Snapshot 25560
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Privacy Policy
Last updated: September 8, 2026
At Stilla Development AB, org number: 559504-8512 ("Stilla", "we", "us", "our"), we take your privacy seriously. This Privacy Policy describes how Stilla collects, uses and discloses information about you when you use our Services, as defined below.
Our role as data controller
The information in this Privacy Policy covers Personal Data Processing for which Stilla is the data controller (as defined in the GDPR). This means that the Privacy Policy only covers situations where we decide the purpose and means for the Processing of Personal Data (i.e., "the why and the how").
Our Privacy Policy does not describe how we Process Personal Data when we act as a data processor. This means that the Privacy Policy does not apply when we Process Personal Data on behalf of another party such as a Stilla Customer (which may, for example, be your employer). Data Subjects whose Personal Data we process on behalf of another data controller (typically the Stilla Customer) should contact that data controller for further information regarding Processing of their Personal Data.
This Privacy Policy explains how we collect and treat Personal Data solely in relation to the following categories of Data Subjects:
individuals representing our Customers, suppliers, service providers or partners
Visitors to our website
individuals who apply for a job with us
individuals who sign up to receive information from us, including via newsletters
Definitions
"Applicable Data Protection Laws" refers to the legislation applicable to the Processing of your Personal Data including the General Data Protection Regulation (EU) 2016/679 ("EU GDPR") and the UK General Data Protection Regulation as defined by the UK Data Protection Act 2018, as amended (the "UK GDPR", and together with the EU GDPR, the "GDPR"), as well as supplementary national legislation.
"Data Subject" is the living, identified or identifiable natural person whose Personal Data is being Processed.
"Personal Data" is any information relating to an identified or identifiable natural person or as further defined in the Applicable Data Protection Laws.
"Processing" means any operation or set of operations which is performed on Personal Data, e.g., collection, storage, modification, access, transfer, deletion, use.
"Customer" is the legal entity or business organization which is the customer of Stilla as a result of having entered into a customer agreement with us or otherwise signed up to use the Services.
"Services" refer to the Stilla AI agent, the Stilla platform and other Stilla product(s) and service(s) made available by Stilla to Customer from time to time.
"Visitor" is the individual who visits our website and in different ways interacts with us.
Data Subject Rights
If the GDPR applies to our Processing of your Personal Data you have certain rights with respect to such Processing, as outlined below. Please note that a number of these rights only apply in certain circumstances, and all of these rights may be limited by Applicable Data Protection Laws. For more information about these rights, or to submit a request, please email us at [email protected] with the subject line: "GDPR Request: [nature of request]". Your request must include enough information for us to verify your identity, relationship with Stilla, and the nature of your request. In some circumstances, we may not be able to fully comply with your request, such as if your rights are limited by Applicable Data Protection Laws, if we are unable to verify your identity, or if it jeopardizes the rights of others. Lastly, please note that where we process your Personal Data as a data processor on behalf of another organization, including our Customers, we will refer you directly to that organization or Customer so that you may submit your request with the appropriate data controller.
Access: You can request more information about the Personal Data we hold about you and request a copy of such Personal Data from us, a so-called register extract. There is no charge for obtaining said register extract. For any additional copies you request, Stilla may charge a reasonable fee to cover our administrative costs in line with Applicable Data Protection Laws.
Rectification: If you believe that any Personal Data we Process about you is incorrect or incomplete, you can request that we correct or supplement such data by contacting us at [email protected]. If you are a representative of a Customer, you can update your contact information by logging into the Service and adjusting it there.
Erasure: You can request that we erase your Personal Data from our systems ("right to be forgotten"). In the event you would like to make such a request, please send an email with the subject line "Erasure of Personal Data Request" to [email protected]. We will confirm receipt of your request and take reasonable steps to ensure you are the Data Subject. Upon verification, we will erase such Personal Data which we are obliged to erase under Applicable Data Protection Laws without undue delay. If we are required to retain certain Personal Data under applicable laws or a contract that we have entered with you, we will ensure that it is Processed only for the specific purpose set forth in such applicable law or contract. If you represent a Customer, please note that you can delete certain account-related information within your account settings.
Withdrawal of Consent: If we are processing your Personal Data based on your consent (as indicated at the time of collection of such data), you have the right to withdraw your consent at any time. Please send an email with the subject line "Withdrawal of Consent" to [email protected].
Portability: You can ask for a copy of certain Personal Data about you in a structured, commonly used and machine-readable format, known as data portability. You can also request that we transmit such Personal Data to another controller where technically feasible, in accordance with Applicable Data Protection Laws. Please send an email with the subject line "Portability Request" to [email protected].
Objection: You can contact us to let us know that you object to the further use or disclosure of your Personal Data for certain purposes, such as for direct marketing purposes. Please send an email with the subject line "Objection Request" to [email protected].
Restriction of Processing: You can ask us to restrict further Processing of your Personal Data.
Right to File Complaint: If you are of the opinion that Stilla has not satisfactorily answered your question or handled your request, you have the right to lodge a complaint with the supervisory authority such as the Swedish Authority for Privacy Protection "IMY" (https://www.imy.se/en/) or any other EU national data protection authority (https://www.edpb.europa.eu/about-edpb/about-edpb/members_en). If you are in the UK or your matter is related to the UK, you can make a complaint directly to us, or with the Information Commissioner's Office "ICO" (https://ico.org.uk/make-a-complaint/). Please note that if you are in the United States, you currently do not have access to a centralized national data protection authority for lodging complaints related to Personal Data.
Stilla's Processing of your Personal Data
Below we provide you with more details on our Processing of Personal Data. Do not hesitate to contact us at [email protected] if you have any questions about this Privacy Policy, our Processing of your Personal Data or if you wish to exercise any of your rights.
For individuals representing our Customers, suppliers, service providers or partners
Processing activities and purposes of Processing include:
Creating and managing your account or other user profiles (where applicable).
Communicating with you and providing you with information you request.
Carrying out business purposes stated when collecting your Personal Data.
Marketing and selling the Services.
Communicating with and administrating contact details for potential customers and others who have or may have an interest in Stilla and/or the Services.
Enforcing any agreements with you.
Responding to correspondence that we receive from you, contacting you when necessary or requested, and sending you information about Stilla or the Services which we think may be of interest.
Billing you for the Services.
Providing customer support.
Analyzing your use of and improving the Services.
Monitoring system performance and identifying errors.
Managing feature requests.
Anonymising or de-identifying your Personal Data to improve the Services.
Personal Data: E-mail, first and last name, title/role, Employer information, billing information (where applicable), interaction history and any other information included in your communication with us.
Source: Directly from yourself or from the business which you represent.
Legal basis: Depending on the processing activity: (i) contractual necessity, to perform our obligations under our agreement with you or the business you represent; (ii) our legitimate business interests to communicate with and administer our relationship with you, handle requests and inquiries, and improve our Services; and/or (iii) consent, where required for direct marketing.
Retention period: Three (3) years after the last meaningful commercial engagement or for as long as necessary for Stilla to fulfill its obligations in accordance with applicable law (e.g., the Swedish Bookkeeping Act (1999:1078)).
We may also Process the aforementioned Personal Data for the purposes and based on our legitimate business interests or legal obligations of meeting legal requirements under applicable laws, regulation, court order or other legal process (such as preventing, detecting and investigating security incidents and potentially illegal or prohibited activities), protecting the rights, property or safety of you, Stilla or another party or for resolving legal disputes.
For Website Visitors
Processing activities and purpose include:
Administrate and respond to any questions and/or inquiries sent to us by e-mail, contact form or via social media.
Creating and managing your account or other user profiles (where applicable).
Personalizing website content and communications based on your preferences.
Doing fraud protection, security and debugging.
Marketing and selling the Services.
Corresponding with you and responding to correspondence that we receive from you, contacting you when necessary or requested, and sending you information about Stilla or the Services.
Sending emails and other communications according to your preferences or displaying content that we think will interest you.
Personal Data: Name, e-mail, and any other information included in your messages to us. Web page interactions, Referring webpage/source through which you accessed our website, IP address, IP-address-based location information, Device ID, Type of device/operating system/browser used to access the Services.
Source: Directly from you/the Data Subject, the business you represent or through the use of cookies or tracking technologies in accordance with our Cookie Statement.
Legal basis: Depending on the processing activity: (i) consent, where we process your Personal Data through non-essential cookies or similar tracking technologies; or (ii) our legitimate interest in communicating with potential customers and assisting individuals who contact us with questions and/or inquiries, as well as to detect and prevent against fraudulent or illegal activity.
Retention period: Twelve (12) months after the last interaction, or, for Personal Data collected through cookies or similar tracking technologies, in accordance with our Cookie Statement, or for as long as necessary for Stilla to fulfill its obligations in accordance with applicable law (e.g., the Swedish Bookkeeping Act (1999:1078)).
For job applicants
Processing activities and purpose include: Receiving job applications to review them and carry out our recruitment process and communicating with you in connection with such process.
Personal data: Name, e-mail, phone number, and any information the individual chooses to include in the CV/personal letter.
Source: Directly from you/the Data Subject, recruiters, or from referees.
Legal basis: Our legitimate interest to carry out necessary activities relating to a recruitment process.
Retention period: Twenty-four (24) months after the relevant recruitment campaign has concluded for unsuccessful candidates, seven (7) years post-employment for successful candidates, or for as long as necessary for Stilla to fulfill its obligations in accordance with applicable law. We may save applications for future job openings in which case we will ask for your consent before we save the application.
For updates about the Services and newsletters
Processing activities and purpose include: Administration and distribution of information related to the Services, newsletters, and Stilla's current and future offerings.
Personal data: Name, e-mail, phone number, and any information you choose to share with us.
Source: Directly from you/the Data Subject.
Legal basis: Our legitimate interest to provide the Data Subject with the requested information regarding our Services to those who are interested.
Retention period: Three (3) years after the last meaningful commercial engagement or as long as you have an active subscription to receive newsletters and other information from Stilla. We only send marketing emails after receiving your consent (such as when you register yourself to receive them) where required by Applicable Data Protection Laws and, depending on where you live, you may have the right to withdraw said consent at any time.
We may where necessary also Process the aforementioned Personal Data for the purposes and based on our legitimate business interests or legal obligations of meeting legal requirements under applicable laws, regulation, court order or other legal process (such as preventing, detecting and investigating security incidents and potentially illegal or prohibited activities), protecting the rights, property or safety of you, Stilla or another party or for resolving legal disputes.
Google API Data
Notwithstanding the foregoing, to the extent we collect Personal Data about you through use of a Google API, our use and transfer of such Personal Data to any other third-party will be in compliance with the Google API Services User Data Statement, including the Limited Use Requirements.
Google Workspace Data – Additional Restrictions
Stilla does not (i) use Google Workspace user data to develop, improve or train non-personalized or generalized AI/ML models or (ii) combine such data with data from other customers for model training.
Consent: In some cases, we process Personal Data based on the consent you expressly grant to us at the time we collect such data. When we process Personal Data based on your consent, it will be expressly indicated to you at the point and time of collection.
How We Disclose Your Personal Data
We may share your Personal Data with or Process it with the help of third parties who help us provide the Services. Such parties can either be processors to Stilla, i.e. companies that process your Personal Data on behalf of Stilla according to our instructions (e.g. providers of IT- and communication services, customer relationship management, customer support, billing, analytics and system monitoring), or independent data controllers who are responsible for the processing of your Personal Data (e.g., law firms or auditing firms that Stilla hires and which, in connection with the performance of their assignment, have access to your Personal Data and Process it in accordance with their procedures and requirements applicable to their business).
We may also share your Personal Data with our current and future parents, affiliates, and subsidiaries, and other companies under common control and ownership. Additionally, we may share your Personal Data with tax authorities (where required by law), referees or other individuals you identify in connection with job applications, and third parties for legal, security or regulatory purposes including to cooperate with law enforcement, judicial orders and regulatory inquiries, or to exercise or defend legal claims.
We do not disclose your Personal Data to third parties for the third parties' own direct marketing purposes, unless you have affirmatively agreed to such disclosure.
Business Transfers
Personal Data that we collect may be transferred to a third party if we undergo a merger, acquisition, bankruptcy or other transaction in which that third party assumes control of our business (in whole or in part).
De-identification of Personal Data
We may create aggregated, de-identified or anonymized data from the Personal Data we collect, including by removing information that makes the data personally identifiable to a particular user. We may use such aggregated, de-identified or anonymized data and share it with third parties for our lawful business purposes, including to analyze, build and improve the Services and promote our business, provided that we will not share such data in a manner that could identify you.
Cookies and Tracking Technologies
We and third parties use cookies and other tracking technologies such as pixel tags, web beacons, clear GIFs and JavaScript to analyze the use of our website, Services and related functions so that we can give you the best user experience. For more information in this regard, please see our Cookie Statement. Most browsers accept such tracking technologies automatically, but you may be able to control the way in which your devices permit the use of certain tracking technologies. If you so choose, you may block or delete certain cookies and other tracking technologies from your browser; however, blocking or deleting cookies may impact the functioning of some of the Services.
Your browser settings may allow you to transmit a signal or other mechanism for exercising your choice regarding the collection or processing of your information when you visit various websites. The Services are not currently designed to respond to such signals.
Data Security
We have taken commercially reasonable security measures designed to protect your Personal Data against unauthorized access, alteration, and erasure. However, we cannot guarantee any assurance that these measures are, or will be, sufficient to protect your Personal Data you choose to provide us through the website or the Services.
Accordingly, we recommend that you help protect your data by being cautious and take appropriate steps to limit access to your computer or device and browser used to access the website and/or the Services.
Data Retention
Other than the specific retention policies set out above, as a general matter we retain your Personal Data for as long as necessary for the purposes for which we originally collected the data in accordance with this Privacy Policy. Personal Data processed to fulfill legal obligations in the Accounting Act will be stored for seven years. Data processed under the Anti-Money Laundering Act will be stored for five to ten years depending on the circumstances.
Where deletion of Personal Data is not possible because retention is required to fulfill our applicable legal obligations, Stilla may take measures, at its discretion, to (a) block the Personal Data from further Processing (except to the extent necessary for its continued hosting or Processing required by applicable law) and (b) protect the Personal Data remaining in its possession, custody, or control and (c) where any authorized sub-processor continues to possess Personal Data, require the authorized sub-processor to take the same measures that would be required of Stilla.
Personal Data of Children
As noted in the Terms of Use, neither our website nor our Services are intended to be accessed by children under 16 years of age. If you are a child under the age of 16, do not attempt to register for or otherwise use the Services or send us any Personal Data. If you believe that a child under 16 years of age may have provided Personal Data to us, please contact us at [email protected].
International Transfers of Personal Data
We occasionally need to transfer Personal Data we collect from you to third countries outside of your country of residence, including the U.S., either directly or through our sub-processors. If we engage in a transfer of Personal Data from the EU/EEA or the UK, as applicable, we will ensure that there is a legal basis for the transfer and that the level of protection is equivalent to that applicable within the EU/EEA such as by ensuring that the country has an adequate level of protection determined by the EU Commission or the UK Secretary of State, as applicable, that the processor/ recipient in question is certified under the EU-U.S. Data Privacy Framework or the UK-US Data Bridge, or that we have taken adequate protective measures such as based the transfer on the European Commission's standard contractual clauses (SCCs) and/or the UK ICO's international data transfer agreement, or international data transfer addendum to the SCCs. You may request a copy of the safeguards we have put in place by contacting us at [email protected].
Changes to the Privacy Policy
We may make changes to this Privacy Policy from time to time or when necessary. When we make material changes to how we use or disclose Personal Data, we will use reasonable efforts to inform you of these changes, such as by posting it on our website or in some other way that makes you aware of the changes like sending you an email.