Privacybeleid

Johan Bjerke (Maja Athena) ("we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and protect your information when you use the samla.ai mobile application and website.

We are a Swedish company and comply with the General Data Protection Regulation (GDPR) and other applicable privacy laws.

Johan Bjerke (Maja Athena) is the data controller for your personal data.

Contact Information: • Email: privacy@samla.ai • Address: Sweden • Data Protection Officer: privacy@samla.ai

Account Information • Email address • Display name • Profile photo (optional) • Country/region and language preference • City / address details you enter for your profile (optional)

Collection Data • Item photos you capture or select • Item descriptions, categories, tags, notes, and custom fields • Storage location labels (building, room, shelf, and similar text) • AI-generated item fields and classified-ad drafts you create

Usage Data • App usage statistics: screens viewed and features used, measured with Google Analytics for Firebase and also recorded in our own database, linked to your account id while you are signed in • Device information: platform, operating system, app version, and the days on which you used the app • IP address, processed by our hosting and analytics providers when the app talks to them; we do not store it ourselves • Error and diagnostic logs, which can include the title and details of an item you were saving or editing when something failed • Records of your AI requests: the model used, tokens, cost, response time, and app version, plus the text of the request and the reply for a short period (see "Data Retention") • Marketplace activity logs when you connect a marketplace and publish listings

Payment Information • Processed by Apple App Store, Google Play, or Stripe • We receive purchase records (product, price, store, country) from our subscription provider • We do not store payment card details

Service Provision • Create and manage your account • Store and sync your collection data • Provide AI-powered item identification and categorization • Generate market value estimates and classified-ad drafts • Publish listings to marketplaces you connect

Communication • Send service-related notifications • Respond to support requests • Send marketing communications (with consent)

Improvement • Analyze app usage to improve features • Develop new functionality • Fix bugs and technical issues

Account review • A small number of administrators can look at an individual account's activity (items, AI requests, purchases, sign-in dates, and app version) to answer support requests, resolve billing questions, investigate abuse, and understand how the app is used. Access is limited to administrators under access controls.

Legal Compliance • Comply with legal obligations • Protect against fraud and abuse

Contract Performance • Providing the app services you requested • Managing your subscription • Publishing listings to marketplaces at your request

Legitimate Interest • Improving our services • Security and fraud prevention • Analytics and research • Reviewing individual account activity for support, billing, and abuse prevention

Consent • Marketing communications • Sharing photos and item details with third-party AI providers • Optional features

Legal Obligation • Compliance with applicable laws • Tax and accounting requirements

AI features (item identification, valuation assistance, price tracking, and classified-ad generation) require sending personal data to third-party AI providers.

What we send • Photos you select for analysis • Item descriptions, notes, and related collection details • Your language preference, country, and currency • City or address locality when used for classified ads

Who receives the data • OpenRouter, our AI gateway (request routing, including its web search tool when a request needs product links) • The AI model providers OpenRouter routes your request to. We only use providers that process your data in the United States or the European Union, and the current list is always shown in the app under Account & Security → AI Data Sharing (at the date of this policy: Google and OpenAI). Our servers refuse to send an ordinary user's request to any provider that is not on that list. • OpenAI directly, when configured to use its API without OpenRouter

What we keep • The text of each request and reply for up to 30 days, so we can check quality and investigate problems; photos are not stored with this record • The model used, tokens, cost, response time, and app version for up to 2 years

Purpose • Identify and categorize items • Extract item attributes and estimate market value • Draft classified ads from your item data

Permission • We ask for your explicit in-app permission before the first AI request and before any later request if you withdrew permission or our disclosure version changed. • You can withdraw permission anytime under Account & Security → AI Data Sharing. AI features then stop sending data until you allow sharing again.

Provider commitments • We require these providers to protect personal data with safeguards that are at least equivalent to those described in this policy, including contractual terms and international transfer safeguards where applicable. • Provider retention and model-training practices are governed by their own terms and our agreements with them. We do not sell your photos or collection data.

We may share your data with:

Family Accounts • If you join or create a family, every member of that family can see and edit every item in the shared collection, including photos, notes, purchase prices, and valuations • Your display name (or email) is shown to other members of your family • Leaving a family ends this sharing for new activity; items you contributed remain in the family collection

Sharing Your Collection • You can share your whole collection with other samla.ai users through a link you create on samla.ai. Anyone who has the link can accept it until it expires or you revoke it. A person who accepts can see, but not change, every item in your collection, including photos, notes, purchase prices, and valuations • Your display name (or email) is shown to the people you share with, and theirs to you • You can stop sharing with a person at any time, and they can leave; access ends on their next visit. Photos they have already viewed may remain cached in their browser

Marketplaces You Connect • When you publish a listing to eBay, Etsy, Tradera, Discogs, or Reverb, we send that listing's photos, title, description, and price to the marketplace, and, where the marketplace requires it, your seller address and the account identity the marketplace returns to us • Your marketplace credentials are stored encrypted and are removed when you disconnect the marketplace or delete your account • A barcode or ISBN you scan is sent to Open Library or Discogs to identify the item

Service Providers • Cloud hosting and authentication (Google Firebase) • Third-party AI providers (OpenRouter and the AI model providers in the United States or the European Union that it routes to, listed in the app) as described in "Third-Party AI Services" • Payment processing (Apple, Google, Stripe) • Subscription entitlement sync (RevenueCat) • Usage analytics (Google Analytics for Firebase) • Encryption key management for marketplace credentials (Google Cloud KMS) • Delivery of sign-in and account emails (Websupport) • Customer support tools

Legal Requirements • When required by law • To protect our rights or safety • In case of business transfer

We do not sell your personal data to third parties.

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States (for example Firebase, OpenRouter, and the AI model providers listed in the app).

We ensure adequate protection through: • Standard Contractual Clauses • Adequacy decisions by the European Commission • Other appropriate safeguards

For transfers to the US, we rely on service providers that comply with relevant data protection frameworks.

• Account data: Until account deletion • Collection data: Until you delete items or your account • AI request text (what you sent and what the AI replied): Up to 30 days on our servers; provider-side retention follows their terms and our configuration • AI request records without the text (model, tokens, cost, response time, app version): Up to 2 years • Usage data (app usage statistics, days active, exports): Up to 2 years • Error and diagnostic logs: Up to 90 days • Marketplace exchange logs: 30 days • Purchase records: Until account deletion, then kept for our books with your identity removed • Support communications: Up to 3 years

After account deletion, we keep a record that the deletion happened (with a one-way hash of your email address, not the address itself) and cost records with your identity removed. Anything else we must retain for legal compliance is anonymized where possible.

Under GDPR and other privacy laws, you have the right to: • Access your personal data • Rectify inaccurate data • Erase your data ("right to be forgotten") • Restrict processing • Data portability • Object to processing • Withdraw consent (including AI data sharing)

To exercise these rights, contact us at privacy@samla.ai or use in-app controls where available (for example AI Data Sharing). To delete your account and its data, use the account deletion page on samla.ai or contact support@samla.ai. We will respond within 30 days.

We implement appropriate technical and organizational measures to protect your data: • Encryption in transit and at rest • Access controls and authentication • Regular security assessments • Employee training on data protection • Incident response procedures

However, no system is 100% secure. We cannot guarantee absolute security.

Our service is not intended for children under 13. We do not knowingly collect personal data from children under 13.

If you are a parent and believe your child has provided us with personal data, please contact us immediately.

We use cookies and similar technologies for: • Essential app functionality • Analytics and performance monitoring • Measuring whether our own advertising worked • User preferences

In the app, usage measurement uses Google Analytics for Firebase. We do not show advertising in the app and we do not build advertising profiles.

On our website, everything except essential functionality is off until you agree to it. Nothing is stored and no identifier is created before you answer, and you can change your answer at any time using "Cookie settings" in the footer.

We ask about each purpose separately, and you can accept one and refuse the other: • Analytics: Google Analytics, so we can see which pages people find useful. • Advertising measurement: so that when we pay for an ad, we can tell whether the visit it produced led to a sign-up. When we are not running paid advertising, the advertising question is not asked at all and no advertising cookie is ever set.

We do not show advertising on our website or in our app. We are the advertiser, not a publisher: we buy placement on services such as the App Store and Google Search to reach people who may want samla.ai, and no third party pays us to display ads to you.

We do not build advertising profiles and we do not do remarketing. The advertising-personalisation signal used by Google is permanently switched off in our code, so even if you accept advertising measurement, you cannot be added to an advertising audience through this site.

You can also control cookies through your browser or device settings. Some features may not work if you disable essential cookies.

We may update this Privacy Policy from time to time. We will notify you of material changes through: • In-app notifications • Email notifications • App store update notes

The updated policy will be effective when posted. Material changes to third-party AI sharing may also require renewed in-app consent.

Email: privacy@samla.ai Address: Johan Bjerke (Maja Athena), Sweden

You also have the right to lodge a complaint with your local data protection authority.