Draft — under legal review
Privacy Notice
- Version
- 0.1-draft
- Updated
- Effective
- Not set (draft)
This notice explains how systown.ai AB (Systown AI) (org. no. 559163-5031, Kungsgatan 8, Stockholm, Sweden) processes personal data when you use MoatDefender. It follows Articles 13 and 14 of the General Data Protection Regulation (GDPR).
Controller: systown.ai AB (Systown AI). We have not appointed a data protection officer; contact privacy@moatdefender.com.
1. The short facts
- We keep no tracking cookies, no analytics and no ad pixels. The only cookies are the ones that keep you signed in and remember that you unlocked a password-protected share (see Cookies).
- We do not keep the original file of a deck you upload. It sits in private storage only until it is read and is deleted right after reading; an upload that is never read is deleted automatically within 48 hours. We keep a fingerprint of it, the file name, and the facts extracted from it.
- We do not sell personal data and do not use your material to train AI models.
- Readings rate companies, not people.
2. What we process, why, and on what basis
| Data | Purpose | Legal basis (GDPR Art. 6) | Kept for |
|---|---|---|---|
| Email, display name, handle, role, plan, token balance | Your account and the Service | Contract, 6(1)(b) | Until you delete your account |
| Sign-in links and sessions | Signing you in | Contract, 6(1)(b) | Links: valid 10 minutes, single use. Sessions: up to 14 days |
| Decks, text and chat answers you submit; the facts extracted; readings, explanations and share links | Producing and keeping your readings | Contract, 6(1)(b) | Until you delete them or your account. Raw deck files are deleted right after reading (unread uploads within 48 hours) |
| Personal data of other people inside material you submit (for example founders, team, customers) | Producing the reading the uploader asked for | Legitimate interest, 6(1)(f), of the uploader and us; or as a processor for a business customer (see DPA) | As the material above |
| IP address and user agent | Security, rate limits and abuse prevention | Legitimate interest, 6(1)(f) | Rate-limit counters: in memory for the length of the limit window (at most one hour). Hosting logs: short-lived hosting logs, kept according to our hosting provider's standard retention |
| Waitlist email | Telling you when access opens | Consent, 6(1)(a). Withdraw any time | Until you withdraw or join |
| Transactional emails (sign-in, receipts, notices) | Running the Service | Contract, 6(1)(b) | As the account |
| Order and payment records (when payments are live) | Bookkeeping and tax | Legal obligation, 6(1)(c) | Seven years, as Swedish bookkeeping law requires |
| Ideas, theses, deal rooms and notes, if you use those features | Those features | Contract, 6(1)(b) | Until you delete them or your account |
If you don't provide your email we cannot create an account. Everything else you submit is your choice.
3. AI processing and automated decisions
Readings are produced with AI models from AI model providers in the USA, including Anthropic and OpenAI. See the AI notice for the details.
No decision with legal or similarly significant effect on you is made solely by automated means (GDPR Art. 22). A reading is an opinion about a company. If someone else, for example an investor, uses a reading you shared, their decision is theirs. You can ask us to explain a reading, and every reading shows the evidence it relied on.
4. Who receives personal data
We use these processors. Each acts only on our instructions under a data processing agreement. The current list with locations and transfer safeguards is on Sub-processors.
- Vercel (hosting), Supabase (database).
- AI model providers in the USA, including Anthropic and OpenAI (AI model processing to produce readings, explanations and content checks). The full list is on the sub-processors page.
- Resend (email delivery). Stripe (payments, once live).
We share data with others only if you choose to (a share link or an opt-in listing), or when the law requires it.
5. Transfers outside the EU/EEA
Some processors are based in the United States. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses with supplementary measures.
6. Your rights
You have the right to access, correct, erase, restrict and port your data, to object to processing based on legitimate interest, and to withdraw consent at any time. You can:
- Download everything we hold about you as one JSON file: open /api/account/export while signed in (a button in Settings → Your data is coming), or email privacy@moatdefender.com.
- Delete your account in Settings → Your data. This removes your profile, material, readings and share links. Public share links stop working. We keep only what the law requires (bookkeeping records).
- Email privacy@moatdefender.com for anything else. We answer within one month.
You can complain to the Swedish Authority for Privacy Protection (IMY, imy.se) or the authority in your country.
7. If you are named in someone else's material
If someone uploaded material that mentions you, we process your data only to produce the reading they asked for, and it stays private to their account unless they share it. You can object, or ask us to erase your data, at privacy@moatdefender.com.
8. Security
See Security for what we actually do to protect data.
9. Children
The Service is not for people under 18.
10. Changes
We date every version of this notice. We email account holders before a material change takes effect.