Privacy policy for the AI assistant service

Scope and controller. This policy covers Finder's AI assistant search service, enquiries to its support address and visits to finder-marketing.se. Isaksson Finder Marketing AB, Swedish company registration number 559601-8209, is the controller for the personal data we process for these purposes.

Contact: Sjömärkesgatan 4 C, 722 10 Västerås, Sweden; support@finder-marketing.se.

Search information. We receive the information that your assistant includes in its tool call. Depending on the tool, this includes the selected site, town, answers to the site's questions and an optional job description of up to 140 characters. Connecting Finder does not give us access to your full conversation history. A tool call may contain information selected or summarised from your conversation.

The search tools do not require your name, phone number or email address. Please do not include these details, exact home addresses, identification numbers or sensitive personal information in a description. We apply filtering for detected links, email addresses and phone numbers. This does not guarantee that a description contains no personal data.

Technical information. Our service receives the network address used to make the request. Depending on the connection, this may be your assistant provider's address or another shared address rather than your own.

For search limits, our application stores a pseudonymous identifier generated from that address using a keyed hash, together with a request counter. It does not store the raw address in that rate-limit record. When a request comes from a network that an assistant provider has published for its service, we count requests per provider instead and store no identifier generated from the address. Limits therefore apply per network address, or per assistant provider for those networks, and are shared by everyone who uses the same address or provider. A daily limit also applies per site. The identifier and counter are deleted no later than 24 hours after the record is created. Copies in database backups are described under Retention.

Our hosting provider, Vercel, receives every request to our MCP server, our sites and finder-marketing.se and keeps a request log for us for one day. The log contains the network address, the requested web address including any query string, the identification of the browser or client and the time. Search details that your assistant sends in the body of a request to our MCP server are not included in this log. Search details sent as part of a web address, for example through our HTTP interface, are included. Our HTTP interface and the assistant tools on our town pages currently send the job description in this way, so a description sent through them is recorded in this log and deleted with it after one day. Our search function runs at our database provider, Supabase, in Frankfurt, Germany. Supabase logs the calls to the search function without your network address and without the search details, and keeps these logs for seven days. Our search function does not log search details. If an error occurs, it logs the name of the tool and a short technical error message. Vercel and Supabase may also process this information to secure and operate their platforms under their own terms.

We also count requests that identify themselves as coming from known AI assistants or crawlers on our sites, per site and day. These totals contain the date, the site, the name of the assistant or crawler from a fixed list, the type of resource requested, whether the request was signed and by which service, the number of requests and the times of the first and last request that day. They contain no network address, no web address or query string and no search details, and we keep them as statistics. Requests to our MCP server at mcp.finder-marketing.se are not included in these totals.

Visits to finder-marketing.se. When you open finder-marketing.se, including this page, Vercel processes your network address, the requested page and your browser information as described above. The site uses no cookies, visitor statistics or advertising tools. It remembers your choice of language and light or dark mode in your browser's local storage.

Purposes and legal bases.

• We use the necessary search inputs to carry out the search and prepare the link you request as part of our service to you: performance of a contract, Article 6(1)(b) GDPR.
• We store the answers and description you ask to have filled in, for the short time described under Links and visits to our sites, to provide the prefilled link as part of our service to you: performance of a contract, Article 6(1)(b) GDPR.
• We use the limited technical information described above to enforce search limits and prevent scraping and abuse, including counting the requests that fetch prefilled details: our legitimate interests in keeping the service available and protecting the listings, Article 6(1)(f) GDPR.
• We use request logs to deliver and secure finder-marketing.se, our MCP server and our sites: our legitimate interest in operating a secure service, Article 6(1)(f) GDPR.
• If you contact support, we use your sender address and message to handle and follow up your enquiry: our legitimate interest in providing support, Article 6(1)(f) GDPR. Where processing is necessary to handle a statutory data-protection request, we rely on our legal obligations under the GDPR, Article 6(1)(c).

Providing a job description is optional. The site and town are needed for a location-specific company search; additional answers are needed only for the relevant form details you want filled in.

Recipients and your assistant provider. Searching does not send your search inputs or job description to the listed companies. We return the result and any generated link to the assistant making the call.

Company names. The result contains the names of the connected companies, the same names that are shown on our town pages, but never their contact details or registration numbers. For a sole proprietorship, the name can be personal data about the business owner. We share the names so that consumers can find the companies, which is what the companies have joined our sites for. The membership agreements with the companies are currently concluded with Oliver Isaksson's sole proprietorship (Finder Marketing), Swedish company registration number 950903-8213, and will be transferred to Isaksson Finder Marketing AB. Until then, the legal basis for sharing the names is our legitimate interest in helping consumers find the connected companies, Article 6(1)(f) GDPR.

Your assistant provider handles your conversation, tool calls and returned information under the privacy information and arrangements applicable to your assistant account. Those arrangements are separate from this policy.

We use service providers for hosting, infrastructure and support:

• Vercel Inc., United States. Hosts our MCP server, our sites and finder-marketing.se and passes requests on to our search function. Receives the network address, the requested web address, the request content and the browser or client identification, and keeps request logs for one day.
• Supabase (contracting party Supabase Pte. Ltd., Singapore; database in Stockholm, Sweden; search function in Frankfurt, Germany). Runs our search function and our database, which holds the rate-limit records, the details behind prefilled links and our support inbox. Receives the search details, the network address (used to calculate the keyed hash and not stored) and support messages. When an email to our support address arrives, Supabase's function log records the sender address, the recipient address and the subject, and keeps them for seven days.
• GleSYS AB, Sweden. Hosts our own mail server, which receives email to support@finder-marketing.se, and our encrypted database backups.
• An AI service provider, United States. Sorts incoming support email, suggests replies and helps us read and answer support messages. Receives the sender address, subject and text of support messages. It is a provider of AI models, processes this data under a data processing agreement and does not use it to train its models.
• Replies from support@finder-marketing.se are sent through our email service.

International transfers. Our database is located in Stockholm, Sweden, and our search function runs in Frankfurt, Germany. Some processing takes place outside the EU/EEA.

• Vercel processes requests and request logs in the United States. Vercel is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision, and its data processing agreement also includes the EU standard contractual clauses.
• Our contracting party at Supabase is Supabase Pte. Ltd. in Singapore, and Supabase uses subprocessors in other countries, including the United States, for example for support and network delivery. These transfers are covered by the EU standard contractual clauses in Supabase's data processing agreement.
• Our AI service provider processes support messages in the United States. These transfers are covered by the EU standard contractual clauses in its data processing agreement.

You can ask for more information about these safeguards or a copy of them by writing to support@finder-marketing.se.

Links and visits to our sites. A generated link may carry selected information from your search or provide access to it for prefilling a form.

When your assistant asks us for companies in a town and includes answers to the site's questions or a short job description, we store those answers and that description on our server and return a link to the town page that contains only a random reference: a web address ending in prefill= followed by 22 characters. The link itself does not contain your answers, your description or any contact details. The reference is generated from 128 random bits and cannot reasonably be guessed. Without answers or a description, the link is simply the town page.

When the link is opened, the town page sends the reference to our server once to fill in the form, and the stored answers and description are erased at that moment. The reference only works on the site it was created for and only once. If the link is not opened, the stored details expire 30 minutes after the link was created and are deleted automatically within five minutes after that. A used or expired link opens the town page with an empty form.

For each link we store only the site, the selected answers (as option codes from that site's form), the short description (up to 140 characters, after we remove detected links, email addresses and phone numbers), the reference, and the times when the link was created, expires and was used. We do not store your network address, name or contact details with it. The request that fetches the details when the link is opened is counted for search limits as described under Technical information.

Links that the service generated before this mechanism was introduced contain the selected answers and description directly in the web address. When such a link is opened, the site reads the details from the address and removes the description from the address bar, but the full address may already have been recorded in our hosting provider's request log.

Opening the link does not submit a quote request. The destination site's privacy information describes processing when you visit it, complete the form and submit a request. Please read it before continuing. Your assistant provider or browser may retain the returned link under its own settings and policies. Once used or expired, the reference in it gives access to nothing.

Retention.

• Rate-limit identifiers and counters: no later than 24 hours after creation, as described above.
• Search inputs and generated links held by Finder or its providers: our application stores search inputs only behind a generated link. These details are erased when the link is opened and otherwise deleted no later than about 35 minutes after the link was created. Vercel's request logs, which can contain search details sent as part of a web address and the addresses of opened links, are kept for one day. Supabase's function logs, which contain no search details, are kept for seven days. Records that exist when a database backup is made, such as rate-limit records and details behind a link that has not yet been opened, can remain in our encrypted daily backups for up to 14 days and in Supabase's daily backups for up to seven days before they are deleted.
• Cached town results: used for up to 15 minutes and held only in the working memory of the search function. These contain company names, not your job description or answers. This cache period does not describe retention in the underlying company directory.
• Support messages and related records: the content is deleted 12 months and the record 24 months after we last handled the enquiry. Supabase's function logs, which record the sender address, recipient address and subject of incoming support email, are kept for seven days. Our AI service provider deletes the support content that our email sorting sends to it within 30 days, unless it must keep it longer under its usage policies. The same 30 days apply to support content processed when we read and answer support messages with its help.

Your rights. Depending on the circumstances, you may request access, correction, deletion, restriction or a portable copy of your personal data.

You may object, for reasons relating to your situation, to processing based on our legitimate interests.

Write to support@finder-marketing.se to exercise your rights. You may complain to the Swedish Authority for Privacy Protection, IMY, or another competent data protection authority, including the authority where you live.

Changes. We publish updates here and change the date above. Where required, we provide additional notice of material changes before the changed processing begins.