Privacy policy
Last Updated: 08/13/2026
Version 2.0
Last Updated: 08/13/2026
Introduction
Introduction
This privacy policy explains how Anaphora AB ("Cetrez", "Anaphora", "we", "us", or "our") collects uses, shares, and protects personal data in our capacity as a data controller. Anaphora operates the Anaphora platform and the websites at anaphora.tech and cetrez.com. This policy applies to personal data collected through:
• our websites (anaphora.tech and cetrez.com, and their subdomains);
• the Anaphora platform and applications (including C5 Pro, Content Studio, BrandOS, Brandograph,vand Anaphora Events), to the extent that we process personal data as a controller in connection with the delivery and administration of our cloud services; and
• direct interactions with us, including sales enquiries, support communications, demonstrations, and event registrations.
Scope limitation. This policy does not apply to any content, data, messages, or campaigns that our customers create, upload, transmit, or store through the Anaphora platform in connection with their own marketing, events, or communications. When we process such data, we act as a data processor on behalf of our customers, and that processing is governed by our Data Processing Addendum (available at anaphora.tech/data-processing-addendum) and the relevant customer's own privacy policy. If you received a communication from, or registered for an event run by, one of our customers, you should refer to that customer's privacy notice for information about how your data is handled.
Please read this policy carefully. If you have any questions, you can contact us using the details in section 1 below. Defined terms used in this policy are explained in the Glossary in section 12.
This privacy policy explains how Anaphora AB ("Cetrez", "Anaphora", "we", "us", or "our") collects uses, shares, and protects personal data in our capacity as a data controller. Anaphora operates the Anaphora platform and the websites at anaphora.tech and cetrez.com. This policy applies to personal data collected through:
• our websites (anaphora.tech and cetrez.com, and their subdomains);
• the Anaphora platform and applications (including C5 Pro, Content Studio, BrandOS, Brandograph,vand Anaphora Events), to the extent that we process personal data as a controller in connection with the delivery and administration of our cloud services; and
• direct interactions with us, including sales enquiries, support communications, demonstrations, and event registrations.
Scope limitation. This policy does not apply to any content, data, messages, or campaigns that our customers create, upload, transmit, or store through the Anaphora platform in connection with their own marketing, events, or communications. When we process such data, we act as a data processor on behalf of our customers, and that processing is governed by our Data Processing Addendum (available at anaphora.tech/data-processing-addendum) and the relevant customer's own privacy policy. If you received a communication from, or registered for an event run by, one of our customers, you should refer to that customer's privacy notice for information about how your data is handled.
Please read this policy carefully. If you have any questions, you can contact us using the details in section 1 below. Defined terms used in this policy are explained in the Glossary in section 12.
Important Information and Who We Are
Important Information and Who We Are
Data Controller
Data Controller
Anaphora AB is the data controller responsible for the personal data described in this privacy policy. Anaphora AB is a company organised under the laws of Sweden (company registration number 559294-4531), with its registered office at Kvarnbygatan 8A, 431 34 Mölndal, Sweden.
Anaphora, Inc. is our affiliate in the United States and is the contracting entity for certain customers located outside the EEA, the United Kingdom, and Switzerland. Where Anaphora, Inc. is your contracting entity, Anaphora AB and Anaphora, Inc. act as joint or independent controllers (as applicable) in respect of the controller processing described in this policy. Other entities in our corporate group may process personal data on our behalf as service providers, as described in section 5.
Anaphora AB is the data controller responsible for the personal data described in this privacy policy. Anaphora AB is a company organised under the laws of Sweden (company registration number 559294-4531), with its registered office at Kvarnbygatan 8A, 431 34 Mölndal, Sweden.
Anaphora, Inc. is our affiliate in the United States and is the contracting entity for certain customers located outside the EEA, the United Kingdom, and Switzerland. Where Anaphora, Inc. is your contracting entity, Anaphora AB and Anaphora, Inc. act as joint or independent controllers (as applicable) in respect of the controller processing described in this policy. Other entities in our corporate group may process personal data on our behalf as service providers, as described in section 5.
Data Protection Contact
Data Protection Contact
We have assessed our obligation to appoint a Data Protection Officer under Article 37 GDPR and have determined that we are not required to appoint one, because our core activities do not consist of large- scale, regular, and systematic monitoring of individuals or large-scale processing of special categories of personal data. For all enquiries relating to data protection, please contact us at privacy@anaphora.tech.
We have assessed our obligation to appoint a Data Protection Officer under Article 37 GDPR and have determined that we are not required to appoint one, because our core activities do not consist of large- scale, regular, and systematic monitoring of individuals or large-scale processing of special categories of personal data. For all enquiries relating to data protection, please contact us at privacy@anaphora.tech.
Contact Details
Contact Details
If you have any questions about this privacy policy or our privacy practices, or wish to exercise any of your legal rights, please contact us as follows:
• Email: privacy@anaphora.tech
• Postal address: Anaphora AB, Kvarnbygatan 8A, 431 34 Mölndal, Sweden
• Telephone: +46 31 806 500
If you have any questions about this privacy policy or our privacy practices, or wish to exercise any of your legal rights, please contact us as follows:
• Email: privacy@anaphora.tech
• Postal address: Anaphora AB, Kvarnbygatan 8A, 431 34 Mölndal, Sweden
• Telephone: +46 31 806 500
Supervisory Authority
Supervisory Authority
You have the right to make a complaint at any time to the supervisory authority for data protection in the country in which you reside. Our lead supervisory authority is the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, Sweden (imy.se). If you reside outside Sweden, you may also contact the supervisory authority in your country of residence. We would, however, appreciate the chance to deal with your concerns before you approach any supervisory authority, so please contact us in the first instance.
You have the right to make a complaint at any time to the supervisory authority for data protection in the country in which you reside. Our lead supervisory authority is the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, Sweden (imy.se). If you reside outside Sweden, you may also contact the supervisory authority in your country of residence. We would, however, appreciate the chance to deal with your concerns before you approach any supervisory authority, so please contact us in the first instance.
Changes to This Policy
Changes to This Policy
We keep this privacy policy under regular review and may modify it from time to time. Where we make material changes, we will update the version number and date at the top of this page and, where appropriate, notify you by other means. We encourage you to review this policy periodically. It is important that the personal data we hold about you is accurate and current, so please keep us informed if your personal data changes during your relationship with us.
We keep this privacy policy under regular review and may modify it from time to time. Where we make material changes, we will update the version number and date at the top of this page and, where appropriate, notify you by other means. We encourage you to review this policy periodically. It is important that the personal data we hold about you is accurate and current, so please keep us informed if your personal data changes during your relationship with us.
Third-Party Links
Third-Party Links
Our websites and services may include links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party services and are not responsible for their privacy practices.
Our websites and services may include links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party services and are not responsible for their privacy practices.
The Data We Collect About You
The Data We Collect About You
We collect, use, store, and transfer different categories of data, some or all of which may contain personal data, which we have grouped as follows:
We collect, use, store, and transfer different categories of data, some or all of which may contain personal data, which we have grouped as follows:
Category
Description
Identity Data
First name, last name, title, job role, and the name of your organisation.
Contact Data
Postal address, email address, telephone numbers, and messaging or social network identifiers
Account Data
Username, password (stored in hashed form), account and notification preferences, role and permissions within the Anaphora platform, and administrator designations.
Transaction Data
Details of subscriptions, orders, fees, payments, and invoices. Full payment card details are processed by our payment service providers and are not stored by us.
Technical Data
Internet protocol (IP) address, browser type and version, time zone setting and location, operating system, device type and identifiers, and other technology on the devices you use to access our websites or platform.
Usage Data
Information about how you use our websites, platform, and services, including pages visited, features used, campaigns and events you configure, session duration, API call logs, and platform performance metrics.
Marketing and Communi-cations Data
Your preferences in receiving marketing from us and your communication preferences, including newsletter subscription status.
Support Data
Information you provide when you contact us for support, including correspondence, support ticket content, and any information you choose to include.
Category
Description
Identity Data
First name, last name, title, job role, and the name of your organisation.
Contact Data
Postal address, email address, telephone numbers, and messaging or social network identifiers
Account Data
Username, password (stored in hashed form), account and notification preferences, role and permissions within the Anaphora platform, and administrator designations.
Transaction Data
Details of subscriptions, orders, fees, payments, and invoices. Full payment card details are processed by our payment service providers and are not stored by us.
Technical Data
Internet protocol (IP) address, browser type and version, time zone setting and location, operating system, device type and identifiers, and other technology on the devices you use to access our websites or platform.
Usage Data
Information about how you use our websites, platform, and services, including pages visited, features used, campaigns and events you configure, session duration, API call logs, and platform performance metrics.
Marketing and Communi-cations Data
Your preferences in receiving marketing from us and your communication preferences, including newsletter subscription status.
Support Data
Information you provide when you contact us for support, including correspondence, support ticket content, and any information you choose to include.
Category
Description
Identity Data
Identity Data
First name, last name, title, job role, and the name of your organisation.
First name, last name, title, job role, and the name of your organisation.
Contact Data
Contact Data
Postal address, email address, telephone numbers, and messaging or social network identifiers
Postal address, email address, telephone numbers, and messaging or social network identifiers
Account Data
Account Data
Username, password (stored in hashed form), account and notification preferences, role and permissions within the Anaphora platform, and administrator designations.
Username, password (stored in hashed form), account and notification preferences, role and permissions within the Anaphora platform, and administrator designations.
Transaction Data
Transaction Data
Details of subscriptions, orders, fees, payments, and invoices. Full payment card details are processed by our payment service providers and are not stored by us.
Details of subscriptions, orders, fees, payments, and invoices. Full payment card details are processed by our payment service providers and are not stored by us.
Technical Data
Technical Data
Internet protocol (IP) address, browser type and version, time zone setting and location, operating system, device type and identifiers, and other technology on the devices you use to access our websites or platform.
Internet protocol (IP) address, browser type and version, time zone setting and location, operating system, device type and identifiers, and other technology on the devices you use to access our websites or platform.
Usage Data
Usage Data
Information about how you use our websites, platform, and services, including pages visited, features used, campaigns and events you configure, session duration, API call logs, and platform performance metrics.
Information about how you use our websites, platform, and services, including pages visited, features used, campaigns and events you configure, session duration, API call logs, and platform performance metrics.
Marketing and Communications Data
Marketing and Communications Data
Your preferences in receiving marketing from us and your communication preferences, including newsletter subscription status.
Your preferences in receiving marketing from us and your communication preferences, including newsletter subscription status.
Support Data
Support Data
Information you provide when you contact us for support, including correspondence, support ticket content, and any information you choose to include.
Information you provide when you contact us for support, including correspondence, support ticket content, and any information you choose to include.
Aggregated Data
Aggregated Data
We also collect, use, and share aggregated data such as statistical or demographic data. Aggregated data may be derived from your personal data but is not considered personal data in law where it does not directly or indirectly reveal your identity. If we combine aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data in accordance with this policy.
We also collect, use, and share aggregated data such as statistical or demographic data. Aggregated data may be derived from your personal data but is not considered personal data in law where it does not directly or indirectly reveal your identity. If we combine aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data in accordance with this policy.
Special Categories of Personal Data
Special Categories of Personal Data
We do not collect any special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). We do not collect any information about criminal convictions and offences.
We do not collect any special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). We do not collect any information about criminal convictions and offences.
Children
Children
The Anaphora platform and our websites are intended for business use and are not directed at children or minors. We do not knowingly collect personal data from individuals under 18. In particular, we do not sell the personal data of, or use personal data for targeted advertising directed at, individuals we know or have reason to believe are under 18, in accordance with applicable US state laws. If you believe we have collected information about an individual under 18 in our capacity as controller, please contact us at privacy@anaphora.tech so that we may delete the information.
The Anaphora platform and our websites are intended for business use and are not directed at children or minors. We do not knowingly collect personal data from individuals under 18. In particular, we do not sell the personal data of, or use personal data for targeted advertising directed at, individuals we know or have reason to believe are under 18, in accordance with applicable US state laws. If you believe we have collected information about an individual under 18 in our capacity as controller, please contact us at privacy@anaphora.tech so that we may delete the information.
If You Fail to Provide Personal Data
If You Fail to Provide Personal Data
Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with our services). In that case we may have to cancel a service you have with us, but we will notify you if this is so at the time.
Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with our services). In that case we may have to cancel a service you have with us, but we will notify you if this is so at the time.
How Your Personal Data Is Collected
How Your Personal Data Is Collected
We collect personal data through the following methods:
We collect personal data through the following methods:
Direct interactions
Direct interactions
You provide us with Identity, Contact, Account, Transaction, Support, and Marketing and Communications Data when you:
• register for an Anaphora account or subscribe to our services;
• configure or use the platform as a representative of a business customer;
• contact us via our websites, email, contact forms, or support channels;
• request a demonstration, attend an event, or register for a webinar;
• subscribe to our newsletter or request marketing materials;
• provide feedback or participate in a survey; or
• enter into or perform a commercial agreement with us.
You provide us with Identity, Contact, Account, Transaction, Support, and Marketing and Communications Data when you:
• register for an Anaphora account or subscribe to our services;
• configure or use the platform as a representative of a business customer;
• contact us via our websites, email, contact forms, or support channels;
• request a demonstration, attend an event, or register for a webinar;
• subscribe to our newsletter or request marketing materials;
• provide feedback or participate in a survey; or
• enter into or perform a commercial agreement with us.
Automated technologies
Automated technologies
When you interact with our websites or use the Anaphora platform, we automatically collect Technical Data and Usage Data using cookies, server logs, and similar technologies. See section 13 and our Cookie Policy (anaphora.tech/cookie-policy) for further details.
When you interact with our websites or use the Anaphora platform, we automatically collect Technical Data and Usage Data using cookies, server logs, and similar technologies. See section 13 and our Cookie Policy (anaphora.tech/cookie-policy) for further details.
Platform-generated data
Platform-generated data
When we deliver our cloud services, we automatically generate Usage Data in the form of session logs, connection metadata, feature usage statistics, error logs, and platform performance metrics. We process this data as controller for the purposes of service delivery, capacity management, billing, security, and service improvement. This is distinct from the customer content we process as a processor, which is governed by the Data Processing Addendum (see the scope limitation in the Introduction).
When we deliver our cloud services, we automatically generate Usage Data in the form of session logs, connection metadata, feature usage statistics, error logs, and platform performance metrics. We process this data as controller for the purposes of service delivery, capacity management, billing, security, and service improvement. This is distinct from the customer content we process as a processor, which is governed by the Data Processing Addendum (see the scope limitation in the Introduction).
Third parties and publicly available sources
Third parties and publicly available sources
We may receive personal data about you from third parties and public sources, including:
• analytics providers;
• advertising and lead enrichment services;
• payment and billing service providers; and
• publicly available sources, including your organisation's website and professional networking profiles.
We may receive personal data about you from third parties and public sources, including:
• analytics providers;
• advertising and lead enrichment services;
• payment and billing service providers; and
• publicly available sources, including your organisation's website and professional networking profiles.
How We Use Your Personal Data
How We Use Your Personal Data
We will only process your personal data where we have a lawful basis to do so. The table below sets out the purposes for which we process personal data, the categories of data involved, and the legal basis we rely on in each case.
We will only process your personal data where we have a lawful basis to do so. The table below sets out the purposes for which we process personal data, the categories of data involved, and the legal basis we rely on in each case.
Purpose/Activity
Data Categories
Lawful Basis
To register you as a user and administer your Anaphora account
Identity, Contact, Account
Performance of contract; Legitimate interests (administering customer accounts)
To deliver our services and manage the customer relationship, including processing orders, subscriptions, and payments
Identity, Contact, Account, Transaction
Performance of contract; Legitimate interests (to recover sums due to us)
To operate, secure, and improve the Anaphora platform, including troubleshooting, testing, system maintenance, and capacity management
Technical, Usage
Legitimate interests (operating, securing, and improving our platform)
To respond to enquiries, support requests, and feedback
Identity, Contact, Support
Performance of contract; Legitimate interests (servicing your request)
To send you marketing communications, including newsletters
Identity, Contact, Marketing and Communications
Consent (newsletter sign-up); Legitimate interests (marketing to existing customers, soft opt-in)
To deliver relevant website content and to measure and understand the effectiveness of our communications
Identity, Contact, Technical, Usage, Marketing and Communications
Consent (non-essential cookies); Legitimate interests (developing our services and growing our business)
To comply with legal, regulatory, tax, accounting, or reporting requirements
All categories as necessary
Legal obligation; Legitimate interests (compliance and risk management)
To establish, exercise, or defend legal claims, and in connection with a corporate transaction
All categories as necessary
Legitimate interests (protecting our legal rights and pursuing corporate transactions)
Purpose/Activity
Data Categories
Lawful Basis
To register you as a user and administer your Anaphora account
Identity, Contact, Account
Performance of contract; Legitimate interests (administering customer accounts)
To deliver our services and manage the customer relationship, including processing orders, subscriptions, and payments
Identity, Contact, Account, Transaction
Performance of contract; Legitimate interests (to recover sums due to us)
To operate, secure, and improve the Anaphora platform, including troubleshooting, testing, system maintenance, and capacity management
Technical, Usage
Legitimate interests (operating, securing, and improving our platform)
To respond to enquiries, support requests, and feedback
Identity, Contact, Support
Performance of contract; Legitimate interests (servicing your request)
To send you marketing communications, including newsletters
Identity, Contact, Marketing and Communications
Consent (newsletter sign-up); Legitimate interests (marketing to existing customers, soft opt-in)
To deliver relevant website content and to measure and understand the effectiveness of our communications
Identity, Contact, Technical, Usage, Marketing and Communications
Consent (non-essential cookies); Legitimate interests (developing our services and growing our business)
To comply with legal, regulatory, tax, accounting, or reporting requirements
All categories as necessary
Legal obligation; Legitimate interests (compliance and risk management)
To establish, exercise, or defend legal claims, and in connection with a corporate transaction
All categories as necessary
Legitimate interests (protecting our legal rights and pursuing corporate transactions)
Purpose/Activity
Purpose/Activity
Data Categories
Data Categories
Lawful Basis
Lawful Basis
To register you as a user and administer your Anaphora account
To register you as a user and administer your Anaphora account
Identity, Contact, Account
Identity, Contact, Account
Performance of contract; Legitimate interests (administering customer accounts)
Performance of contract; Legitimate interests (administering customer accounts)
To deliver our services and manage the customer relationship, including processing orders, subscriptions, and payments
To deliver our services and manage the customer relationship, including processing orders, subscriptions, and payments
Identity, Contact, Account, Transaction
Identity, Contact, Account, Transaction
Performance of contract; Legitimate interests (to recover sums due to us)
Performance of contract; Legitimate interests (to recover sums due to us)
To operate, secure, and improve the Anaphora platform, including troubleshooting, testing, system maintenance, and capacity management
To operate, secure, and improve the Anaphora platform, including troubleshooting, testing, system maintenance, and capacity management
Technical, Usage
Technical, Usage
Legitimate interests (operating, securing, and improving our platform)
Legitimate interests (operating, securing, and improving our platform)
To respond to enquiries, support requests, and feedback
To respond to enquiries, support requests, and feedback
Identity, Contact, Support
Identity, Contact, Support
Performance of contract; Legitimate interests (servicing your request)
Performance of contract; Legitimate interests (servicing your request)
To send you marketing communications, including newsletters
To send you marketing communications, including newsletters
Identity, Contact, Marketing and Communications
Identity, Contact, Marketing and Communications
Consent (newsletter sign-up); Legitimate interests (marketing to existing customers, soft opt-in)
Consent (newsletter sign-up); Legitimate interests (marketing to existing customers, soft opt-in)
To deliver relevant website content and to measure and understand the effectiveness of our communications
To deliver relevant website content and to measure and understand the effectiveness of our communications
Identity, Contact, Technical, Usage, Marketing and Communications
Identity, Contact, Technical, Usage, Marketing and Communications
Consent (non-essential cookies); Legitimate interests (developing our services and growing our business)
Consent (non-essential cookies); Legitimate interests (developing our services and growing our business)
To comply with legal, regulatory, tax, accounting, or reporting requirements
To comply with legal, regulatory, tax, accounting, or reporting requirements
All categories as necessary
All categories as necessary
Legal obligation; Legitimate interests (compliance and risk management)
Legal obligation; Legitimate interests (compliance and risk management)
To establish, exercise, or defend legal claims, and in connection with a corporate transaction
To establish, exercise, or defend legal claims, and in connection with a corporate transaction
All categories as necessary
All categories as necessary
Legitimate interests (protecting our legal rights and pursuing corporate transactions)
Legitimate interests (protecting our legal rights and pursuing corporate transactions)
Legitimate interests
Legitimate interests
Where we rely on legitimate interests as our legal basis, we weigh our interests against your interests, rights and freedoms, and we do not process your personal data on that basis where your interests override ours. You may contact us to obtain further information about how we have assessed our legitimate interests in respect of any specific processing activity.
Where we rely on legitimate interests as our legal basis, we weigh our interests against your interests, rights and freedoms, and we do not process your personal data on that basis where your interests override ours. You may contact us to obtain further information about how we have assessed our legitimate interests in respect of any specific processing activity.
Data minimisation
Data minimisation
We collect only the personal data that is reasonably necessary for, and proportionate to, the purposes described in this section. We do not collect or retain personal data beyond what is needed to fulfil those purposes, and we periodically review our data collection practices to ensure continued compliance with this principle.
We collect only the personal data that is reasonably necessary for, and proportionate to, the purposes described in this section. We do not collect or retain personal data beyond what is needed to fulfil those purposes, and we periodically review our data collection practices to ensure continued compliance with this principle.
Marketing
Marketing
You will receive marketing communications from us if you have requested information from us, have subscribed to our newsletter, or are an existing customer and have not opted out of receiving marketing. Where you are an existing customer, or have actively enquired about our products or services, we may send you marketing communications about our own similar products and services without prior opt-in consent, in reliance on the soft opt-in under the Swedish Marketing Act (marknadsföringslagen (2008:486)) and the ePrivacy Directive, provided you were given the opportunity to opt out when we collected your details and have not since opted out. Where we have no such prior relationship with you, including where we obtain your contact details from third-party enrichment services or public sources, we will obtain your consent before sending you marketing communications.
We will obtain your express opt-in consent before sharing your personal data with any third party for their own marketing purposes.
You can opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email, or by contacting us at privacy@anaphora.tech. Opting out of marketing does not affect personal data provided to us for service delivery or other non-marketing purposes.
You will receive marketing communications from us if you have requested information from us, have subscribed to our newsletter, or are an existing customer and have not opted out of receiving marketing. Where you are an existing customer, or have actively enquired about our products or services, we may send you marketing communications about our own similar products and services without prior opt-in consent, in reliance on the soft opt-in under the Swedish Marketing Act (marknadsföringslagen (2008:486)) and the ePrivacy Directive, provided you were given the opportunity to opt out when we collected your details and have not since opted out. Where we have no such prior relationship with you, including where we obtain your contact details from third-party enrichment services or public sources, we will obtain your consent before sending you marketing communications.
We will obtain your express opt-in consent before sharing your personal data with any third party for their own marketing purposes.
You can opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email, or by contacting us at privacy@anaphora.tech. Opting out of marketing does not affect personal data provided to us for service delivery or other non-marketing purposes.
SMS messaging programmes
SMS messaging programmes
If you sign up to receive SMS or text messages from us, we collect your mobile telephone number and a record of your consent to receive such messages, and we use this information solely to deliver the messages you have opted in to receive and to manage your messaging preferences. Where you sign up to receive SMS messages from one of our customers through the Anaphora platform, we handle your mobile number and consent record as a processor on that customer's behalf; that processing is governed by our Data Processing Addendum and the relevant customer's privacy notice (see the scope limitation in the Introduction).
With respect to our SMS messaging programmes, mobile telephone numbers, SMS opt-in data, and records of consent to receive text messages will not be sold to or shared with third parties or affiliates for their independent marketing or promotional purposes. This restriction applies to all text messaging originator opt-in data and consent information collected through our SMS programmes, whether we act as controller or processor.
You may opt out of receiving SMS messages at any time by replying STOP to any message. After opting out, you will receive a single confirmation message and no further SMS messages will be sent unless you re-subscribe. For assistance, reply HELP to any message or contact us at the details provided in section 1.
If you sign up to receive SMS or text messages from us, we collect your mobile telephone number and a record of your consent to receive such messages, and we use this information solely to deliver the messages you have opted in to receive and to manage your messaging preferences. Where you sign up to receive SMS messages from one of our customers through the Anaphora platform, we handle your mobile number and consent record as a processor on that customer's behalf; that processing is governed by our Data Processing Addendum and the relevant customer's privacy notice (see the scope limitation in the Introduction).
With respect to our SMS messaging programmes, mobile telephone numbers, SMS opt-in data, and records of consent to receive text messages will not be sold to or shared with third parties or affiliates for their independent marketing or promotional purposes. This restriction applies to all text messaging originator opt-in data and consent information collected through our SMS programmes, whether we act as controller or processor.
You may opt out of receiving SMS messages at any time by replying STOP to any message. After opting out, you will receive a single confirmation message and no further SMS messages will be sent unless you re-subscribe. For assistance, reply HELP to any message or contact us at the details provided in section 1.
Automated decision-making
Automated decision-making
We do not use your personal data, in our capacity as controller, for automated decision-making or profiling that produces legal effects concerning you or similarly significant effects. Where the Anaphora platform offers AI-enabled features, those features are addressed in section 10.
We do not use your personal data, in our capacity as controller, for automated decision-making or profiling that produces legal effects concerning you or similarly significant effects. Where the Anaphora platform offers AI-enabled features, those features are addressed in section 10.
Change of purpose
Change of purpose
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to obtain an explanation of how the processing for the new purpose is compatible with the original purpose, please contact us.
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to obtain an explanation of how the processing for the new purpose is compatible with the original purpose, please contact us.
Disclosures of Your Personal Data
Disclosures of Your Personal Data
We may share your personal data with the following categories of recipients for the purposes described in section 4:
Third party recipients acting on our instructions, who provide cloud hosting, SMS and communications delivery, analytics, payment processing, customer support tooling, email delivery, and security monitoring, as well as other services. A list of the third parties that may receive personal data in connection with our services, as of the effective date of this policy, is available at anaphora.tech/third-parties.
AI vendors whose models power certain AI-enabled features of the platform, as described in section 10.
Professional advisers including lawyers, auditors, bankers, and insurers who provide consultancy, legal, insurance, and accounting services to us. These parties typically act as independent controllers in respect of any personal data they receive.
Affiliated entities within our corporate group, who may assist with the delivery and support of our services.
Advertising and analytics partners who help us understand how visitors use our websites and deliver relevant content, where you have consented to the use of non-essential cookies or tracking technologies. These partners may act as independent controllers for the data they collect. See section 13 and our Cookie Policy for further details.
Corporate transaction counterparties in connection with a potential or actual sale, merger, acquisition, restructuring, or transfer of all or part of our business or assets. In such circumstances, personal data held by us may be among the assets transferred, and the new owner may use your personal data in accordance with this policy.
Law enforcement and regulatory authorities where we are required to do so by applicable law, court order, regulatory obligation, or legal process, or to protect the rights, property, or safety of Anaphora, our customers, or others.
We require all third parties with whom we share personal data to respect the security of your personal data and to treat it in accordance with the law. Where we engage third-party service providers, we do so under written agreements that include appropriate data protection and confidentiality obligations.
We may share your personal data with the following categories of recipients for the purposes described in section 4:
Third party recipients acting on our instructions, who provide cloud hosting, SMS and communications delivery, analytics, payment processing, customer support tooling, email delivery, and security monitoring, as well as other services. A list of the third parties that may receive personal data in connection with our services, as of the effective date of this policy, is available at anaphora.tech/third-parties.
AI vendors whose models power certain AI-enabled features of the platform, as described in section 10.
Professional advisers including lawyers, auditors, bankers, and insurers who provide consultancy, legal, insurance, and accounting services to us. These parties typically act as independent controllers in respect of any personal data they receive.
Affiliated entities within our corporate group, who may assist with the delivery and support of our services.
Advertising and analytics partners who help us understand how visitors use our websites and deliver relevant content, where you have consented to the use of non-essential cookies or tracking technologies. These partners may act as independent controllers for the data they collect. See section 13 and our Cookie Policy for further details.
Corporate transaction counterparties in connection with a potential or actual sale, merger, acquisition, restructuring, or transfer of all or part of our business or assets. In such circumstances, personal data held by us may be among the assets transferred, and the new owner may use your personal data in accordance with this policy.
Law enforcement and regulatory authorities where we are required to do so by applicable law, court order, regulatory obligation, or legal process, or to protect the rights, property, or safety of Anaphora, our customers, or others.
We require all third parties with whom we share personal data to respect the security of your personal data and to treat it in accordance with the law. Where we engage third-party service providers, we do so under written agreements that include appropriate data protection and confidentiality obligations.
International Transfers
International Transfers
We are headquartered in Sweden, and our platform infrastructure is hosted within the European Union. Some of our service providers and group entities are based outside the European Economic Area (EEA), which means that the processing of your personal data may involve a transfer of data to countries outside the EEA.
Whenever we transfer personal data internationally, we ensure that appropriate safeguards are in place, including:
EEA transfers: the European Commission's Standard Contractual Clauses (as adopted under Commission Implementing Decision (EU) 2021/914), supplemented by additional safeguards where required. We may also rely on European Commission adequacy decisions, including the EU-US Data Privacy Framework where the recipient is a certified participant.
UK transfers: the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, as issued by the Information Commissioner under section 119A of the Data Protection Act 2018. We may also rely on UK adequacy regulations, including the UK-US Data Bridge where the recipient is certified under the EU-US Data Privacy Framework (including the UK Extension).
Where required, we conduct Transfer Impact Assessments to evaluate the legal framework of the recipient country and implement supplementary technical measures (such as encryption in transit and at rest) and organisational measures to ensure an essentially equivalent level of protection for personal data. You may obtain a copy of the transfer mechanism relied upon for any specific transfer by contacting us using the details in section 1.
We are headquartered in Sweden, and our platform infrastructure is hosted within the European Union. Some of our service providers and group entities are based outside the European Economic Area (EEA), which means that the processing of your personal data may involve a transfer of data to countries outside the EEA.
Whenever we transfer personal data internationally, we ensure that appropriate safeguards are in place, including:
EEA transfers: the European Commission's Standard Contractual Clauses (as adopted under Commission Implementing Decision (EU) 2021/914), supplemented by additional safeguards where required. We may also rely on European Commission adequacy decisions, including the EU-US Data Privacy Framework where the recipient is a certified participant.
UK transfers: the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, as issued by the Information Commissioner under section 119A of the Data Protection Act 2018. We may also rely on UK adequacy regulations, including the UK-US Data Bridge where the recipient is certified under the EU-US Data Privacy Framework (including the UK Extension).
Where required, we conduct Transfer Impact Assessments to evaluate the legal framework of the recipient country and implement supplementary technical measures (such as encryption in transit and at rest) and organisational measures to ensure an essentially equivalent level of protection for personal data. You may obtain a copy of the transfer mechanism relied upon for any specific transfer by contacting us using the details in section 1.
Data Security
Data Security
We have implemented appropriate technical and organisational measures to protect your personal data against accidental loss and unauthorised access, use, alteration, or disclosure. These measures include encryption of data in transit and at rest using industry-standard algorithms, role-based access controls, use of a secure secrets manager for credentials, regular security assessments and vulnerability testing, and staff training on data protection obligations. Our cloud infrastructure is hosted with providers that maintain recognised certifications, including SOC 2 Type II and ISO 27001.
We limit access to your personal data to those employees, agents, contractors, and service providers who have a business need to know. They are subject to contractual duties of confidentiality and will only process your personal data on our instructions.
We have put in place procedures to deal with any suspected personal data breach. Where a breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, in accordance with GDPR Article 33. Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, in accordance with GDPR Article 34.
We have implemented appropriate technical and organisational measures to protect your personal data against accidental loss and unauthorised access, use, alteration, or disclosure. These measures include encryption of data in transit and at rest using industry-standard algorithms, role-based access controls, use of a secure secrets manager for credentials, regular security assessments and vulnerability testing, and staff training on data protection obligations. Our cloud infrastructure is hosted with providers that maintain recognised certifications, including SOC 2 Type II and ISO 27001.
We limit access to your personal data to those employees, agents, contractors, and service providers who have a business need to know. They are subject to contractual duties of confidentiality and will only process your personal data on our instructions.
We have put in place procedures to deal with any suspected personal data breach. Where a breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, in accordance with GDPR Article 33. Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, in accordance with GDPR Article 34.
Data Retention
Data Retention
We retain your personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected. The following table sets out our standard retention periods:
We retain your personal data only for as long as reasonably necessary to fulfil the purposes for which it was collected. The following table sets out our standard retention periods:
Data Category
Retention Period
Reason
Account Data
Duration of the customer relationship, plus up to 24 months thereafter to allow for post-termination queries and data retrieval
Service delivery and post-termination data retrieval under the customer agreement
Transaction Data
As required by applicable law, typically up to seven years
Swedish accounting and tax requirements (bokföringslagen (1999:1078))
Contact and Support Data
Duration of the business relationship, plus up to 24 months thereafter
Ongoing service delivery, warranty, and dispute-resolution periods
Marketing and Communications Data
Until you withdraw consent or opt out, or after up to 24 months of inactivity. Suppression records retained indefinitely to honour opt-outs
Consent management; legitimate interest in communicating with active contacts
Technical and Usage Data
Up to 24 months, after which data is aggregated or deleted
Security, billing verification, capacity planning, and service improvement
Identity and Contact Data (prospective customers)
Up to 24 months from your last interaction
Legitimate interest in following up on business enquiries
Data Category
Retention Period
Reason
Account Data
Duration of the customer relationship, plus up to 24 months thereafter to allow for post-termination queries and data retrieval
Service delivery and post-termination data retrieval under the customer agreement
Transaction Data
As required by applicable law, typically up to seven years
Swedish accounting and tax requirements (bokföringslagen (1999:1078))
Contact and Support Data
Duration of the business relationship, plus up to 24 months thereafter
Ongoing service delivery, warranty, and dispute-resolution periods
Marketing and Communications Data
Until you withdraw consent or opt out, or after up to 24 months of inactivity. Suppression records retained indefinitely to honour opt-outs
Consent management; legitimate interest in communicating with active contacts
Technical and Usage Data
Up to 24 months, after which data is aggregated or deleted
Security, billing verification, capacity planning, and service improvement
Identity and Contact Data (prospective customers)
Up to 24 months from your last interaction
Legitimate interest in following up on business enquiries
Data Category
Data Category
Retention Period
Retention Period
Reason
Reason
Account Data
Account Data
Duration of the customer relationship, plus up to 24 months thereafter to allow for post-termination queries and data retrieval
Duration of the customer relationship, plus up to 24 months thereafter to allow for post-termination queries and data retrieval
Service delivery and post-termination data retrieval under the customer agreement
Service delivery and post-termination data retrieval under the customer agreement
Transaction Data
Transaction Data
As required by applicable law, typically up to seven years
As required by applicable law, typically up to seven years
Swedish accounting and tax requirements (bokföringslagen (1999:1078))
Swedish accounting and tax requirements (bokföringslagen (1999:1078))
Contact and Support Data
Contact and Support Data
Duration of the business relationship, plus up to 24 months thereafter
Duration of the business relationship, plus up to 24 months thereafter
Ongoing service delivery, warranty, and dispute-resolution periods
Ongoing service delivery, warranty, and dispute-resolution periods
Marketing and Communications Data
Marketing and Communications Data
Until you withdraw consent or opt out, or after up to 24 months of inactivity. Suppression records retained indefinitely to honour opt-outs
Until you withdraw consent or opt out, or after up to 24 months of inactivity. Suppression records retained indefinitely to honour opt-outs
Consent management; legitimate interest in communicating with active contacts
Consent management; legitimate interest in communicating with active contacts
Technical and Usage Data
Technical and Usage Data
Up to 24 months, after which data is aggregated or deleted
Up to 24 months, after which data is aggregated or deleted
Security, billing verification, capacity planning, and service improvement
Security, billing verification, capacity planning, and service improvement
Identity and Contact Data (prospective customers)
Identity and Contact Data (prospective customers)
Up to 24 months from your last interaction
Up to 24 months from your last interaction
Legitimate interest in following up on business enquiries
Legitimate interest in following up on business enquiries
The retention periods above apply to personal data we process as a data controller. Retention and deletion of data we process as a processor on behalf of our customers is governed by the Data Processing Addendum and the applicable customer agreement.
We may retain your personal data for a longer period in the event of a complaint, regulatory investigation, or anticipated litigation. In all cases, we apply the principle of data minimisation and take reasonable steps to ensure personal data is not retained beyond what is necessary for the applicable purpose.
The retention periods above apply to personal data we process as a data controller. Retention and deletion of data we process as a processor on behalf of our customers is governed by the Data Processing Addendum and the applicable customer agreement.
We may retain your personal data for a longer period in the event of a complaint, regulatory investigation, or anticipated litigation. In all cases, we apply the principle of data minimisation and take reasonable steps to ensure personal data is not retained beyond what is necessary for the applicable purpose.
9. Your Legal Rights
9. Your Legal Rights
Under applicable data protection laws, you have the following rights in relation to your personal data. These rights are subject to certain conditions and exemptions prescribed by law.
Right of access: You may request a copy of the personal data we hold about you and information about how we process it.
Right to rectification: You may request that we correct any personal data that is inaccurate or incomplete.
Right to erasure: You may request that we delete your personal data in certain circumstances, such as where it is no longer necessary for the purposes for which it was collected.
Right to restriction: You may request that we restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or object to our processing.
Right to data portability: You may request that we provide your personal data to you or a third party in a structured, commonly used, machine-readable format, where we process the data on the basis of your consent or for the performance of a contract and the processing is carried out by automated means.
Right to object: You may object to our processing of your personal data where we rely on legitimate interests as our legal basis. You have an absolute right to object to the processing of your personal data for direct marketing purposes.
Right to withdraw consent: Where we rely on your consent to process personal data, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Right not to be subject to automated decision-making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. As stated in section 4, we do not currently engage in such processing as controller.
Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is IMY, whose details are set out in section 1. If you reside outside Sweden, you may lodge a complaint with the supervisory authority in your country of residence.
Under applicable data protection laws, you have the following rights in relation to your personal data. These rights are subject to certain conditions and exemptions prescribed by law.
Right of access: You may request a copy of the personal data we hold about you and information about how we process it.
Right to rectification: You may request that we correct any personal data that is inaccurate or incomplete.
Right to erasure: You may request that we delete your personal data in certain circumstances, such as where it is no longer necessary for the purposes for which it was collected.
Right to restriction: You may request that we restrict the processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or object to our processing.
Right to data portability: You may request that we provide your personal data to you or a third party in a structured, commonly used, machine-readable format, where we process the data on the basis of your consent or for the performance of a contract and the processing is carried out by automated means.
Right to object: You may object to our processing of your personal data where we rely on legitimate interests as our legal basis. You have an absolute right to object to the processing of your personal data for direct marketing purposes.
Right to withdraw consent: Where we rely on your consent to process personal data, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Right not to be subject to automated decision-making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. As stated in section 4, we do not currently engage in such processing as controller.
Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is IMY, whose details are set out in section 1. If you reside outside Sweden, you may lodge a complaint with the supervisory authority in your country of residence.
How to exercise your rights
How to exercise your rights
To exercise any of these rights, please contact us at privacy@anaphora.tech. We may need to verify your identity before processing your request, as a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We will respond to all legitimate requests within one month. If your request is particularly complex or you have made multiple requests, we may extend this period by up to two further months and will notify you accordingly.
To exercise any of these rights, please contact us at privacy@anaphora.tech. We may need to verify your identity before processing your request, as a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We will respond to all legitimate requests within one month. If your request is particularly complex or you have made multiple requests, we may extend this period by up to two further months and will notify you accordingly.
No fee usually required
No fee usually required
You will not have to pay a fee to exercise your rights. However, we may charge a reasonable fee or refuse to comply with a request that is manifestly unfounded, repetitive, or excessive.
You will not have to pay a fee to exercise your rights. However, we may charge a reasonable fee or refuse to comply with a request that is manifestly unfounded, repetitive, or excessive.
Artificial Intelligence and Automated Processing
Artificial Intelligence and Automated Processing
The Anaphora platform offers optional AI-enabled features (our "AI Offerings") that help our customers generate brand-compliant content and communications. AI Offerings are features enabled by artificial intelligence, machine learning, computer vision, or similar technologies. This section explains, for transparency, how those features handle personal data and the safeguards we apply. Use of AI Offerings is optional and is also governed by our AI Terms (available at anaphora.tech/ai-terms).
The Anaphora platform offers optional AI-enabled features (our "AI Offerings") that help our customers generate brand-compliant content and communications. AI Offerings are features enabled by artificial intelligence, machine learning, computer vision, or similar technologies. This section explains, for transparency, how those features handle personal data and the safeguards we apply. Use of AI Offerings is optional and is also governed by our AI Terms (available at anaphora.tech/ai-terms).
How AI Offerings process personal data
How AI Offerings process personal data
When a customer uses AI Offerings, the inputs to those features ("Prompts") and the content they generate ("Output") are part of the customer content we process as a processor on the customer's behalf. To the extent Prompts or Output contain personal data, that processing is governed by the Data Processing Addendum and the relevant customer agreement, not by this controller policy. We act as controller only for the limited platform-generated and account data described in sections 2 and 3 that arises from operating these features.
When a customer uses AI Offerings, the inputs to those features ("Prompts") and the content they generate ("Output") are part of the customer content we process as a processor on the customer's behalf. To the extent Prompts or Output contain personal data, that processing is governed by the Data Processing Addendum and the relevant customer agreement, not by this controller policy. We act as controller only for the limited platform-generated and account data described in sections 2 and 3 that arises from operating these features.
AI vendors and sub-processing
AI vendors and sub-processing
AI Offerings rely on third-party model providers (our "AI vendors"). Where Prompts or Output contain personal data, these AI vendors act as our sub-processors. We maintain data processing agreements with each AI vendor. A list of our current AI vendors, as of the effective date of this policy, is available at anaphora.tech/ai-vendors.
AI Offerings rely on third-party model providers (our "AI vendors"). Where Prompts or Output contain personal data, these AI vendors act as our sub-processors. We maintain data processing agreements with each AI vendor. A list of our current AI vendors, as of the effective date of this policy, is available at anaphora.tech/ai-vendors.
No training on your data
No training on your data
We do not use Prompts or Output to train, fine-tune, or otherwise improve AI models or AI Offerings, except to the extent the data has been anonymised or aggregated, or as the customer otherwise authorises. We select AI vendor account tiers that, according to the applicable vendor data policy, do not permit the vendor to use Prompts or Output for general model training.
We do not use Prompts or Output to train, fine-tune, or otherwise improve AI models or AI Offerings, except to the extent the data has been anonymised or aggregated, or as the customer otherwise authorises. We select AI vendor account tiers that, according to the applicable vendor data policy, do not permit the vendor to use Prompts or Output for general model training.
Your rights in relation to AI processing
Your rights in relation to AI processing
We do not use AI Offerings, in our capacity as controller, to make decisions about you based solely on automated processing that produce legal or similarly significant effects. Where you are a resident of a US state whose law provides a right to opt out of profiling in furtherance of automated decisions, see section 14.
We do not use AI Offerings, in our capacity as controller, to make decisions about you based solely on automated processing that produce legal or similarly significant effects. Where you are a resident of a US state whose law provides a right to opt out of profiling in furtherance of automated decisions, see section 14.
Jurisdiction
Jurisdiction
Anaphora AB is located in Sweden. This privacy policy and any matters relating to it are governed by the laws of Sweden, without regard to conflict-of-law principles. Nothing in this section limits any rights or protections available to you under the data protection or privacy laws of your own jurisdiction, including the US state privacy laws described in section 14; where those laws apply to you, they govern your rights and our corresponding obligations. Where Anaphora, Inc. is the relevant controller (see section 1), the applicable US state privacy laws govern the processing of your personal data.
Anaphora AB is located in Sweden. This privacy policy and any matters relating to it are governed by the laws of Sweden, without regard to conflict-of-law principles. Nothing in this section limits any rights or protections available to you under the data protection or privacy laws of your own jurisdiction, including the US state privacy laws described in section 14; where those laws apply to you, they govern your rights and our corresponding obligations. Where Anaphora, Inc. is the relevant controller (see section 1), the applicable US state privacy laws govern the processing of your personal data.
Glossary
Glossary
AI Offerings, Prompts, and Output have the meanings given in section 10 and in our AI Terms. AI vendors are the third-party providers of the AI models that power AI Offerings.
Comply with a legal obligation means processing your personal data where it is necessary for compliance with a legal or regulatory obligation to which we are subject.
Consent means a freely given, specific, informed, and unambiguous indication of your wishes by which you signify your agreement to the processing of your personal data for a particular purpose. You may withdraw your consent at any time by contacting us or, where applicable, by adjusting your cookie or communication preferences.
Legitimate interests means the interest of our business in conducting and managing our operations to enable us to provide the best service and the most secure experience. We consider and balance any potential impact on you and your rights before we process your personal data for our legitimate interests, and we do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted by law). You may contact us for further information about how we assess our legitimate interests.
Performance of contract means processing your data where it is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into such a contract.
Personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements.
AI Offerings, Prompts, and Output have the meanings given in section 10 and in our AI Terms. AI vendors are the third-party providers of the AI models that power AI Offerings.
Comply with a legal obligation means processing your personal data where it is necessary for compliance with a legal or regulatory obligation to which we are subject.
Consent means a freely given, specific, informed, and unambiguous indication of your wishes by which you signify your agreement to the processing of your personal data for a particular purpose. You may withdraw your consent at any time by contacting us or, where applicable, by adjusting your cookie or communication preferences.
Legitimate interests means the interest of our business in conducting and managing our operations to enable us to provide the best service and the most secure experience. We consider and balance any potential impact on you and your rights before we process your personal data for our legitimate interests, and we do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted by law). You may contact us for further information about how we assess our legitimate interests.
Performance of contract means processing your data where it is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into such a contract.
Personal data means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements.
Cookies and Tracking Technologies
Cookies and Tracking Technologies
We use cookies and similar tracking technologies on our websites to operate the site, analyse usage, and deliver relevant content. Non-essential cookies are not activated until you give your explicit consent, in accordance with the Swedish Electronic Communications Act (lag om elektronisk kommunikation (2022:482)) and the ePrivacy Directive.
When you first visit our websites from a jurisdiction that requires prior consent (including the EEA and the UK), our consent management platform will give you the option to accept all cookies, reject all non-essential cookies, or customise your preferences. You can change your preferences at any time using the cookie settings link in the footer of any page. For full details of the cookies we use, their purposes and durations, and how to manage your preferences, please refer to our Cookie Policy at anaphora.tech/cookie-policy.
In summary, we use the following categories of cookies:
Strictly necessary cookies: essential for the operation of the website, such as session management and authentication. These do not require your consent.
Functional cookies: enable enhanced functionality and personalisation. Consent required.
Performance cookies (analytics): allow us to measure and improve the performance of the website. Consent required.
Targeting cookies (advertising): may be used by advertising partners to build a profile of your interests. Consent required.
We use cookies and similar tracking technologies on our websites to operate the site, analyse usage, and deliver relevant content. Non-essential cookies are not activated until you give your explicit consent, in accordance with the Swedish Electronic Communications Act (lag om elektronisk kommunikation (2022:482)) and the ePrivacy Directive.
When you first visit our websites from a jurisdiction that requires prior consent (including the EEA and the UK), our consent management platform will give you the option to accept all cookies, reject all non-essential cookies, or customise your preferences. You can change your preferences at any time using the cookie settings link in the footer of any page. For full details of the cookies we use, their purposes and durations, and how to manage your preferences, please refer to our Cookie Policy at anaphora.tech/cookie-policy.
In summary, we use the following categories of cookies:
Strictly necessary cookies: essential for the operation of the website, such as session management and authentication. These do not require your consent.
Functional cookies: enable enhanced functionality and personalisation. Consent required.
Performance cookies (analytics): allow us to measure and improve the performance of the website. Consent required.
Targeting cookies (advertising): may be used by advertising partners to build a profile of your interests. Consent required.
Do Not Track
Do Not Track
We do not currently respond to browser-based “Do Not Track” signals, as there is no universally accepted standard for how such signals should be interpreted.
We do not currently respond to browser-based “Do Not Track” signals, as there is no universally accepted standard for how such signals should be interpreted.
US State Privacy Rights
US State Privacy Rights
This section supplements the information provided elsewhere in this privacy policy and applies to residents of US states that have enacted comprehensive consumer privacy legislation, including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, and any other state with applicable privacy legislation in effect at the time of your request. This section is organised into general provisions that apply across all such states, followed by California-specific provisions.
This section supplements the information provided elsewhere in this privacy policy and applies to residents of US states that have enacted comprehensive consumer privacy legislation, including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, and any other state with applicable privacy legislation in effect at the time of your request. This section is organised into general provisions that apply across all such states, followed by California-specific provisions.
General US state privacy rights
General US state privacy rights
If you reside in a US state with a comprehensive consumer privacy law, you may have some or all of the following rights, depending on your state of residence:
Right to know and access: You may request confirmation of whether we process your personal data and, if so, access to that data together with information about the categories collected, the purposes of processing, and the categories of third parties with whom we share it.
Right to delete: You may request that we delete personal data we have collected from or about you, subject to certain exceptions permitted by law.
Right to correct: You may request that we correct inaccurate personal data that we maintain about you.
Right to opt out of sale, sharing, and targeted advertising: You may direct us not to sell or share your personal data for cross-context behavioural advertising or targeted advertising purposes.
Right to opt out of profiling: Where applicable state law provides for it (including Minnesota and Connecticut), you may opt out of profiling in furtherance of automated decisions that produce legal or similarly significant effects concerning you. You may also request information about the logic involved and what actions, if any, might change the result.
Right to data portability: Where required by applicable state law, you may request a copy of your personal data in a portable and, to the extent technically feasible, readily usable format.
Right to non-discrimination: We will not discriminate against you for exercising any of your privacy rights.
To exercise any of these rights, please contact us at privacy@anaphora.tech. We may need to verify your identity before processing your request. You may also designate an authorised agent to make a request on your behalf.
If you reside in a US state with a comprehensive consumer privacy law, you may have some or all of the following rights, depending on your state of residence:
Right to know and access: You may request confirmation of whether we process your personal data and, if so, access to that data together with information about the categories collected, the purposes of processing, and the categories of third parties with whom we share it.
Right to delete: You may request that we delete personal data we have collected from or about you, subject to certain exceptions permitted by law.
Right to correct: You may request that we correct inaccurate personal data that we maintain about you.
Right to opt out of sale, sharing, and targeted advertising: You may direct us not to sell or share your personal data for cross-context behavioural advertising or targeted advertising purposes.
Right to opt out of profiling: Where applicable state law provides for it (including Minnesota and Connecticut), you may opt out of profiling in furtherance of automated decisions that produce legal or similarly significant effects concerning you. You may also request information about the logic involved and what actions, if any, might change the result.
Right to data portability: Where required by applicable state law, you may request a copy of your personal data in a portable and, to the extent technically feasible, readily usable format.
Right to non-discrimination: We will not discriminate against you for exercising any of your privacy rights.
To exercise any of these rights, please contact us at privacy@anaphora.tech. We may need to verify your identity before processing your request. You may also designate an authorised agent to make a request on your behalf.
Sensitive data
Sensitive data
The definition of "sensitive data" or "sensitive personal information" varies by state. Some states classify financial information as sensitive; others include precise geolocation data, citizenship or immigration status; and others use expansive definitions that extend to government identifiers and additional categories. To the extent that any data we collect (such as Transaction Data processed by our payment service providers, or Technical Data that may include IP-derived geolocation) falls within a broader state-specific definition of sensitive data, we process that data only for the purposes described in section 4 and on the legal bases set out there. We do not sell sensitive data under any state's definition.
The definition of "sensitive data" or "sensitive personal information" varies by state. Some states classify financial information as sensitive; others include precise geolocation data, citizenship or immigration status; and others use expansive definitions that extend to government identifiers and additional categories. To the extent that any data we collect (such as Transaction Data processed by our payment service providers, or Technical Data that may include IP-derived geolocation) falls within a broader state-specific definition of sensitive data, we process that data only for the purposes described in section 4 and on the legal bases set out there. We do not sell sensitive data under any state's definition.
Universal opt-out mechanisms
Universal opt-out mechanisms
We do not sell your personal information, and we do not share it for cross-context behavioural advertising or targeted advertising, so there is currently no sale or sharing for you to opt out of. You may still adjust your cookie preferences at any time (see section 13) or contact us at privacy@anaphora.tech. We do not currently respond to browser-based “Do Not Track” signals, as there is no universally accepted standard for how such signals should be interpreted.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising or targeted advertising, so there is currently no sale or sharing for you to opt out of. You may still adjust your cookie preferences at any time (see section 13) or contact us at privacy@anaphora.tech. We do not currently respond to browser-based “Do Not Track” signals, as there is no universally accepted standard for how such signals should be interpreted.
California-specific provisions
California-specific provisions
The following provisions apply specifically to residents of the State of California. This sub-section is intended to comply with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (the "CCPA"). Provision of this notice is not an admission that we are a "business" within the meaning of the CCPA, and nothing in this policy may be construed as such an admission.
The following provisions apply specifically to residents of the State of California. This sub-section is intended to comply with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (the "CCPA"). Provision of this notice is not an admission that we are a "business" within the meaning of the CCPA, and nothing in this policy may be construed as such an admission.
A. Categories of personal information collected
A. Categories of personal information collected
We have collected the following categories of personal information (as defined by the CCPA) within the preceding 12 months:
We have collected the following categories of personal information (as defined by the CCPA) within the preceding 12 months:
Category
Collected
Source(s)
Identifiers (name, email, IP address, account name)
Yes
Direct; Automated; Third parties
Personal information under Cal. Civ. Code 1798.80(e) (name, address, telephone number)
Yes
Direct
Commercial information (transaction and subscription records)
Yes
Direct; Platform-generated
Internet or other electronic network activity (interaction with our websites and platform)
Yes
Automated
Geolocation data (IP-derived, approximate only)
Yes
Automated
Professional or employment-related information (job title, organisation)
Yes
Direct; Third parties
Inferences drawn from other categories to create a profile
No
N/A
Sensitive personal information
No
N/A
Category
Collected
Source(s)
Identifiers (name, email, IP address, account name)
Yes
Direct; Automated; Third parties
Personal information under Cal. Civ. Code 1798.80(e) (name, address, telephone number)
Yes
Direct
Commercial information (transaction and subscription records)
Yes
Direct; Platform-generated
Internet or other electronic network activity (interaction with our websites and platform)
Yes
Automated
Geolocation data (IP-derived, approximate only)
Yes
Automated
Professional or employment-related information (job title, organisation)
Yes
Direct; Third parties
Inferences drawn from other categories to create a profile
No
N/A
Sensitive personal information
No
N/A
Category
Category
Collected
Collected
Source(s)
Source(s)
Identifiers (name, email, IP address, account name)
Identifiers (name, email, IP address, account name)
Yes
Yes
Direct; Automated; Third parties
Direct; Automated; Third parties
Personal information under Cal. Civ. Code 1798.80(e) (name, address, telephone number)
Personal information under Cal. Civ. Code 1798.80(e) (name, address, telephone number)
Yes
Yes
Direct
Direct
Commercial information (transaction and subscription records)
Commercial information (transaction and subscription records)
Yes
Yes
Direct; Platform-generated
Direct; Platform-generated
Internet or other electronic network activity (interaction with our websites and platform)
Internet or other electronic network activity (interaction with our websites and platform)
Yes
Yes
Automated
Automated
Geolocation data (IP-derived, approximate only)
Geolocation data (IP-derived, approximate only)
Yes
Yes
Automated
Automated
Professional or employment-related information (job title, organisation)
Professional or employment-related information (job title, organisation)
Yes
Yes
Direct; Third parties
Direct; Third parties
Inferences drawn from other categories to create a profile
Inferences drawn from other categories to create a profile
No
No
N/A
N/A
Sensitive personal information
Sensitive personal information
No
No
N/A
N/A
The business and commercial purposes for which we collect and use each category are described in section 4. The categories of third parties with whom we share personal information are described in section 5. Retention periods are described in section 8.
The business and commercial purposes for which we collect and use each category are described in section 4. The categories of third parties with whom we share personal information are described in section 5. Retention periods are described in section 8.
B. Sale and sharing of personal information
B. Sale and sharing of personal information
We do not sell personal information as that term is defined under the CCPA.
We do not share personal information (as defined under the CCPA) for cross-context behavioural advertising.
We do not sell personal information as that term is defined under the CCPA.
We do not share personal information (as defined under the CCPA) for cross-context behavioural advertising.
C. Sensitive personal information
C. Sensitive personal information
We do not collect or process sensitive personal information as defined under the CCPA.
We do not collect or process sensitive personal information as defined under the CCPA.
D. Your California privacy rights
D. Your California privacy rights
As a California resident, you have the right to know and access, the right to delete, the right to correct, the right to opt out of the sale or sharing of personal information for cross-context behavioural advertising, and the right not to be discriminated against for exercising your CCPA rights. The substance of these rights is described under "General US state privacy rights" above. You also have the right to limit the use and disclosure of sensitive personal information, although, as noted, we do not collect sensitive personal information as defined under the CCPA.
As a California resident, you have the right to know and access, the right to delete, the right to correct, the right to opt out of the sale or sharing of personal information for cross-context behavioural advertising, and the right not to be discriminated against for exercising your CCPA rights. The substance of these rights is described under "General US state privacy rights" above. You also have the right to limit the use and disclosure of sensitive personal information, although, as noted, we do not collect sensitive personal information as defined under the CCPA.
E. Exercising your California rights
E. Exercising your California rights
To submit a request, please contact us at privacy@anaphora.tech. You may also designate an authorised agent to make a request on your behalf. If you use an authorised agent, we may require the agent to demonstrate that you have provided written permission, and we may require you to verify your own identity directly with us. We will verify your identity by matching information you provide against information we have on file, and will respond to verified requests within 45 days (extendable to 90 days where reasonably necessary, with notice to you). You may make a request to know or to access your personal information twice in a 12-month period. You do not need to create an account with us to make a request.
To submit a request, please contact us at privacy@anaphora.tech. You may also designate an authorised agent to make a request on your behalf. If you use an authorised agent, we may require the agent to demonstrate that you have provided written permission, and we may require you to verify your own identity directly with us. We will verify your identity by matching information you provide against information we have on file, and will respond to verified requests within 45 days (extendable to 90 days where reasonably necessary, with notice to you). You may make a request to know or to access your personal information twice in a 12-month period. You do not need to create an account with us to make a request.
F. California "Do Not Track" and Shine the Light
F. California "Do Not Track" and Shine the Light
As required by the California Online Privacy Protection Act (CalOPPA), we disclose that we do not currently respond to browser-based "Do Not Track" signals, and that third-party analytics and advertising providers may collect information about your online activities on our websites over time, as described in our Cookie Policy. Our policy is to obtain express opt-in consent before sharing personal information with third parties for their direct marketing purposes, which satisfies California's "Shine the Light" law (Civil Code section 1798.83). To make an enquiry regarding this practice, please contact us at privacy@anaphora.tech.
As required by the California Online Privacy Protection Act (CalOPPA), we disclose that we do not currently respond to browser-based "Do Not Track" signals, and that third-party analytics and advertising providers may collect information about your online activities on our websites over time, as described in our Cookie Policy. Our policy is to obtain express opt-in consent before sharing personal information with third parties for their direct marketing purposes, which satisfies California's "Shine the Light" law (Civil Code section 1798.83). To make an enquiry regarding this practice, please contact us at privacy@anaphora.tech.
Legitimate interest means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We must consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.
Legitimate interest means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We must consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.
Get in touch
Have something to say? We’d love to hear from you! Whether you want to share feedback, ask a question, or simply make a connection, we’re here to listen.
Get in touch
Have something to say? We’d love to hear from you! Whether you want to share feedback, ask a question, or simply make a connection, we’re here to listen.
Get in touch
Have something to say? We’d love to hear from you! Whether you want to share feedback, ask a question, or simply make a connection, we’re here to listen.
Get in touch
Have something to say? We’d love to hear from you! Whether you want to share feedback, ask a question, or simply make a connection, we’re here to listen.