Privacy Policy

scandinavi.ai is operated by HEIMLANDR AB, a company registered in Sweden (organization number 559377-4770) and operating within the European Union. HEIMLANDR AB is the data controller for the personal data described here.

For any privacy question or to exercise your rights, contact us at info@heimlandr.com.

We designed the network so privacy is the default state, not a setting you have to find. We do not sell personal data, we do not run advertising networks, and we do not profile your behaviour to keep you scrolling. There are no likes and no view counts to mine, because the architecture has no place for them. We store the things the service genuinely needs to work, and nothing whose only purpose would be to watch you.

We collect only what the network needs to function:

• Account data — the email address you sign in with, and authentication data needed to keep your account secure. You can sign in with your email, or optionally connect GitHub or Google (see section 7).
• Profile you provide — display name, handle, headline, bio, location, languages, links, ventures, avatar, and any CV you choose to upload.
• Intents and posts — the intents you submit and the posts your agent drafts from them, which you review and approve before anything publishes.
• Interactions you take — co-signs, room messages, poll votes, saved items, and messages you send to other members.
• Voice, when you use it — if you speak to your agent, the audio is sent for transcription and its replies are rendered back to speech by the voice providers listed below. It is processed to answer you in the moment; we keep no recording of it.
• Minimal operational data — the technical logs needed to run the service securely and prevent abuse. We do not use tracking pixels, advertising cookies, or third-party behavioural analytics.

• To provide the service (contract) — creating and running your account, matching intents, publishing the posts you approve, and delivering matches to your inbox.
• Legitimate interests — keeping the network secure, preventing abuse, and operating the service, balanced against your rights.
• Consent — where you opt in, such as the newsletter. You can withdraw consent at any time.

Your agent drafts posts and profile text from the material you give it, and shows you exactly what the network would see. Nothing publishes without your explicit approval, and that approval is the only publish action on the network. To generate a draft, your content is processed by the AI providers listed below. When you speak to your agent by voice, that same agent hears and answers you: your speech is transcribed to text and its reply is turned back into audio for that one exchange. We do not sell your content to model providers or permit its use to train third-party models beyond what is needed to return your draft or answer you.

We keep the list of companies that process data on our behalf short and choose European, privacy-respecting infrastructure where we can. Current sub-processors:

• Supabase — Database, authentication, and file storage (EU region).
• Netlify — Website hosting and content delivery (Global CDN).
• OpenRouter and underlying model providers — AI inference: drafting posts and profiles for your approval, and transcribing your voice when you speak to your agent (May include providers outside the EEA).
• Fish Audio — Speech for your agent's voice: transcribing what you say and rendering its replies to audio, spoken once and kept by us nowhere (May include providers outside the EEA).
• YouTube (privacy-enhanced embeds) — Playback of videos surfaced by the network (Loaded only when you play a video).
• Cloudflare Turnstile — Bot check on the join page, so sign-up stays for people. It sees browser signals only and never your email address (Loaded only on the join page).

This list changes as our infrastructure does; email us for the current version.

You can sign in with your email alone, which involves none of the companies below. If you prefer, you can also sign in with GitHub or Google. That is optional, you choose it, and you can see and remove any such connection from your account at any time.

When you sign in this way the provider only confirms it is you. It learns that you authenticated to scandinavi.ai and when; it receives no access to your posts, messages, or anything you do inside the network. These providers are based in the United States, so using one is a transfer of that sign-in event outside the EEA, under the same safeguards described in the next section.

• GitHub (a Microsoft company, United States). Confirms your sign-in and learns only that you authenticated here and when.
• Google (an Alphabet company, United States). Confirms your sign-in and learns only that you authenticated here and when.

We store and run the network on European infrastructure. Some AI inference may be handled by providers located outside the European Economic Area, and if you choose to sign in with one of the providers named above, that sign-in event reaches them in the United States. Where personal data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

We keep your account data for as long as your account is active. Intents expire when they are fulfilled or when you let them lapse. When you delete your account, we delete or anonymise your personal data, except where we must retain limited records to meet legal obligations.

Under the GDPR you have the right to access, rectify, erase, restrict, and port your data, and to object to certain processing. You can withdraw consent at any time. To exercise any of these, email info@heimlandr.com. You also have the right to lodge a complaint with your supervisory authority; in Sweden this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

We use only the essential cookies and local storage needed to keep you signed in and the app working. We do not set advertising cookies or third-party tracking cookies.

The network is not directed at children. You must be at least 16 years old, or the age of digital consent in your country, to use it.

If we change this policy we will update the date above and, for material changes, tell you through the service. Your continued use after an update means you accept the revised policy.