SousAI

GDPR overview

Implementation is documented rather than merely claimed. The privacy policy names the controller, lists the data categories, and maps each purpose to an Article 6 legal basis: contract performance, legal obligation for accounting, legitimate interest for security, and consent for marketing. Data subject rights are set out by article, from access under Article 15 to objection under Article 21. A separate data processing agreement is published, with a named subprocessor list, thirty days' notice before any change, breach notification within seventy-two hours, and Standard Contractual Clauses under Article 46 for transfers to the United States. Security measures are stated: TLS 1.3 in transit, AES-256 at rest, two-factor authentication, annual penetration tests. The site badges itself GDPR-adapted. No ISO 27001 or SOC 2 certification is claimed anywhere, and no data protection officer is named.

Who owns the data?

Two documents assign the roles differently, and both matter. Under the privacy policy, Passinhas Group AB is the controller for the personal data it collects through the site and the account. Under the published GDPR data processing agreement the positions reverse: the customer is the controller and Passinhas Group AB acts as processor for the operational data loaded into the service, processing it only on the customer's documented instructions, the terms of service and the DPA itself. The customer may request access, deletion within the stated retention rules, a copy of the data in a transferable format, and a security audit. The terms reserve the software, its code, design, features and logos to the vendor as exclusive property.

Reuse rights

The customer keeps the operational data it loads and can retrieve it without asking permission: the data processing agreement grants a right to obtain a copy in a transferable format, to request deletion within the retention rules, and to run a security audit. Nothing in the terms restricts what the customer then does with its own invoices, recipes or margin figures. The reverse is not symmetrical. The terms forbid reselling, sublicensing or transferring the service, modifying it, creating derivative works, reverse engineering it, or using it to build a competing product. On the vendor's side the stated purposes are limited to delivering the service, storing and processing operational data, backups and disaster recovery, analytics and system monitoring. Notably, no document on the site says anything at all about whether customer data feeds AI model training, in either direction.

Data retention & training

Hosting summary

The data processing agreement names four subprocessors and their locations: Supabase for the database, storage and backups in the EU and the United States; Vercel for hosting and the application server in the United States; Google Cloud as the underlying infrastructure beneath Supabase across several regions; and Stripe for payments in the EU and the United States. The Impressum repeats the same three primary providers. Transfers outside the EU are covered by Standard Contractual Clauses under Article 46 GDPR, and the vendor commits to thirty days' notice before adding or replacing a subprocessor. Data is encrypted with AES-256 at rest and TLS 1.3 in transit. Jurisdiction is Swedish, with disputes heard in Stockholm. One caution: the homepage displays a Swedish data centre badge and the machine-readable summary says EU-hosted, neither of which matches the contractual documents. The documents were treated as authoritative, and no Swedish hosting is established anywhere on the site.