vessla“, “we“, “us“) collects, uses, shares and protects personal data when you visit vessla.ai, subscribe to our newsletter, contact us, do business with us, or apply for a job with us. It also explains your rights and how to use them.
Using the Vessla platform, or a tenant or supplier of a property company that uses Vessla?
This policy does not cover the data handled inside the Vessla platform. There, Vessla works on behalf of the property company or organisation that uses it, and that organisation is responsible for your personal data. Its privacy notice explains how your data is used. To exercise your rights, contact that organisation. If you contact us instead, we will pass your request on to it without delay and tell you that we have done so.
1. Interpretation and definitions
Capitalised words in this policy have the meanings below. They apply equally in the singular and the plural.
Controller — the organisation that decides why and how personal data is processed, and is responsible for it under the GDPR.
Customer — an organisation that has an agreement with us to use the Vessla platform.
GDPR — Regulation (EU) 2016/679, the General Data Protection Regulation, together with the Swedish Data Protection Act (2018:218) that supplements it.
Personal data — any information relating to an identified or identifiable individual.
Service Provider — a company that processes personal data on our behalf, for example a hosting provider.
Website — our website at vessla.ai.
You — the individual whose personal data is processed.
2. Who we are
Kaorad Technology AB is the Controller for the processing described in this policy.
Org. no. 559585-2749
Tomtebogatan 11, 113 39 Stockholm, Sweden
Privacy questions and requests: privacy@vessla.ai
We have not appointed a Data Protection Officer, because the GDPR does not require us to. All questions about personal data go to privacy@vessla.ai. That inbox is handled by the person responsible for data protection at Vessla.
3. Personal data we collect
3.1 Information you give us
Enquiries. Your name, email address, phone number, organisation and role, and whatever you write to us, when you email or call us, for example to ask for a demo.
Newsletter. Your email address, when you subscribe to our newsletter on the Website.
Business contacts. Name, role, business email address and phone number of the people we deal with at Customers, prospective customers, suppliers and partners, for example contract signatories, invoice recipients and contact persons. We also keep our correspondence and meeting notes with them.
Job applications. Your CV, cover letter and application documents, notes from interviews, and any work samples or assessments.
3.2 Information collected automatically
Website connection data. When you visit the Website, our hosting provider records technical data needed to deliver the page and keep the site secure: your IP address, the date and time of the request, the page requested, your browser type, and the referring page.
Website statistics. We use Framer Analytics, the statistics built into our website platform, to count visits and see which pages are used. It sets no cookies, stores nothing in your browser and creates no lasting identifier. When you visit, your browser sends the page address, the referring page, your language and time zone, and page performance measurements. To count unique visitors per day, Framer combines your IP address and browser details into a hashed value using a key that is replaced and deleted every day, so you cannot be recognised from one day to the next. We only see aggregated numbers, never individual visitors.
We do not use advertising or tracking tools, and we do not build visitor profiles.
3.3 Information from other sources
Publicly available business information. To find relevant people at property companies, we may use business contact information that organisations publish themselves, such as names and roles on a company website or in company registers. {{[Confirm] which sources are used in prospecting, e.g. company websites, Bolagsverket, LinkedIn, and whether any data provider or CRM is used. Remove this bullet if none.}}
Your organisation. A colleague may give us your contact details, for example when naming you as a contact person in an agreement.
3.4 What we do not collect
We do not ask for sensitive data, such as health, religion or ethnicity. We do not collect payment card data, and we do not buy personal data from data brokers.
4. How we use your personal data
We use personal data to:
answer enquiries, and arrange the meetings and demos you ask for;
send our newsletter to people who have subscribed, and tell relevant people at property organisations about Vessla;
understand how the Website is used, using aggregated visit statistics;
enter into and manage agreements with Customers, suppliers and partners, including contracts, onboarding, invoicing and day-to-day communication;
keep accounting records as required by law;
recruit: assess applications, arrange interviews and make hiring decisions;
keep the Website secure and available, and detect and prevent abuse and attacks;
meet legal obligations and protect our rights: respond to lawful requests from authorities, establish, exercise or defend legal claims, and support audits of our information security management system, including ISO/IEC 27001 certification audits; and
carry out a business transaction: evaluate or complete a merger, acquisition, financing or sale of all or part of our business (see Section 7).
We do not sell personal data, use it for advertising, or use it to train AI models.
5. Legal bases for processing
Purpose | Legal basis | Our legitimate interest, where relevant |
|---|---|---|
Answering enquiries, meetings and demos | Legitimate interest (Art. 6(1)(f)), or steps you ask us to take before entering a contract (Art. 6(1)(b)) | Answering people who contact us |
Newsletter | Consent (Art. 6(1)(a)), given when you subscribe | — |
Website statistics | Legitimate interest (Art. 6(1)(f)) | Understanding which pages are useful, while identifying no one and storing nothing in the visitor’s browser |
Business-to-business marketing | Legitimate interest (Art. 6(1)(f)); consent (Art. 6(1)(a)) where the law requires it for electronic marketing | Telling relevant organisations about a product for their business |
Agreements with Customers, suppliers and partners | Contract (Art. 6(1)(b)) where you are the party; otherwise legitimate interest | Managing the agreement with the organisation you represent |
Accounting records | Legal obligation (Art. 6(1)(c)): Swedish Bookkeeping Act (1999:1078) | — |
Recruitment | Steps before entering a contract (Art. 6(1)(b)), and legitimate interest | Keeping a record sufficient to respond to a discrimination claim |
Website security | Legitimate interest (Art. 6(1)(f)) | Protecting our infrastructure against attack and abuse |
Legal obligations, legal claims and audits | Legal obligation or legitimate interest | Protecting our rights and demonstrating compliance |
Business transactions | Legitimate interest (Art. 6(1)(f)) | Being able to carry out a merger, acquisition or financing |
Where we rely on legitimate interest, we have weighed our interest against your rights and expectations. You can ask us for more information about that assessment, and you have the right to object (Section 10).
Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing that took place before it.
6. How long we keep personal data
We keep personal data only as long as we need it for the purpose it was collected for, and then delete or anonymise it.
Category | Retention period |
|---|---|
Website connection data | {{[Confirm] Framer’s log retention}} |
Newsletter subscription | Until you unsubscribe |
Website statistics | Visitor hashes: one day. After that only aggregated statistics remain, which do not identify anyone |
Enquiries | 24 months from our last contact with you |
Sales and marketing contacts | 24 months from the last meaningful contact, or until you object |
Contact persons at Customers, suppliers and partners, and the related correspondence | The term of the agreement plus 12 months |
Accounting records, including invoices | 7 years, as required by the Swedish Bookkeeping Act |
Job applications | 2 years after the recruitment process ends |
We may keep data longer where the law requires it, or where it is needed to establish, exercise or defend a legal claim. In that case we keep only what is necessary, and only for as long as necessary.
7. Who we share personal data with
7.1 Service providers
We use a small number of Service Providers to run our Website and our business. They may use personal data only to provide their service to us, under written data processing agreements.
Provider | What they do for us | Where data is processed |
|---|---|---|
Framer B.V. | Hosting of the Website, website statistics, and the newsletter sign-up form | {{[Confirm] Framer’s processing location (the site is served from eu-central-1, Frankfurt) and that Framer’s DPA is accepted for this workspace}} |
{{[Confirm] newsletter tool, if subscriptions are forwarded from Framer to e.g. Mailchimp or Brevo, or sent by email}} | Sending the newsletter | |
Google Ireland Ltd (Google Workspace) | Our email, calendar and documents, including our correspondence with you | EU {{[Confirm] the Workspace data region setting}} |
{{[Confirm] accounting, payroll, CRM and applicant-tracking providers, and add a row for each that processes data covered by this policy}} |
7.2 Advisers, auditors and insurers
We may share personal data with our lawyers, accountants and insurers, and with auditors and certification bodies that audit our information security management system, where they need it to advise us or do their work. They are bound by confidentiality.
7.3 Business transactions
If we are involved in a merger, acquisition, financing, or sale of all or part of our business, personal data may be shared with the other parties and their advisers under confidentiality, and transferred to a new owner. We will tell you before your personal data becomes subject to a different privacy policy.
7.4 Authorities and legal requirements
We may disclose personal data where we are required to by law, by a court order, or by a valid request from a public authority. Where the law allows, we will tell you.
7.5 Protecting rights and safety
We may disclose personal data where necessary to establish, exercise or defend legal claims; to investigate or prevent fraud, security incidents or other wrongdoing; or to protect the rights, property or safety of Vessla or others.
7.6 With your consent
We may share personal data for other purposes if you ask us to or agree to it.
We do not sell personal data, share it for advertising, or give it to data brokers.
8. International transfers
We store and process personal data within the EU/EEA. The only exception is our email provider, Google: our email is stored in the EU, but Google may access it from outside the EU/EEA when needed to provide support and security. That access is protected by the EU–U.S. Data Privacy Framework and the EU Standard Contractual Clauses. You can ask for a copy of these safeguards by writing to privacy@vessla.ai.
9. How we protect personal data
We protect personal data with technical and organisational measures appropriate to the risk. These include encryption in transit and at rest, multi-factor authentication and least-privilege access for our staff, logging and monitoring, confidentiality obligations and regular security and data protection training for everyone who works for us, and a documented incident response process. Our information security programme follows the ISO/IEC 27001 framework.
No method of transmission or storage is completely secure. If a personal data breach occurs, we notify the Swedish Authority for Privacy Protection (IMY) within 72 hours where required. Where a breach is likely to put you at high risk, we also tell you without undue delay.
10. Your rights
Under the GDPR you have the right to:
Access — find out whether we process your personal data, and receive a copy of it together with information about how we use it.
Rectification — have inaccurate data corrected and incomplete data completed.
Erasure — have your data deleted, for example where we no longer need it, where you withdraw consent, or where you successfully object. We may keep data the law requires us to keep, such as accounting records.
Restriction — ask us to limit our use of your data, for example while we check its accuracy or assess an objection.
Data portability — receive data you have given us, where we process it by consent or contract, in a structured, commonly used and machine-readable format, and have it sent to another organisation where technically feasible.
Objection — object at any time to processing based on our legitimate interests. We will then stop unless we have compelling legitimate grounds that override your interests, or need the data for a legal claim. You can always object to direct marketing, and we will then stop.
Withdrawal of consent — withdraw consent at any time, where we rely on it.
Automated decisions — not be subject to a decision based solely on automated processing that produces legal or similarly significant effects for you. We do not make such decisions.
How to exercise your rights. Email privacy@vessla.ai. We reply within one month of receiving your request. If a request is complex, or we receive many, we may extend this by up to two further months, and we will tell you why within the first month.
Exercising your rights is free. We may charge a reasonable fee or refuse only where a request is clearly unfounded or excessive, and we will explain why.
We may need to verify your identity before acting on a request, for example by replying to the email address we hold for you. We ask only for what is necessary to do so.
If we refuse a request, we tell you why and remind you of your right to complain (Section 15).
11. Newsletter and marketing
You can unsubscribe from the newsletter at any time, using the link in every newsletter or by emailing privacy@vessla.ai.
Other than the newsletter, we send product news and invitations only to business contacts, and only where the law allows it: either because you asked for them, or because you are a contact at an organisation we reasonably believe has an interest in Vessla. Every marketing email includes an unsubscribe link, and you can also email privacy@vessla.ai. When you opt out we stop, and keep only a note that you opted out, so that we do not contact you again.
12. Cookies
Our Website sets no cookies and stores nothing in your browser. The website statistics described in Section 3.2 work without cookies, and we use no advertising or tracking tools. Because nothing is set, there is no cookie banner. If this ever changes, we will update this section first, and ask for your consent before setting any non-essential cookie.
{{[Confirm] Google Fonts: the Website loads fonts from fonts.googleapis.com and fonts.gstatic.com, so every visitor’s IP address goes to Google (verified 2026-10-07). Upload the fonts to Framer as custom fonts, so they are served from Framer (recommended), then delete this note. Otherwise, add Google Fonts as a recipient in Section 7.1 and a transfer in Section 8.}}
13. Children
The Website is intended for businesses and is not directed at children. We do not knowingly collect personal data from children under 16. If you believe a child has given us personal data, contact us and we will delete it.
14. Links to other websites
The Website may link to websites we do not operate, such as social media. We are not responsible for their content or privacy practices. Please read their privacy policies.
15. Complaints
If you are unhappy with how we handle your personal data, please contact us first at privacy@vessla.ai and we will try to resolve it. You always have the right to lodge a complaint with the supervisory authority:
Integritetsskyddsmyndigheten (IMY), the Swedish Authority for Privacy Protection
Box 8114, 104 20 Stockholm, Sweden · imy.se
You may also complain to the supervisory authority in the EU country where you live or work.
16. Changes to this policy
We may update this policy, for example when we change a Service Provider. When we do, we update the date at the top. If a change is material, we give clearer notice before it takes effect, for example on the Website. Previous versions are available on request.
17. Contact
Questions about this policy or your personal data: privacy@vessla.ai
Kaorad Technology AB
Tomtebogatan 11, 113 39 Stockholm, Sweden