Privacy Policy
Biosonic AB Org. number: 559472-8056 Bergsundsgatan 7, 11737 Stockholm, Sweden
Last updated: February 2025
1. Who we are
BioSonic AB ("BioSonic", "we", "us") is a Swedish technology company providing AI-powered bat acoustic analysis services. This privacy policy explains how we collect, use, and protect your personal data when you use our website (biosonic.se) and our web portal.
Data controller: BioSonic AB, org.nr 559472-8056 Contact: josef.carlson@biosonic.se
2. What personal data we collect
When you create an account on our portal, we collect:
First name
Last name
Email address
Password (stored encrypted, never in plain text)
Phone number (optional)
Country
Organisation name
We also automatically collect:
Log data (IP address, browser type, pages visited, timestamps) when you use our website and portal.
3. Why we process your data and our legal basis
‘
4. Client project data
When you upload audio recordings, geographic coordinates, and project identifiers through our portal, this data is processed by BioSonic on your behalf (or on behalf of your organisation). This data is environmental and ecological in nature and is not personal data. Processing of this data is governed by your service agreement with BioSonic.
5. How we protect your data
All data is transmitted over encrypted connections (TLS 1.2+).
Cloud data is stored encrypted at rest on servers within the EU (AWS Stockholm region and Supabase, Stockholm).
Access to personal data is restricted to authorised BioSonic personnel only.
We use AWS Cognito for secure authentication.
6. Where your data is stored
All data is stored and processed within the European Union:
AWS EU Stockholm region (eu-north-1) — file storage, compute, and authentication.
Supabase (EU Stockholm) — database.
Vercel (EU) — website hosting.
Your data does not leave the European Economic Area.
7. Who we share your data with
We do not sell your personal data. Your data may be shared with:
Cloud service providers (AWS, Supabase, Vercel) — who process data on our behalf under GDPR-compliant data processing agreements.
Legal authorities — if required by law.
We do not share your data with any other third parties.
8. How long we keep your data
Account data: Retained for as long as your account is active. If you request deletion of your account, your personal data will be deleted within 30 days.
Client project data: Retained for up to 9 years unless otherwise agreed in your service contract, to support long-term ecological monitoring and regulatory requirements. Project data can be deleted earlier on request.
Log data: Retained for up to 12 months.
9. Your rights
Under GDPR, you have the right to:
Access the personal data we hold about you.
Correct inaccurate personal data.
Delete your personal data ("right to be forgotten").
Restrict processing of your personal data.
Data portability — receive your data in a machine-readable format.
Object to processing based on legitimate interest.
To exercise any of these rights, contact us at: josef.carlson@biosonic.se
We will respond within 30 days.
10. Cookies
Our website uses essential cookies required for the website to function. We do not use advertising or tracking cookies. If we introduce analytics cookies in the future, we will update this policy and ask for your consent.
11. Changes to this policy
We may update this privacy policy from time to time. The "last updated" date at the top of this page will reflect the most recent version.
12. Complaints
If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY):
Integritetsskyddsmyndigheten (IMY) Box 8114, 104 20 Stockholm imy@imy.se www.imy.se
13. Contact us
BioSonic AB Bergsundsgatan 7, 11737 Stockholm, Sweden josef.carlson@biosonic.se
