Privacy policy

⁨V360 Studios Sweden AB⁩ (company reg. no. ⁨556925-5945⁩) runs Ekominnen and is the data controller for the processing described here.

Postal address: ⁨Torrängsgatan 8, 170 60 Solna⁩.

Email: ⁨hej@ekominnen.se⁩

• The account holder – the person who has an account in Ekominnen and adds a storyteller, usually a family member.
• The storyteller – the person Eko talks with, through the account holder's account or through a conversation link.
• People who are mentioned – family, friends and others the storyteller talks about.

About the account holder: email address and sign-in details, a display name (the part of the email address before @ unless another is given) and when the account was created. Ekominnen also records what each call to the AI costs – the kind, the time, which conversation or chapter it concerns, which model, how many tokens and the cost in kronor, never the content – to calculate the meter and limit how much is created per day.

About the storyteller: name, relationship to the account holder, year of birth, conversation language, a photo if the account holder uploads one, the family's own photos for the chapters, and when consent was confirmed.

From the conversations: audio recordings of the storyteller's answers, a transcript of the whole conversation (Eko's questions and the storyteller's answers), a summary of each conversation and a suggested theme for the next one, the memory bank (people, places, events and themes the storyteller has mentioned, with an approximate year) and the chapters written from the conversations, with a Swedish translation if someone has asked for one. Finished chapters also get audio, in which Eko's voice reads the chapter, and painted pictures with a short picture description. Answers typed instead of spoken are stored as text.

About the conversation link: when the account holder creates a link for the storyteller, Ekominnen does not store the link itself, only a checksum of it, when it was created, when it expires and whether it has been revoked.

About the book's QR codes: for each chapter in the book, a checksum of the code's key (the key itself is not stored), which of the storyteller's recorded answers the account holder has chosen for the code to play, whether the code is paused, and when it was last opened and how many times on the same day.

About the weekly question: the storyteller's email address, which the account holder enters, and the language the emails are written in; when the request was sent and when the storyteller said yes or unsubscribed; which questions from Eko's fixed list of questions have been sent and when, with a conversation link for each question (only a checksum of the link is stored).

About Ekominnen's emails: for each email Ekominnen sends – purchase confirmation, withdrawal confirmation, gift code, the request about the weekly question and the weekly question – Ekominnen stores the kind of email, the language, times, status and the ids of the purchase, the storyteller and the account. The address and the text are not stored in that log.

About purchases: what was bought (for the family, as a gift or more time), the amount and VAT, how much time a purchase of more time gave and until when it is valid, and on withdrawal how much of the time had been used, when the payment was made, the three confirmations before payment with the time and the version of the terms, the gift code and when it was activated, which year the purchase covers and whether the purchase was withdrawn. You give card details and other payment details directly to Stripe – Ekominnen never sees them. When someone tries a gift code without being logged in, Ekominnen stores a checksum of the IP address to stop guessing. It is deleted after a day.

Sensitive data: a life story can contain information about health, religion, ethnic origin, political opinions and other special categories of personal data under Article 9 of the General Data Protection Regulation (GDPR). What is told is stored as part of the story.

Ekominnen uses Gemini, Google's AI service, to:

• transcribe what the storyteller says (speech to text),
• ask the next question in the conversation,
• note memories after the conversation and check them against what was said,
• write chapters and check them against the conversations,
• translate a chapter into Swedish when the account holder asks for it,
• read Eko's questions aloud for the account holder,
• read finished chapters aloud in Eko's voice,
• paint pictures for finished chapters and check them.

Sent to Google: the storyteller's answers (audio or text), the conversation transcript, the memory bank, the chapter text, and the storyteller's name, relationship, year of birth and language. Photos are not sent.

The pictures show places, objects and atmosphere, never people. Gemini reads the chapter and writes a short description of the scene, without names and with places only at regional level. Only that description is sent to Google's image model. The finished picture is then sent to Gemini, which checks that it shows no people or text. The pictures are requested through Google's Interactions API with the setting store: false, so that Google does not store the requests there (without that setting they are kept for 55 days).

The music in listening mode was made in advance with Google's AI model Lyria and is the same for everyone. Nothing from the stories was sent to make it.

Ekominnen makes no decisions about any person. The AI writes text that the account holder can read, edit and delete.

The browser's own voice is used when the storyteller uses the conversation link, when transcripts and chapter drafts are read aloud, and as long as a finished chapter's audio is not ready. That reading happens in the browser, not at Ekominnen. Some browsers then use an online voice provided by the browser's maker.

• The account: to provide the service to the account holder under the agreement – Article 6(1)(b) GDPR (contract).
• The stories: to hold the conversations, store the recordings and write memories and chapters – the storyteller's consent, Article 6(1)(a), and for sensitive data the storyteller's explicit consent, Article 9(2)(a).
• People who are mentioned: their names and what is said about them are stored as part of the storyteller's story – legitimate interest, Article 6(1)(f): the family's interest in preserving the story.
• Protecting the service: the log of chapters, translations, read-alouds, chapter audio and pictures is used to limit misuse and costs – legitimate interest, Article 6(1)(f) – and to calculate the meter, that is how much of the year's amount and of bought time has been used – Article 6(1)(b) (contract).
• Purchases: to carry out the purchase – Article 6(1)(b) (contract) – and to keep the accounting records – Article 6(1)(c) (legal obligation under the Swedish Bookkeeping Act). The checksum of the IP address when gift codes are tried – legitimate interest, Article 6(1)(f): protecting the codes against guessing.
• The weekly question: the storyteller's email address is used to email the weekly question – the storyteller's consent, Article 6(1)(a), which the storyteller gives by pressing Yes in the request and can withdraw with the link in every email. The log of Ekominnen's emails and the limit on how many requests an account can send – legitimate interest, Article 6(1)(f): making sure the same email is not sent twice and that Ekominnen's email cannot be used for unwanted emails.

The storyteller answers personally at the start of the first conversation – in the account holder's app or via the conversation link. Ekominnen shows a consent text in Swedish, English or Arabic (the storyteller's language when it is one of these, otherwise the account holder's; the storyteller can switch) and can read it aloud in Eko's voice. The text says that the conversations are recorded, that Google's AI writes down what is said, asks questions, notes memories and writes chapters and sticks to what the storyteller has told, that finished chapters can be read aloud by a computer voice and get painted pictures of places and objects, that the family can get a link where they read and listen to the finished chapters, that the storyteller's own voice can be played through QR codes in the printed book, that what is told may be about health, faith or other personal things, and that recordings and stories are stored in Stockholm.

The storyteller confirms with the button “Yes, I am at least 18 and want to take part”. Ekominnen stores when this happened, whether it happened in the account holder's app or via the conversation link, the version and language of the text and a checksum of the text. Only then can a conversation begin. If the text changes in substance, the storyteller answers again at the start of the next conversation. If the storyteller says “Not now”, nothing is stored.

Withdrawing consent: the storyteller can take back their yes in the conversation (“Don't want to take part any more?”), the account holder can do it on the storyteller's page, and both can email ⁨hej@ekominnen.se⁩. The conversation links, the family links and the book's QR codes are then closed and the address for the weekly question is deleted straight away, and no new conversations, chapters, translations, chapter audio or pictures are made. 30 days after the withdrawal everything about the storyteller is deleted automatically: recordings, transcripts, memories, chapters, chapter audio, pictures and photo. Until then the account holder can read and download. If the storyteller says yes again before then, nothing is deleted. Withdrawing consent does not affect what was done before.

The account holder sees everything about their storytellers: conversations, recordings, memories and chapters. The storyteller sees the ongoing conversation through the conversation link. Anyone who has the printed book can scan the chapters' QR codes and hear the answers the account holder has chosen, in the storyteller's own voice, or Eko's reading of the chapter – without an account. The account holder can pause a code.

Ekominnen uses six processors. Under data processing agreements, they may only process the data on our behalf:

• Google (contracting party Google Cloud EMEA Limited) – AI as described in section 4 (Gemini API), and a copy of the files every night in Google Cloud Storage in Stockholm (see How long the data is kept).
• Supabase – database, storage of audio and photos, and sign-in. The data is stored in Stockholm (AWS eu-north-1).
• Vercel – hosting of the website and servers, and the visitor statistics (see Cookies). Ekominnen's server functions run in Stockholm.
• Resend – sends Ekominnen's email: invitations and sign-in links, purchase confirmations, withdrawal confirmations and gift codes to the account holder, and the request and the weekly question to the storyteller.
• Stripe (Stripe Payments Europe, Limited, Ireland) – receives the payment when you buy Ekominnen. Stripe is also an independent controller for part of the processing, for example to prevent fraud and to follow anti-money-laundering rules.
• Sentry (Functional Software, Inc.) – receives error reports from Ekominnen's servers, so that we get an alert when something goes wrong, for example when a payment cannot be recorded. A report contains the error code, where in the code the error occurred and sometimes Stripe's ID for the purchase – never names, email addresses, recordings or texts. The reports are stored in the EU and deleted after at most 90 days.

Ekominnen shows no ads and sells no data. The visitor statistics are described under Cookies.

The data is stored in Stockholm, but the providers may also process it outside the EU/EEA:

• Google: under Google's data processing terms, the data may be processed in any country where Google or its subprocessors maintain facilities. Transfers to the US rely on the EU-U.S. Data Privacy Framework, under which Google LLC is certified, and otherwise on the European Commission's standard contractual clauses. Google does not use what is sent to Gemini, or what comes back, to improve its products. Google keeps it for 55 days to detect misuse, and flagged content may be reviewed by authorised Google staff. The copy of the files in Google Cloud Storage is stored in Stockholm.
• Vercel: under Vercel's data processing agreement, Vercel's primary processing takes place in the US, and traffic to the website passes through Vercel's network with nodes in many countries. Transfers rely on standard contractual clauses.
• Supabase: the contracting party, Supabase Pte. Ltd., is based in Singapore. If data is transferred outside the EU/EEA, this relies on standard contractual clauses under Supabase's data processing agreement.
• Resend: Ekominnen's email is sent from the EU, but Resend (Plus Five Five, Inc.) stores account data and logs of the emails sent, including the recipient's email address, in the US. Transfers rely on the EU-U.S. Data Privacy Framework and standard contractual clauses.
• Stripe: data about the purchase can be transferred to Stripe, LLC in the US. Transfers rely on the EU-U.S. Data Privacy Framework and standard contractual clauses.
• Sentry: the error reports are stored in Sentry's EU region in Germany. If they are nevertheless processed in the US, for example in connection with support, this relies on the EU-U.S. Data Privacy Framework and standard contractual clauses.

The data is kept until it is deleted. The only things Ekominnen deletes automatically are a storyteller who has withdrawn their consent – 30 days after the withdrawal (see the section on consent) – and the log of the weekly question, after 31 days (see below).

• A chapter is deleted from the chapter itself, together with its audio and pictures. The conversations it is based on remain.
• A picture is removed under the chapter's pictures (Remove). Audio for an older version of the chapter is deleted when the audio for the new version is ready, and the pictures are deleted when the chapter gets a different number of parts.
• A storyteller is deleted under Edit → Delete the storyteller. First all recordings, photos, chapter audio and pictures are removed, then conversations, transcripts, memories, chapters and conversation links. If something cannot be removed, the deletion stops and shows what remains, so that it can be run again.
• The whole account is deleted under Settings → Delete the account. This deletes all files, storytellers, conversations, memories, chapters, the log and the account itself.
• Purchases are kept for seven years after the end of the calendar year in which the financial year ended, as the Swedish Bookkeeping Act requires (Chapter 7, Section 2) – even if the account is deleted. The link to the account is then removed. The cost of the calls is deleted with the account.
• A single conversation, recording or memory cannot be deleted in the app today. Email ⁨hej@ekominnen.se⁩ and we will delete it.
• A QR code stops working when the account holder pauses it, when the storyteller withdraws their consent and when the chapter or the storyteller is deleted. The code in a printed book cannot be replaced – if the chapter is deleted, it stops working for good.
• A conversation link expires after 30 days, when the account holder revokes it, or when a new link is created.
• The weekly question: the address is deleted when the account holder removes it, straight away when the storyteller withdraws their consent, and when the storyteller is deleted. If the storyteller unsubscribes, or the account holder turns it off, no more emails are sent. The link in an email with the weekly question is valid for 14 days from the Monday. The log of the emails about the weekly question (only ids, times and which question) is kept for 31 days – even if the storyteller is deleted, so that the limit on requests per account holds – and is then deleted automatically. The log of the purchase emails is kept with the purchase.
• Backups: Supabase copies the database every night and keeps the copies for 7 days. Recordings, photos, the chapters' audio and pictures, and books are copied every night to Google Cloud in Stockholm. What is deleted in Ekominnen is removed from the copy the following night and is gone for good 7 days later. So what you delete is completely gone within 8 days.

At Google, what was sent to Gemini is kept for 55 days (see section 8).

Under Edit for a storyteller, and under Settings, you can download everything about the storyteller as a ZIP file. It contains the chapters as text (with the Swedish translation if there is one), the chapters' audio and pictures, the family's own photos, the storyteller's recordings and photo, and a machine-readable file (JSON) with the storyteller's details, all conversations with transcripts, the memories, the chapters, the picture descriptions, the address for the weekly question and the questions that have been sent. The ZIP file is put together in your browser. The recordings can also be played and downloaded on each conversation's page.

The ZIP file does not contain the account's email address or the log. Email ⁨hej@ekominnen.se⁩ if you would like a complete copy.

Under the GDPR you have the right to:

• know what data we hold about you and get a copy of it (Article 15),
• have incorrect data corrected (Article 16),
• have data erased (Article 17),
• ask for processing to be restricted (Article 18),
• receive data you have provided in a machine-readable format (Article 20),
• object to processing based on legitimate interest (Article 21),
• withdraw consent at any time (Article 7(3)).

These rights apply to the account holder, the storyteller and the people mentioned in the stories. The account holder can edit the storyteller's profile and the chapters in the app. Transcripts and memories cannot be edited in the app today. For everything else, email ⁨hej@ekominnen.se⁩. We reply within one month.

• An account can only reach its own data. This is enforced in the database for every table and for the storage of audio, photos and pictures.
• Recordings, photos, the chapters' audio and pictures are kept in private storage and shown through time-limited links.
• The conversation link is long and random, and Ekominnen stores only a checksum of it. Anyone with the link can hold a conversation as the storyteller, so it should only be given to the storyteller.
• The QR codes' keys are random, and Ekominnen stores only a checksum of them. Each code can be opened at most 300 times a day, and the audio plays through links that are valid for two minutes.
• The copy in Google Cloud is private and encrypted. The server reaches it with its own service account, without stored keys; otherwise only Ekominnen's administrator can.

Ekominnen uses two kinds of cookies:

• Sign-in cookies from Supabase, which keep you signed in.
• NEXT_LOCALE, which stores the language you chose for 365 days. It is only set when you change language.

Ekominnen also stores two things in the browser's storage on your device: where you are in a chapter's audio, so that playback can continue where you left off, and whether the background music is on or off. This is not sent to Ekominnen.

Ekominnen uses no cookies for advertising or statistics.

The visitor statistics (Vercel Web Analytics) count visits to the open pages, such as the home page and the terms, without cookies and without storing anything on your device. For each page view, the page, where you came from, roughly where you are (country, region and city), browser, operating system and type of device are stored. The same visitor is recognised for at most one day by a checksum of the request, which is then deleted. The IP address is not stored. The statistics are not used in the app, on the conversation link or on pages with a key in the address.

Ekominnen is for adults. The account holder and the storyteller must be at least 18 years old.

We update this policy when Ekominnen changes, for example when a new provider is added. The date at the top shows when it was last changed.

Please contact us first at ⁨hej@ekominnen.se⁩. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se.