Legal

Privacy Policy

Last updated · 13 September 2026

Systown (“we”, “us”) respects your privacy. This policy explains what personal data we collect on systown.ai, why we collect it, and the rights you have under the EU General Data Protection Regulation (GDPR). The short version: we collect only what you give us, we run no advertising or analytics trackers, and we never sell personal data.

Who is responsible

Systown is the data controller for personal data processed through this website.

Organisation number: 559163-5031 · VAT: SE559163503101
Address: Kungsgatan 8 · KG10 · Stockholm, Sweden
Email: ai@systown.ai

What we collect and why

We process personal data in the following situations:

Contact and briefing requests. When you use the contact form we collect your name, email address and message, and — if you choose to provide them — company, role, industry, fleet size, timeline and site details. We use this to respond to your request and prepare a briefing (legal basis: steps prior to entering a contract, and our legitimate interest in responding to inquiries). The form is delivered to us by email; we do not add you to any mailing list.
Portal accounts. If you register for the Systown portal we process your email address and profile details to create and operate your account (legal basis: performance of a contract).
Security and abuse prevention.We process IP addresses for rate limiting, and the contact form is protected by Google reCAPTCHA, which assesses whether a submission is automated (legal basis: our legitimate interest in keeping the site secure). reCAPTCHA loads only when you interact with the contact form; Google’s processing is described in the Google Privacy Policy.

Contact enquiries are stored in Supabase so the authorised Systown administrator can review requests, record follow-up notes and respond. Resend sends acknowledgements and internal notifications. An internal weekly summary of contact enquiries and PLANT waitlist activity helps us manage follow-up; it is not a marketing subscription.

Systown PLANT waitlist

When you join the PLANT waitlist, we collect your email address and, if you choose, your name, company, area of interest and operational question. We record the consent wording version, request time and email confirmation. We use this information for PLANT product updates and future pilot opportunities, based on your consent.

Supabase stores these records, Vercel hosts the form, and Resend delivers confirmation emails. Only the authorised waitlist administrator can review signups. Confirm your email before receiving updates. Every waitlist email includes an unsubscribe link; you can also contact us at ai@systown.ai to withdraw consent or request deletion. Signup details are not sent to analytics.

We retain waitlist information while it is needed for the requested updates and pilot discussions. Unsubscribing stops updates; we retain the withdrawal record to respect your choice. You can request deletion of your record at any time. We review retained records when the pilot programme changes or ends.

Job applications

Applications submitted through /join are used for the relevant recruitment and sent to our hiring contact through Resend. See the dedicated recruitment privacy notice for the data collected, legal basis, recipients, retention criteria and your rights. No automated candidate ranking is used.

Cookies and local storage

Essential cookies and local storage run the site: your cookie choice is stored in your browser’s local storage so we do not ask again, and portal login uses essential authentication cookies. We run no advertising trackers.

If you choose “Accept all” in the cookie banner, we additionally load Google Analytics to understand how the site is used (pages visited, approximate region, device type). It sets _gacookies and does not load at all if you choose “Essential only” (legal basis: consent, which you can withdraw by clearing this site’s data in your browser — the banner will then ask again).

Service providers

We use a small number of providers who process data on our behalf under data processing agreements:

Vercel — website hosting and content delivery.
Resend — delivery of contact-form and recruitment email to us and confirmations to you.
Supabase — authentication and database for the portal.
Google reCAPTCHA — contact-form abuse protection (loads only on the contact form).
Google Analytics — audience measurement (loads only after you choose “Accept all”).

Some providers may process data outside the EU/EEA (for example in the United States). Where that happens, the transfer is protected by the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

How long we keep data

Contact and briefing requests: as long as needed to handle the request and any follow-up, then deleted.
Portal accounts: for as long as the account exists; deleted on account closure except where law requires longer retention.
Security logs and rate-limit data: short-lived and rotated automatically.

Your rights

Under the GDPR you have the right to:

access the personal data we hold about you;
have inaccurate data corrected and, in many cases, have data deleted;
restrict or object to processing based on legitimate interest;
receive the data you provided in a portable format;
withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email ai@systown.ai. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority.

Changes to this policy

We may update this policy as the site or our services evolve. The date at the top shows when it was last revised. Material changes will be announced on this page before they take effect.