Data processing agreement

This data processing agreement, version 2026-10-13-r2, is between the customer organisation identified in its pilot/service agreement (the controller) and House of Brattberg AB, registration number 559125-1805 (the processor). It applies after explicit written acceptance by both parties. A representative must have authority to bind their organisation. Merely visiting this page does not accept it.

Instructions, purpose and duration

Riktra stores, organises, retrieves and versions company direction, decisions, responsibilities, shared context and personal work notes, and serves authorised context to the customer’s people and connected AI clients. Submitted meeting material is processed to propose records for human review. Processing lasts for the agreed service period and the return/deletion process below.

The customer determines the purposes and lawful basis, informs affected people, authorises users and AI clients, and submits only information necessary for these purposes. Instructions consist of this agreement, the agreed service configuration and the customer’s authorised requests. Riktra processes customer personal data only on documented instructions, including transfers, unless applicable law requires otherwise. Riktra will inform the customer of such a legal requirement before processing unless prohibited, and will notify the customer if an instruction appears to infringe applicable data protection law.

Data and people covered

Customer data may identify employees, contractors, business contacts and people named in company records or submitted meetings. Categories include names, work contact details, roles, responsibilities, decisions, meeting contributions, account-linked authorship and private work notes. Unnecessary sensitive personal information, credentials, employee performance scoring and regulated high-risk uses are outside the initial pilot’s agreed purpose. Additional use cases require an explicit assessment and written agreement.

Riktra separately acts as controller for its own account administration, beta applications and necessary service operations as described in the privacy policy. This agreement does not transfer control of those purposes to the customer.

Confidentiality and security measures

Persons authorised to process customer data must be bound by confidentiality or an appropriate statutory obligation. Riktra restricts access according to operational need and uses database-enforced tenant isolation, authenticated membership/role checks, owner-only private application access, HTTPS transport, server-side credential handling and controlled release checks. Private application roles do not exclude privileged service/infrastructure operators; Riktra does not provide operator-excluding end-to-end encryption.

Security measures include reviewing dependencies and access, recording content-minimised operational errors, verifying backup/recovery procedures and incident handling, and maintaining the controls described on the security page. Measures are proportionate to the processing and may improve without reducing the agreed protection. No ISO certification, independent audit, guaranteed uptime or fixed recovery time is represented by this agreement.

Subprocessors and transfers

The customer gives general written authorisation for the subprocessors and processing categories listed below and in the privacy policy. Riktra will notify the customer’s designated contact at least 30 days before adding or replacing a subprocessor, allowing a reasoned data-protection objection. The parties will seek a workable alternative; if none is available, the affected processing must not proceed and the customer may end the affected service with return/deletion of data.

• Vercel: Application and MCP hosting. Every request to the service, and its server logs.
• Supabase: Database, authentication and access control. All stored data, and account credentials.
• Anthropic: Extracting candidate records from submitted material. The submitted transcript, meeting title and titles from current company context for extraction and duplicate detection. Processing begins before extracted candidates are screened for sensitivity. No extraction call occurs unless someone submits material. Customer-authorized external AI clients have their own processing terms.
• Amplitude: Optional usage analytics and AI-usage measurement. Disabled by default for every organisation. If an owner or administrator enables usage analytics, Amplitude receives fixed page categories, button/link click counts and extraction measurements (model, latency, token counts and success). No record content, search terms, full URLs, raw errors or persistent person identifiers are sent. Each event is re-authorised on the server. Session replay is unavailable and no browser sessions are recorded. Operational and security logs necessary to run the service are separate.
• Resend: Transactional email. Recipient address and message content for service emails. The sending region does not determine where email content, delivery logs and account records are stored.
• Google: Operator mailbox and optional sign-in. The operator’s Google mailbox receives operational notifications, beta-application messages and service/privacy correspondence. These copies have their own mailbox access and retention boundary. Separately, when a person chooses Google sign-in, Google returns that account’s name, email address and profile picture under its identity-service terms.
• Cloudflare: DNS resolution. Domain lookups only. No application data passes through it.

Google’s operator mailbox role covers service correspondence and operational messages; it does not mean company/private records are routinely emailed. Google sign-in is a separate optional identity service selected by the user, with its own provider terms.

Riktra binds subprocessors to applicable data-protection obligations and remains responsible to the customer for their performance of those obligations. Where processing outside the EEA requires safeguards, Riktra will establish the applicable adequacy basis or appropriate contractual safeguards and assess the transfer before that processing. A Swedish database region does not establish EU-only processing.

Import sends the transcript, meeting title and titles from existing company context to the extraction provider before sensitive candidates are screened. The customer must account for the provider’s applicable retention and terms. Separately, AI clients chosen by the customer receive authorised retrieved context under that customer’s instructions and their own provider terms. Revoking access does not delete previously received copies.

Requests, incidents and assistance

Riktra assists the customer with data-subject requests and obligations concerning security, breach notification, impact assessments and prior consultation, taking account of the processing and information available. Requests concerning customer-controlled records are directed to the customer. Identity and authority are verified before disclosure or erasure; rights of other people are protected.

Riktra will notify the customer without undue delay after becoming aware of a personal-data breach affecting customer data. The initial notice includes available facts about the nature, likely effects, affected categories and mitigation; further information may follow as the investigation develops. The customer remains responsible for its own regulatory and data-subject notification decisions. Contact: privacy@riktra.com.

Return, deletion and retained copies

At the customer’s choice, Riktra returns or deletes customer personal data after service termination and deletes remaining copies unless law requires retention. Authenticated exports provide documented company and personal scopes; company owners cannot receive colleagues’ private notes. Requests for material excluded from self-service export are handled separately with verified authority.

Confirmed company closure removes its live records, histories, memberships and private data within that company. Personal account closure removes that person’s account, memberships and private data; other companies’ governed records may remain under those controllers’ instructions. Operational erasure receipts retain opaque identifiers and times for recovery reconciliation, without customer record content.

Backup copies are isolated from normal application use and expire under the verified provider retention arrangements. Before a recovered service is reopened, erasure and revoked access must be reconciled. Riktra provides the customer’s applicable backup-retention details during contracting rather than promising immediate removal from every backup. Downloads and copies held by customer-selected AI providers remain under their recipients’ control.

Information and review

Riktra makes available information needed to demonstrate its obligations and allows and contributes to reasonable audits and inspections by the customer or its mandated auditor. The parties coordinate access, confidentiality and scope to protect other customers and service security; these arrangements do not remove mandatory rights. Supplier reports support infrastructure review and do not certify Riktra.

Precedence and contact

This agreement takes precedence over conflicting service terms on customer personal-data processing. It does not limit statutory liability or data-subject rights. The service agreement governs other matters. Processing instructions and requests go to privacy@riktra.com; service questions go to hello@riktra.com.