GRANSKA Terms, Privacy & Data Processing Terms

GRANSKA is an AI-based decision-support tool for methodological and procedural review of documents and other material, ranging from non-sensitive policies and administrative documents to material containing highly sensitive personal information.

GRANSKA does not provide legal advice, make legal decisions, or replace independent professional assessment.

AI systems can make mistakes, including incorrect conclusions, inaccurate or invented references, contextual misunderstandings, and errors in legal or methodological interpretation.

Users must independently assess the output before relying on it in legal proceedings, dealings with public authorities, or other important matters.

GRANSKA may be used by both Private Users and Organization Users, including companies, law firms, public authorities, and other professional organizations.

Private Users may use the Service with a personal account, and through some partner sites without one. Private Users are not required to purchase a subscription or make a payment.

"Customer Content" means documents, text, and other information submitted to GRANSKA, together with the analysis generated from that material.

Users may only submit material that they are legally permitted to process and provide to the Service.

MANI claims no ownership of Customer Content. Any rights remain with the user, customer organization, or other applicable rightsholder.

Customer Content is not used to train MANI's or Google's AI models.

GRANSKA is designed around Zero Data Retention and read-and-burn architecture.

Customer Content is processed only for the requested review. It is not retained as a customer history, used for profiling, or used for machine learning.

The processing works as follows:

• Customer Content is transmitted over an encrypted connection to GRANSKA's cloud environment.
• Temporary storage, queues, or caching may be used only where technically necessary to perform and deliver the analysis.
• Uploaded documents are normally deleted when the analysis is completed. If that step does not complete, the automated deletion routine below removes them.
• A generated report is deleted when it is delivered to the user's browser. A report retrieved through the API is not deleted by being read, so that a dropped connection does not lose it; it is deleted when the customer's system requests deletion.
• An automated dead-man switch runs every 15 minutes to identify and delete abandoned or residual processing data.
• Whatever happens, all Customer Content relating to a review is deleted no later than 30 minutes after the review has been completed or aborted, whether or not anyone has fetched the report.

Customer Content is therefore normally present in the system only for the minutes required to perform and deliver the requested analysis. Apart from the two exceptions in the next paragraphs, no Customer Content is stored beyond the life of the review itself. GRANSKA does not create or maintain a persistent, searchable archive of Customer Content.

The first exception concerns usage receipts written before 25 August 2026. When a review failed before that date, the error description recorded on its receipt may quote text from the document that was being reviewed. Those receipts are currently kept without a set end date, and their statistics copy for 400 days (Section 5a); neither is deleted by the 30-minute bound above. Receipts written since that date contain no document text.

The second exception concerns Google Cloud's own logs for the Service. When a review failed before 25 August 2026, the error message written to those logs may quote text from the document that was being reviewed. Since that date the Service writes its own error codes there instead, but in a few remaining cases, such as a failed attempt that is handed back to be run again, an error message produced during the processing can still reach those logs, and it can quote a fragment of a document or its analysis. Those logs are kept for 30 days, so the last entries written before 25 August 2026 are deleted by 24 September 2026, and they are stored in Google Cloud Logging's global storage location, which is not limited to the EU. They are not deleted by the 30-minute bound above.

The operational event log contains no Customer Content. What the Service's logs do contain, where they are stored, and how long they are kept, is set out in Section 5a.

MANI personnel do not have routine access to Customer Content. Any internal access during active processing is technically and organizationally restricted and may occur only when necessary for purposes such as support, troubleshooting, security, or incident handling, by authorized personnel and to the minimum extent necessary.

Once Customer Content has been deleted under the Zero Data Retention process, no persistent copy remains in GRANSKA for later access, apart from what the receipts and log entries described above may quote. MANI personnel therefore cannot subsequently retrieve or review an uploaded document after it has been deleted.

MANI processes only limited personal data for its own purposes, and not the content of what you upload, with the two exceptions described in Section 3: on usage receipts written before 25 August 2026, the error description may quote text from the document that was being reviewed, and an error message in Google Cloud's own logs, which are kept for 30 days, may quote text from a document or its analysis. This section describes that processing in general terms; Section 5a describes each category of data we hold, why we hold it, who can access it, where it is stored, and for how long.

For Organization Users, this includes the user's name, professional email address, organization, account role, and limited account and security information necessary to provide, administer, secure, and support the Service.

For Private Users with an account, this includes the email address and account identifier needed to provide the account. Private Users using a partner site without an account are not asked for account or contact information.

For all users, GRANSKA processes technical metadata necessary to operate, secure, and follow up the Service: for example timestamps, request duration, functions used, the AI resources and cost a review used, and technical status or error codes. This metadata does not contain Customer Content, except for the receipts and log entries described in Section 3. Where a user has an account, it is linked to the user's account identifier and organization, and it is then personal data.

MANI also uses this metadata for internal follow-up and statistics about how the Service is used: how many reviews are run, how long they take, what they cost, and how many shortcomings and strengths the review finds in each area of law it checks. The statistics contain counts only, never document text, quotes, or the wording of any finding; the copy of the receipts they are compiled from is described in Section 5a. Statistics about findings are compiled per organization and never per individual user within an organization, and a figure is only shown where it is based on at least five reviews.

Where MANI processes personal data relating to users, it does so where necessary to perform its agreement with the user or customer organization, comply with legal obligations, or pursue legitimate interests in administering, securing, and following up the Service. MANI does not use personal data for profiling or automated decision-making that produces legal or similarly significant effects.

The Zero Data Retention rules in Section 3 apply separately to Customer Content.

The account information requested from users is necessary to create and administer an account. Without this information, MANI may be unable to provide account access.

This section describes, by category, the personal data MANI keeps about a person who uses GRANSKA: what kind of data each category is, with representative examples, why we hold it and on what legal basis, who can access it, where it is stored, and for how long. The examples illustrate each category; they are not a list of every individual item of data. It does not cover the people described inside an uploaded document: about them, nothing is kept once the review is deleted under Section 3, except where the error description on a receipt written before 25 August 2026, or an error message in Google Cloud's own logs, quotes the document (Section 3). Receipts written since that date contain no document text, and the logs are kept for 30 days.

Apart from what is kept in your browser and the four exceptions below, the data described above is stored within the EU, in Google Cloud's europe-west1 region (Belgium). Your sign-in details are held by Firebase Authentication, which processes them only in the United States. Google Cloud's own logs are stored in Google Cloud Logging's global storage location, which is not limited to the EU. To deliver the invitation email, the recipient's email address and the content of the letter are sent to Resend, which processes and holds them in the United States (Section 7), and Resend retains its copy in accordance with its standard retention for sent emails. The notice of your feedback is held in the Feedback app, with Supabase, in a region that has not yet been confirmed.

The website uses Firebase App Check with reCAPTCHA Enterprise, services provided by Google, to protect the Service against automated abuse. To do so, it stores strictly necessary security data in your browser and sends technical signals about your browser and device to Google for risk assessment. This is done solely for security, fraud and abuse prevention, and never for analytics or advertising.

Where MANI acts as Data Controller, individuals may have rights under applicable data protection law, including rights to access, correct, delete, restrict, or object to certain processing and, where applicable, receive their personal data in a portable format.

Requests may be sent to support@utredningsgranskaren.se. They are handled manually, and answered within one month.

Where a request concerns Customer Content processed for an Organization User, that organization is normally the Data Controller. MANI will assist the organization as required under applicable law.

Because Customer Content is deleted through the Zero Data Retention architecture, MANI will normally no longer hold the relevant Customer Content when a request is received. The data described in Section 5a is held, and is covered by these rights.

Individuals may also lodge a complaint with the competent data protection authority. In Sweden, this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

GRANSKA uses Google Cloud and Google Gemini for cloud infrastructure and AI processing.

The relevant Google Cloud contracting entity is Google Cloud EMEA Limited.

The Service is configured so that Customer Content is processed within Europe/EU/EEA, apart from the log entries described in Section 3, and AI processing takes place through Google's EU multi-region on a Google Cloud endpoint with data residency restricted to EU Member States.

Customer Content submitted to the AI service is not used to train Google's or MANI's AI models.

Sign-in details are handled by Firebase Authentication, a Google service that processes them only in the United States (Section 5a).

Email that the Service sends, such as invitations to join an organization, is delivered by Plus Five Five, Inc. (trading as Resend). Resend receives the recipient's email address and the content of the message, never Customer Content. Resend processes data in the United States; the transfer is covered by the EU Commission's standard contractual clauses.

MANI may use other subprocessors where necessary to provide the Service. Subprocessors that process Customer Content must be subject to appropriate confidentiality, security, and data protection obligations.

Where personal data is transferred internationally, MANI uses the safeguards required by applicable data protection law.

Additional rules for Organization Users are set out in Schedule 1.

Users must not:

• use GRANSKA unlawfully;
• submit material they are not legally permitted to process;
• attempt to gain unauthorized access to the Service or its systems;
• interfere with the security or operation of GRANSKA;
• systematically extract or reproduce the Service or its underlying architecture for the purpose of developing a competing service; or
• present GRANSKA output as an authoritative legal or professional determination without appropriate independent assessment.

Users are responsible for the material they choose to submit and for how they use the resulting analysis.

MANI owns or licenses the intellectual property rights in GRANSKA, including its software, interface, prompt architecture, methods, design, and trademarks.

Users receive a limited, non-exclusive, non-transferable, and revocable right to use the Service for its intended purpose and in accordance with these Terms.

MANI acquires no ownership rights in Customer Content.

Subject to any third-party rights in the underlying material, users and customer organizations may use reports generated for them for their own purposes.

MANI may update GRANSKA and these Terms when necessary for legal, security, technical, or operational reasons.

Material changes will be communicated in an appropriate manner before they take effect where required by applicable law.

MANI may suspend or restrict access where reasonably necessary to protect the Service, prevent misuse, address security risks, or comply with law.

Nothing in this Section limits rights that cannot lawfully be excluded.

GRANSKA is a decision-support tool, and its output may contain errors. Users must independently assess output before relying on it.

To the maximum extent permitted by applicable law, MANI is not liable for indirect or consequential loss, loss of profit or business, litigation costs, or other losses resulting from reliance on AI-generated output without appropriate independent assessment.

MANI is not responsible for the outcome of legal, administrative, professional, or other proceedings in which GRANSKA output is used.

Nothing in these Terms excludes or limits liability that cannot lawfully be excluded or limited.

Private Users may access GRANSKA without a subscription or payment.

If a Private User qualifies as a consumer under applicable law, any mandatory consumer rights remain unaffected by these Terms.

Nothing in these Terms excludes, restricts, or replaces a consumer right that cannot legally be excluded, restricted, or replaced.

These Terms are governed by Swedish law.

For Organization Users, disputes that cannot be resolved amicably shall be determined by a competent Swedish court.

For consumers, the choice of Swedish law does not deprive the consumer of mandatory protections available under the law that would otherwise apply to the consumer.

Any mandatory rules concerning where a consumer may bring or be subject to legal proceedings also remain unaffected.

The Service is provided by:

MANI Dev AB, Swedish company registration number 559582-2338, trading as GRANSKA. Email: support@utredningsgranskaren.se

These Data Processing Terms apply whenever MANI processes personal data on behalf of an Organization User acting as Data Controller.

They form part of the agreement between MANI and the organization and are intended to satisfy the requirements applicable to processor agreements under Article 28 GDPR and corresponding requirements under other applicable data protection laws.

If these Data Processing Terms conflict with another provision of the Terms regarding MANI's processing of Customer Content on behalf of an organization, this Schedule prevails.