1. Who is responsible
Yuna is the product name of the business operated by Leif Peter Billekvist, trading as Hoffstedts, Sweden. Contact: yuna@hoffstedts.se. The support address recorded for Yuna in Stripe is Hoffstedtsgatan 4, 602 41 Norrköping, Sweden.
Yuna processes account, business administration and support information to operate its service. For personal data in a customer’s website conversations or knowledge, the customer may be controller and Yuna processor; the role depends on the purpose and is addressed in the draft DPA.
Requires approval / verification
Validate controller/processor roles, legal entity and privacy contact. This notice is a draft, not a completed GDPR compliance statement.
2. Information processed
Account information includes email, authentication identifiers and company membership/role records. Company information includes business details, approved facts, website origins, uploaded documents and imported website content.
Conversation records can contain visitor messages, AI replies, contact information voluntarily supplied, conversation context, revised memory fields and technical traces. Technical security records include signed widget sessions, verified origins, request/rate-limit information and incidents.
Billing records include Stripe customer/subscription references, purchase status, credit grants/use and accounting events. Payment details are entered in Stripe’s embedded checkout rather than a Yuna-built card form. Support emails contain the information you choose to send.
Requires approval / verification
Complete the field-level data inventory, including hosting/network logs, IP handling, backups and provider-side metadata. Do not assume traces or uploaded documents contain no personal data.
3. Purposes and proposed legal bases
Purposes include account access, company administration, knowledge review/retrieval, responding to website visitors when activated, billing/credit accounting, abuse prevention, troubleshooting and responding to support requests.
Contract performance may apply to operating customer accounts; legal obligations may apply to accounting; a documented legitimate-interest assessment may support proportionate security processing. Consent, where required, must be specific to its purpose. A visitor contact request is kept separate from marketing permission.
Requires approval / verification
Confirm a legal basis for each purpose and data category, document any legitimate-interest assessments, and provide the customer’s own visitor notice. The draft does not select a blanket basis for all processing.
4. Service providers and international transfers
The implementation uses Lovable Cloud for hosted application/data services, Lovable’s AI connection for model and embedding requests, and Stripe for payments. AI prompts can include relevant approved company passages, recent messages and conversation context. Embeddings support retrieval.
These technical integrations do not by themselves establish the final legal subprocessor list, hosting regions, model-provider retention policies or lawful international transfer arrangements.
Requires approval / verification
Verify contracting entities, actual AI providers, locations, onward subprocessors, DPAs, transfer safeguards and provider training/retention terms. No claim of EU-only storage or “never used for training” is made.
5. Retention and deletion
Data is stored in company, knowledge, conversation, billing and trace records. Archiving knowledge or leaving a workspace is not necessarily deletion. Stripe and statutory accounting records may have separate retention requirements.
There is no verified service-wide deletion schedule or completed self-service account-deletion flow in this draft. Contact yuna@hoffstedts.se to request review of an access, correction, export or deletion request.
Requires approval / verification
Approve retention periods by category, backup deletion, deletion/return procedures, accounting requirements and operational request handling. No deletion deadline or automatic erasure is promised.
6. Rights and security
Depending on applicable law and the legal basis, individuals may have rights of access, correction, erasure, restriction, portability and objection, and may withdraw consent without affecting earlier lawful processing. They may complain to the relevant supervisory authority; in Sweden this is IMY (imy.se). Requests about a customer website may need to be handled by that customer.
Company membership checks, company-scoped data access, private storage, signed widget sessions, verified website origins and rate limits are implemented controls. These are not an assurance of perfect security, a security certification or a contractual SLA.
Requires approval / verification
Verify rights-request ownership, identity checks, incident escalation and breach notification procedures before launch.
7. Cookies and updates
See the Cookie Policy for browser storage and embedded-service considerations. This draft has no effective date; a material update and notification policy must be approved before it is used as a live notice.