Legal

Privacy Policy

Last updated · 31 August 2026

Systown (“we”, “us”) respects your privacy. This policy explains what personal data we collect on systown.ai, why we collect it, and the rights you have under the EU General Data Protection Regulation (GDPR). The short version: we collect only what you give us, we run no advertising or analytics trackers, and we never sell personal data.

Who is responsible

Systown is the data controller for personal data processed through this website.

Organisation number: 559163-5031 · VAT: SE559163503101
Address: Kungsgatan 8 · KG10 · Stockholm, Sweden
Email: ai@systown.ai

What we collect and why

We process personal data in three situations:

Contact and briefing requests. When you use the contact form we collect your name, email address and message, and — if you choose to provide them — company, role, industry, fleet size, timeline and site details. We use this to respond to your request and prepare a briefing (legal basis: steps prior to entering a contract, and our legitimate interest in responding to inquiries). The form is delivered to us by email; we do not add you to any mailing list.
Portal accounts. If you register for the Systown portal we process your email address and profile details to create and operate your account (legal basis: performance of a contract).
Security and abuse prevention.We process IP addresses for rate limiting, and the contact form is protected by Google reCAPTCHA, which assesses whether a submission is automated (legal basis: our legitimate interest in keeping the site secure). reCAPTCHA loads only when you interact with the contact form; Google’s processing is described in the Google Privacy Policy.

Cookies and local storage

We use only what is essential to run the site. Your cookie choice is stored in your browser’s local storage so we do not ask again. Portal login uses essential authentication cookies. We run no advertising trackers and no analytics today; if we ever add analytics, they will load only after you choose “Accept all” in the cookie banner, and this policy will be updated first.

Service providers

We use a small number of providers who process data on our behalf under data processing agreements:

Vercel — website hosting and content delivery.
Resend — delivery of contact-form email to us and confirmations to you.
Supabase — authentication and database for the portal.
Google reCAPTCHA — contact-form abuse protection (loads only on the contact form).
Spline — serves assets for the 3D scenes on some pages.

Some providers may process data outside the EU/EEA (for example in the United States). Where that happens, the transfer is protected by the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

How long we keep data

Contact and briefing requests: as long as needed to handle the request and any follow-up, then deleted.
Portal accounts: for as long as the account exists; deleted on account closure except where law requires longer retention.
Security logs and rate-limit data: short-lived and rotated automatically.

Your rights

Under the GDPR you have the right to:

access the personal data we hold about you;
have inaccurate data corrected and, in many cases, have data deleted;
restrict or object to processing based on legitimate interest;
receive the data you provided in a portable format;
withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email ai@systown.ai. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority.

Changes to this policy

We may update this policy as the site or our services evolve. The date at the top shows when it was last revised. Material changes will be announced on this page before they take effect.