Privacy Policy for kobbi

Velona AB, company registration number 559577-0453, Sisjöbäckens Väg 22 Lgh 1002, 436 38 Askim, Sweden. VAT number SE559577045301.

Velona AB provides kobbi — an AI assistant that answers messages in your business channels (WhatsApp, Instagram DM and web chat) and can look up catalogue, stock, order and return data.

Data protection contact: dataskydd@kobbi.se.

This policy covers two separate situations. Which one applies to you decides who you should contact.

Part A — Velona AB is the controller. This applies if you visit kobbi.se, request a demo, are a contact person at a customer, or receive an invoice from us. Here Velona AB decides the purposes and means of the processing.

Part B — Velona AB is the processor. This applies to the messages end users send to a business that uses kobbi. There our customer is the controller, and Velona AB processes the data only on that customer’s documented instructions and under the data processing agreement signed with each customer (GDPR art. 28).

Did you write to a company’s kobbi assistant and want your data erased? Then contact that company, not Velona AB. We assist the company and forward your request if you contact us anyway — see the Delete data page.

Part A — where we are the controller:

• Contact details: name, email address, phone number, company and job title.
• Account details: user name, hashed password, sign-in times and IP address.
• Billing and contract data: billing address, company registration number, VAT number and payment history.
• Technical logs: error messages, calls to the service and browser type.
• Swedish personal identity number (personnummer) or coordination number (samordningsnummer) — only where the customer is a sole trader and the identity number is needed for invoicing. For a sole trader the company registration number is the same as the owner’s personal identity number.

Part B — where the customer is the controller and we are the processor:

• The content of messages between the end user and the customer’s assistant — text, image, audio and attachments.
• Channel identifiers: WhatsApp phone number, Instagram ID and profile name.
• Commerce and order data the customer has made available to the assistant, such as order number, delivery address and return status.

Swedish personal identity numbers. The assistant never asks end users for a personnummer, and if one is sent in a message anyway it is masked before the data reaches our logs or our error monitoring. We do, however, ask for a personnummer in our own customer panel when the customer is a sole trader — see the Part A list above.

Below is the current list of sub-processors that process personal data on our behalf. We notify our customers before the list changes.

Two rows are deliberately incomplete. We would rather say that the information is missing than state a processing location we have not verified.

WhatsApp — the limits of EU data storage. EU data storage (Germany) is selected for our WhatsApp numbers. The setting has two known limits that we state openly: while a message is being processed the content may sit in international data centres for up to 60 minutes, and the setting does not cover address book data.

Instagram — no EU data storage. Meta does not offer EU data storage for Instagram DM. We therefore cannot promise that Instagram messages are processed only within the EU/EEA. What we do is data minimisation: we do not fetch or keep more than is needed to answer the message.

DeepSeek processes message text in China. The European Commission has not adopted an adequacy decision for China. We are documenting the legal basis for that transfer and will state it here once it is in place. We do not claim the basis exists before we can show it.

What is sent to the model is the content of the message and the information needed to compose a reply.

Google (Gemini API) is used for image, audio and embeddings. The endpoint is global and we have not fixed a processing region. We therefore do not promise that this processing happens within the EU/EEA.

For Instagram DM, Meta cannot offer EU data storage; see section 5.

Do you not want your messages handled by an AI assistant? Contact the business you wrote to and ask for another channel, such as phone or email.

We do not keep data longer than the purpose requires (GDPR art. 5(1)(e)).

The default retention for conversations and messages is 12 months. A customer can agree a different retention period with us; it is not a setting the customer changes on their own in the panel.

When a customer account is closed, customer data is deleted immediately, with no waiting period. See the Delete data page.

You have the right to request access to your personal data, rectification of inaccurate data, restriction of the processing, erasure (art. 17) and data portability (art. 20). You also have the right to object to processing based on legitimate interests (art. 21).

Where the processing is based on consent — that applies to marketing to people who are not customers, see section 4 — you have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the consent was withdrawn (GDPR art. 7(3)).

Where to send the request depends on which part applies, see section 2. For Part B you send your request to the business you wrote to; we assist them in our role as processor (art. 28(3)(e)).

We answer a request without undue delay and at the latest within one month (art. 12(3)).

You have the right to lodge a complaint with the supervisory authority (art. 77). In Sweden that is the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), imy.se.

We use necessary cookies for sign-in and security. Today we use no cookies for marketing or for third-party analytics.

If we start using non-essential cookies they will be off until you actively consent, and you will be able to change your choice at any time. The basis is the Swedish Electronic Communications Act.

kobbi is an AI system. When you write to a business’s kobbi assistant, an AI system answers you, not a person. You can always ask to speak to a human at that business.

Our customers cannot switch off the information that you are interacting with an AI system. The basis is the AI Act (EU) 2024/1689 art. 50.

Data is stored on servers in Stockholm, Sweden. Access is restricted and logged. Sensitive identifiers, including Swedish personal identity numbers, are masked before they reach logs or error monitoring.

We describe only what we can demonstrate. Statements about penetration testing, backups outside our hosting provider and a written incident procedure will be added when they exist and have been verified.

Questions about this policy: dataskydd@kobbi.se. Velona AB, Sisjöbäckens Väg 22 Lgh 1002, 436 38 Askim, Sweden.

We may change this policy. Material changes are announced in the service or by email. The current version and date are shown at the top of the page.

• Delete data