Privacy Policy

Updated: May 2026

Data Controller

Kreatum AI is the data controller for the processing of your personal data.

What data do we collect?

When you contact us via form or email, we collect:

• Name
• Email address
• Company name (if relevant)
• Message/enquiry

How is the data used?

We use your personal data to:

• Respond to your enquiry
• Provide AEO services
• Send monthly reports (customers only)

Traffic Analytics (Google Analytics 4)

We use Google Analytics 4 (GA4) to understand how the website is used, such as which pages are visited and how long visitors stay. GA4 uses first-party cookies to distinguish between unique visits.

Our configuration

We have configured GA4 as follows to minimize personal data processing:

• IP anonymization enabled – your full IP address is never stored
• No advertising or remarketing – we do not use Google Ads features
• No demographic reports – we do not collect data on age, gender or interests
• No personally identifiable information (PII) – we do not track individual users

The script only loads when the site runs on our production domain (aeomotor.se). Pages with noindex tags (e.g., thank-you pages) are not measured.

Legal basis

Processing is based on Article 6.1.a GDPR (consent). GA4 statistics are only activated after you have accepted statistics via our cookie banner. You can withdraw your consent at any time by clearing your browser cookies.

Read more in Google's privacy policy: https://policies.google.com/privacy

AI Chat (Elmer)

We offer an AI-powered chat feature on our website where an AI assistant named Elmer answers questions about AEOmotor and AI visibility. Elmer is not a human.

What data is processed

When you start a chat, we store:

• Your messages and the AI assistant's responses
• A randomly generated session ID stored in your browser's localStorage (no third-party cookies)
• A hashed version of your IP address (FNV-1a with salt), used for anti-spam purposes and which cannot be traced back to your original IP
• Timestamp of consent and conversation start
• Language preference

If you submit contact details via the form in the chat, we also store:

• Name and email address (required)
• Company name and message (optional)
• Timestamp of consent

Legal basis

• Consent (Article 6.1 a GDPR) — you explicitly agree to having the conversation stored before the chat starts
• Legitimate interest (Article 6.1 f GDPR) — to respond to enquiries and improve the service

AI transparency (EU AI Act)

It is always clear that you are communicating with an AI:

• The label "AI assistant" is permanently visible in the chat window
• The first message in every session explains that Elmer is an AI
• If you ask Elmer whether it is human, the AI will honestly answer that it is not
• We do not use any manipulative or deceptive techniques

Where data is processed

The following sub-processors handle data in connection with the chat feature:

• Netlify, Inc. (USA, with EU data centres available) — hosting, serverless functions, and database
• Mistral AI SAS (France, EU) — text embeddings via the mistral-embed model for the chat's internal search function (RAG), and a Mistral model to generate chat responses
• Resend, Inc. (USA) — email notification for new contact enquiries (if enabled)

Data storage in the EU: Text embeddings (the chat's search index) and chat responses are generated and processed by Mistral AI within the EU. Chat messages are stored in our Netlify Database and automatically deleted according to the retention period below. Mistral is contractually prohibited from using chat data to train its models.

If a sub-processor processes data outside the EU, such transfer is supported by the EU-U.S. Data Privacy Framework (DPF) and/or Standard Contractual Clauses (SCC) pursuant to the European Commission's decisions.

Retention period

• Chat messages and sessions are automatically deleted after 90 days via a scheduled deletion function
• Contact details (leads) are retained until the customer relationship ends, or until you request deletion

Your rights

• Request your chat history via https://aeomotor.se/api/gdpr-export?session_id=YOUR_ID (your session ID can be found in your browser's localStorage under the key elmer_session_id)
• Delete all your chat data via a POST request to https://aeomotor.se/api/gdpr-delete with body { "session_id": "YOUR_ID" }, or by emailing kontakt@kreatum.se

Your rights

You have the right to request access to, correction or deletion of your personal data. Contact us at kontakt@kreatum.se.