ANVL Privacy Policy

Last updated: 2026-09-01 In force from: 2026-09-01 Version: 1.0

1. About this policy

This policy describes how Dalarna Digital Marketing Agency AB ("we", "us", "ANVL") processes personal data when you use ANVL — our AI-driven platform for websites, brand profiles, presentations and content.

The policy covers:

• the marketing site anvl.work,
• the application app.anvl.work and the supporting services that run it,
• the public customer sites published with ANVL — but only to the extent that we process data on our own behalf. See section 3 on our dual role.

The policy does not cover how our customers use their own tools outside ANVL, or third-party services you choose to connect (see section 16).

2. Definitions

3. Controller — and when we are a processor instead

We have two roles, and which one applies determines what you can ask of us.

3.1 We are the controller

…for data where we determine the purposes ourselves:

• accounts, sign-in and security (users, passkeys, sessions, security logs),
• access requests, invitations and trial periods,
• invoicing, consumption metering and customer care,
• our own marketing and communication,
• operations, troubleshooting, abuse prevention and improving the platform.

Controller: Dalarna Digital Marketing Agency AB, company registration number 556942-8427, Slaggatan 13, 791 71 Falun, Sweden. Contact: privacy@anvl.work.

3.2 We are a processor

…for personal data that our customers put into, or collect through, their own sites and projects in ANVL: contact forms, newsletter sign-ups, email arriving in contact details in brand material, photographs of people in the media library, and visitor statistics on the customer's site.

There the customer is the controller and determines the purposes. We process the data on the customer's documented instructions and under the data processing agreement (DPA) that forms part of our contract. If you are a visitor or a contact of one of our customers, address your request to that customer first — we help the customer answer.

4. What personal data we process

4.1 Data you give us

4.2 Data collected automatically

4.3 Customer content

Pages, text, images, logotypes, brand profiles, presentations, social posts, uploaded files, chat messages to the AI assistant, interview answers and version history. The content may contain personal data if you choose to put it there — photographs of staff, customer quotes, contact details.

We keep version history for pages, brand profiles, presentations and designs. Deleted text may therefore remain in an earlier version until the history is erased.

4.4 Data about websites we analyse for you

If you ask an agent to analyse a web address — brand import, SEO review, accessibility scan, performance measurement or screenshot — we fetch the public page and process its content. If the page contains personal data, that data is processed as part of the task.

4.5 Visitors to sites built in ANVL

On a published customer site we process:

• Always: technical information required to deliver the page (IP address in server logs), the consent cookie, and the password cookie for password-protected pages.
• Always, to a third party: fonts are fetched from Google's font service, which means the visitor's IP address is sent to Google on page load. See section 9.3.
• If the visitor submits data: email address on newsletter sign-up, and whatever the visitor writes in contact forms.
• Only with consent: statistics via Google Analytics 4 and Google Tag Manager, where the customer has configured it.
• With embedded content: if a page embeds a YouTube video it uses the mode without tracking cookies (youtube-nocookie.com), but the video still loads from Google's servers and the visitor's IP address reaches them on playback.

4.6 Sensitive data

Do not put sensitive data into ANVL. That means health, ethnicity, religion, political opinions, trade union membership or sex life, and it also means biometric data, national identity numbers, criminal records and payment card numbers.

The service is not built to handle those, and nothing in it asks you for them. If such data ends up here anyway, we still protect it under this policy and our agreement — but we may ask you to remove it.

5. Why we process the data — purposes and legal basis

You may withdraw consent at any time without affecting the lawfulness of processing before the withdrawal, and object to processing based on legitimate interests — see section 13.

6. AI processing

ANVL generates content using large language models and image models.

How the calls are made. Generation runs on language and image models from external providers. Every call goes through our own AI proxy, which holds the API keys and logs consumption. We use the providers' API services, not their consumer products. Which providers are engaged, and where each of them processes data, is listed in section 7.

What is sent there. The prompt the function builds — which may contain your customer content, your brand material, and text from a website you asked us to read. Do not send personal data you do not want to leave our infrastructure.

No model training. We do not permit our providers to use content sent via the API to train their models, and we do not train models of our own on your content. We may use de-identified and aggregated statistics (number of runs, token consumption, error rate) to improve the service.

What we log ourselves. Every AI call is logged with function, model, token consumption, cost, run time, and a link to user and site. The prompt and the brand material that accompanied it may be stored for troubleshooting and quality follow-up. If you want prompt logging switched off for your account, contact privacy@anvl.work.

Brand memory. The platform may keep a per-customer memory of how you steer generation — what you create and how you adjust it — to make future suggestions more accurate. The memory is tied to your organisation, not to an individual, and is used only for your own generation.

Automated decision-making. We make no automated decisions that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The AI proposes content — a human reviews and publishes.

AI output is not fact. Generated content can contain errors. You are responsible for reviewing it before you publish.

7. Recipients and sub-processors

We never sell personal data. We share it only with the recipients below, and only to the extent necessary.

7.1 ScreenshotOne — a disclosed shortcoming

ScreenshotOne states in its own privacy policy (last updated 2025-11-15) that the company "is not yet compliant with the GDPR", and that a data processing agreement is "available on request" — that is, not entered into. Their database and API run on DigitalOcean in the USA; the headless browsers that take the screenshot run on Google Cloud in the USA.

The function is used by the research agent in the presentation tool and takes screenshots of public URLs you specify yourself. It sends no account details and no customer content. The service is disabled when no API key is configured.

We have not entered into a processor agreement with ScreenshotOne, and we disclose that openly rather than claim otherwise. The service is on its way out — we are moving the function to our own rendering service.

All sub-processors are bound by data processing agreements with obligations equivalent to our own. If we replace or add a sub-processor that processes customer data, we inform affected customers in reasonable time in advance, and the customer has the right to object. If you are a customer, the notice period stated in the data processing agreement applies — it is binding and takes precedence over this wording.

8. Disclosure on legal demand and abuse

We may disclose personal data where it is necessary to

• comply with law, a court order or a valid request from a competent authority,
• investigate, prevent or address fraud, security incidents or abuse of the service,
• establish, exercise or defend legal claims.

We disclose only what is actually requested, assess every request, and notify the affected customer unless we are legally prevented from doing so.

9. Cookies and similar technologies

9.1 How consent works

Necessary cookies are set without consent — they are required for the service to work. Statistics and marketing cookies are set only after active consent: the default is off, and no such scripts load before you have chosen.

9.2 Cookies we use

Google Consent Mode v2 is used where Google tags are present: the default state is "denied" and is sent before the tags load, and is updated when you make your choice.

Change your mind whenever you like. Click "Cookie settings" in the footer, or clear cookies in your browser. Declining statistics and marketing does not affect how the service works. When we change the categories, you are asked again.

9.3 Transfers that are not cookies

Some functions send the visitor's IP address to a third party without setting any cookie. That still counts as processing of personal data:

• Fonts. Published sites fetch fonts from Google's font service (fonts.googleapis.com / fonts.gstatic.com). The visitor's IP address is transferred to Google on every page load. We are working to serve the fonts from our own infrastructure instead.
• Embedded video. Where a page embeds YouTube, the cookieless mode is used, but the IP address reaches Google when the video loads.
• Maps and other embeds that a customer chooses to add work the same way and are controlled by the customer.

10. Logs and security events

We log sign-ins, failed sign-in attempts, changes to security settings, registration of passkeys and similar, together with IP address, user agent and timestamp. The logs are used to detect intrusion attempts, to troubleshoot, and to be able to show what has happened on an account — not to monitor how individual employees work.

11. How long we keep the data

Erasure in live operation takes effect in backups only once the backup has been rotated out.

12. Security

• Sign-in without passwords. ANVL uses passkeys (WebAuthn/FIDO2). The private key never leaves your device, and the passkey is bound to our domain — which makes phishing ineffective. Password sign-in and one-time codes are being phased out and are used only for accounts that have not yet moved over.
• Encryption. All traffic runs over TLS. Session cookies are httpOnly, secure and sameSite.
• Authorisation. Role-based access per organisation and site — users reach only what they are entitled to.
• Isolation. Each customer is its own tenant; content and files are separated by site ID.
• Backup. Regular backups of database and files.
• Personal data breach. On a confirmed incident carrying risk, we notify the Swedish Authority for Privacy Protection (IMY) within 72 hours of becoming aware of it. Affected customers are notified without undue delay and no later than 48 hours — that deadline is stated in the data processing agreement and is binding.

Your responsibility. Protect your device and your sign-in methods, do not share accounts, and contact security@anvl.work immediately if you suspect unauthorised access.

No service is entirely without risk. We cannot guarantee uninterrupted availability at our suppliers, and outages at them may affect access to the service.

13. Your rights

Under the GDPR you have the right to

• access the personal data we process about you (a subject access request),
• have inaccurate data corrected,
• have data erased when it is no longer needed, or where the processing rested on consent,
• request restriction of the processing,
• object to processing based on legitimate interests, and always to direct marketing,
• receive your data in a machine-readable format and transmit it (data portability),
• withdraw consent at any time.

How to do it: email privacy@anvl.work. We may need to verify your identity. We respond without undue delay and at the latest within one month; where a request is complex we may extend by two months and will then tell you why.

If you are a visitor or a contact of one of our customers — address the customer (see 3.2).

Complaints. You always have the right to lodge a complaint with the supervisory authority:

Integritetsskyddsmyndigheten (IMY), the Swedish Authority for Privacy Protection Box 8114, 104 20 Stockholm, Sweden imy@imy.se — +46 8 657 61 00 — imy.se

14. Children

ANVL is a service for businesses and is not directed at children. We do not knowingly collect personal data from people under 18. If we learn that an account belongs to a child, we erase the data.

15. Transfers to third countries

Our database, our servers and our uploaded files are held by Oderland Webbhotell AB in Gothenburg, Sweden. Several of our sub-processors — chiefly the AI providers and Google — process data in the USA. Such transfers are made on the basis of

• the European Commission's Standard Contractual Clauses (SCC), module 2 (controller to processor), decision 2021/914, and
• the EU–US Data Privacy Framework where the provider is certified,

together with supplementary safeguards: encryption in transit, data minimisation, and no training on your content.

You may request a copy of the safeguards we apply via privacy@anvl.work.

16. Links and integrations

ANVL may link to or integrate with services we do not control — Google, social platforms, domain and email providers, and the websites you ask our agents to analyse. When you use such a service, their privacy policy applies. We are not responsible for how they process your data.

17. Changes to this policy

We update the policy when the service, the law or our suppliers change. The latest version is always at anvl.work/privacy with the update date at the top.

For material changes — those that reduce your rights or extend the purposes — we notify you by email or by a notice in the product at least 30 days before they take effect.

18. Contact

18.1 Data protection officer

We have no data protection officer, and that is a considered decision rather than an oversight. We assessed Art. 37(1) GDPR on 2026-08-31:

• 37(1)(a) — we are not a public authority or body.
• 37(1)(b) — our core activity is developing the platform, not regular and systematic monitoring of people on a large scale. We carry out no behavioural analysis and no automatic profiling of individuals.
• 37(1)(c) — we do not process sensitive data on a large scale. The service is built for design and content, and we never ask for such data (see 4.6).

The decision is reassessed on three events: when the platform moves from closed beta to general availability, when the number of active users means the processing could be regarded as "large scale", or if the service begins to store or analyse sensitive personal data. The assessment is documented internally and signed by the company's owner.

19. Severability

Should any provision be found invalid or unenforceable, it shall be interpreted so as to achieve its purpose as closely as possible. The remaining provisions apply unchanged.

20. Governing law

Swedish law applies to this policy and to the processing of personal data in ANVL, together with the GDPR and other applicable EU law.