Legal

Privacy Policy

Last updated: October 9, 2026 · Effective: October 9, 2026

1. Who We Are

Squidler is operated by Squidler AB, a company registered in Sweden (collectively, "Squidler", "we", "us", or "our"). We operate the website at squidler.io and the associated platform that provisions personal AI agent instances for users.

For privacy and legal inquiries, contact us at legal@squidler.io.

2. What We Collect

We collect and process the following categories of personal data:

  • Account Data: Email address, name, and profile information provided during registration and authentication.
  • Credentials you give your agent: API keys, tokens and passwords for services you connect it to. These are encrypted at rest and are used only to reach that service on your behalf — never shared with anyone else, and never used to reach a different service.
  • Messaging Channel Credentials: Authentication tokens and configuration data for the messaging platforms you connect to your agent.
  • Agent Conversation Logs: Messages and data exchanged between you (and third parties you communicate with) and your AI agent. These logs are stored to enable the agent's functionality, including memory and context, and are encrypted at rest (see Section 5).
  • People using apps your agent builds: When an app your agent built has user login turned on, the people who use it sign in with a Squidler account (Account Data above). For each such app we also keep who may use it and with which roles, invitations (the invited email address, the roles offered, who sent it and when), requests for access (including any message written with one), and sign-in sessions for the app. What people enter into the app is stored like the rest of your agent's data.
  • Usage Data: Platform interaction data, feature usage, error logs, and performance metrics.
  • Website Analytics: Aggregate pageview and referral metrics collected through Plausible Analytics. Plausible does not set cookies, does not use browser local storage for tracking, and does not create persistent visitor identifiers.
  • Product Analytics: How you interact with the application — key events (such as signing up or hiring an agent), conversion funnels, and fully-masked session replays (no input values or text are captured) — collected through PostHog to understand and improve the Service. Browser-side collection is consent-gated; core product events are recorded server-side (see Section 3, legitimate interests). PostHog data is hosted in the EU.
  • Payment Data: Payment information is processed by Stripe. We do not store your full credit card details; we receive only limited billing identifiers from Stripe.
  • Technical Data: IP addresses, browser type, device information, and access timestamps collected automatically when you use our platform.

We process your personal data on the following legal bases:

  • Performance of a contract (Art. 6(1)(b)): Processing account data, API keys, and conversation logs is necessary to provide the Service you have subscribed to.
  • Legitimate interests (Art. 6(1)(f)): Usage data, technical data, and aggregate website analytics are processed for platform security, fraud prevention, service improvement, and troubleshooting. Our legitimate interest does not override your fundamental rights.
  • Consent (Art. 6(1)(a)): Where required, such as for optional marketing communications. You may withdraw consent at any time.
  • Legal obligation (Art. 6(1)(c)): Where we are required to retain data for tax, accounting, or regulatory purposes under Swedish or EU law.

4. GDPR Roles

For account data (your email, name, payment information), Squidler AB acts as the data controller.

For agent data (conversation logs, any data you share with or through your AI agent, and data generated by your agent), you are the data controller and Squidler AB acts as the data processor. We process this data solely on your behalf and according to your instructions (i.e., your use of the platform). A Data Processing Agreement (DPA) is available for download — see Section 16 below.

For apps your agent builds, who may use an app, their roles, invitations, access requests and what people enter into the app are agent data: the app's owner is the data controller and Squidler AB the data processor. The Squidler account each of those people signs in with is their own, and for it Squidler AB is the data controller, as for any account.

5. Security of Credentials and Content

Your API keys are treated as highly sensitive credentials. We implement the following safeguards:

  • All API keys are encrypted at rest using AES-256 encryption.
  • Keys are transmitted only over encrypted connections (TLS 1.2+).
  • Access to stored keys is strictly limited to automated systems that require them to execute AI provider API calls on your behalf.
  • We do not log, inspect, or use your API keys for any purpose other than operating your agent as instructed by you.

Your content — agent conversation logs, agent memory, desk content, and related user-generated data — is additionally protected with application-layer encryption:

  • Content is encrypted using envelope encryption: each agent instance has its own data encryption key, wrapped by a master key held in a dedicated cloud key-management service, separate from the database and its backups. The key-management service never receives your content.
  • Administrative access to decrypted content is restricted by policy and every such access is logged in an audit trail.
  • Because the Service is a server-side AI agent, our systems necessarily process your content in plaintext to operate your agent (for example, to send messages to your AI provider). This encryption protects stored data; it is not end-to-end encryption.

6. Third-Party Data Flows

To run the Service we rely on other companies — for infrastructure, for the AI models your agents think with, for sending email, for taking payments. Where they handle data on our behalf they are our sub-processors, bound by written data-processing agreements, and we remain responsible to you for what they do.

The current list is published at squidler.io/subprocessors — every company, what it does for us, what reaches it and where it processes. It lives there rather than in this policy so that it is accurate on the day you read it, and so that a change reaches you as a notice rather than as a quietly edited paragraph. We notify customers at least 7 days before that list changes, and you can ask us to send those notices to a specific address by writing to legal@squidler.io.

The categories, and what each receives:

  • AI providers: the content you and your agent exchange, including anything your agent retrieves from services you have connected, in order to generate its responses, transcriptions, images, speech and memory. None of them may use your data to train or improve their models — that is a condition of our using a provider at all, not a setting we happened to pick.
  • Infrastructure: hosting, storage and backups for everything the Service keeps, and the key management behind our content encryption (see Section 5).
  • Email: messages your agent sends and receives, including the subject, the body and any attachments, and service email such as invitations to an app your agent built, sent to the address the invitation names. Choosing EU data residency does not cover this — it governs where your data is processed by AI, not the route an email takes to a mailbox.
  • Messaging platforms you connect: messages are routed through them according to your own configuration. Those accounts are yours, under your agreement with that platform.
  • Payments: our payment processor, which acts as an independent data controller for payment data.
  • Authentication: your email address, name and the technical details of each sign-in.
  • Analytics and advertising measurement: how the Service and our public pages are used. Anything involving cookies follows the choices you make in Section 13, and session recordings are fully masked — no input values or text are captured.

7. Google Workspace Data — Limited Use

When you connect a Google account to your agent, your agent may access data from Google Workspace APIs (such as Gmail, Google Calendar, Google Drive, Contacts, Sheets, Docs, and Forms), limited to the specific services and permission levels you grant. Squidler's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

  • We use Google user data only to provide and improve the user-facing features of your agent that you have asked it to perform (for example, reading, drafting, or sending mail; managing calendar events; or working with your files).
  • We do not use Google Workspace data — and we do not allow our AI processors to use it — to develop, improve, or train generalized or non-personalized AI or machine-learning models. This restriction applies equally to the raw data and to any data derived from it.
  • We do not transfer or sell Google user data to third parties for advertising, market research, or similar purposes, and we do not make it available to data brokers.
  • We do not allow humans to read your Google user data except with your explicit consent for specific messages, where necessary for security purposes (such as investigating abuse), to comply with applicable law, or where the data has been aggregated and anonymized for internal operations.

Google data your agent retrieves is processed by our AI providers (Amazon Bedrock and OpenAI) solely to return results to you, under the no-training terms described in Section 6. You can disconnect a Google account at any time from your agent's settings, which revokes our access.

8. Your Responsibility for Data Shared with Your Agent

You are solely responsible for all data you share with, send to, or make accessible to your AI agent. This includes data shared by third parties who communicate with your agent through connected messaging channels.

As the data controller for agent data, you are responsible for:

  • Ensuring you have a lawful basis to process any personal data shared with your agent.
  • Informing third parties who interact with your agent about how their data is processed.
  • Not sharing sensitive personal data (such as Swedish personal identity numbers, passwords, financial credentials, medical or health information, or other special category data under GDPR Article 9) with your agent unless you fully understand and accept the associated risks.

Warning: Data shared with your agent may be transmitted to third-party AI providers for processing. We strongly advise against sharing sensitive personal data with your agent. If you choose to do so, you do so entirely at your own risk.

9. Data Retention and Deletion

  • Active accounts: Data is retained for as long as your account is active and as needed to provide the Service.
  • Account deletion: Upon account deletion or cancellation, we will delete or anonymize your personal data, including agent conversation logs and stored API keys, within 30 days. Certain data may be retained longer where required by law.
  • Apps with user login: who may use an app, their roles and open invitations are kept for as long as the app exists; an invitation expires after 30 days. A sign-in session for an app lasts at most 30 days and is deleted 7 days after it ends. Accepted, withdrawn or expired invitations, decided access requests and removed access are deleted after 90 days. Removing the app deletes all of it at once.
  • Backups: Residual copies in encrypted backups will be overwritten in accordance with our backup rotation schedule (no longer than 90 days). Backup data is not actively processed and is subject to the same access controls as production data.

10. International Data Transfers

Our primary infrastructure is hosted within the European Union (Hetzner, Germany). However, certain third-party services (AI providers, Stripe, Auth0) may process data outside the EU/EEA. Where such transfers occur, they are safeguarded by:

  • European Commission adequacy decisions;
  • Standard Contractual Clauses (SCCs) approved by the European Commission; or
  • Other legally recognized transfer mechanisms under GDPR Chapter V.

By providing your API keys for third-party AI providers, you acknowledge that conversation data will be transferred to the servers of those providers, which may be located outside the EU/EEA.

11. Your Rights Under GDPR

As a data subject, you have the following rights regarding your personal data:

  • Right of access (Art. 15): Obtain confirmation of whether we process your personal data and request a copy.
  • Right to rectification (Art. 16): Request correction of inaccurate personal data.
  • Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten").
  • Right to restriction (Art. 18): Request restriction of processing in certain circumstances.
  • Right to data portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format. You may export your conversation logs and agent data through the platform or by contacting us.
  • Right to object (Art. 21): Object to processing based on legitimate interests.
  • Right to withdraw consent (Art. 7(3)): Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at legal@squidler.io. We will respond within 30 days as required by GDPR. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) or another competent supervisory authority.

12. Automated Decision-Making

Your AI agent may take automated actions based on your instructions, including sending messages, browsing websites, and managing tasks. You maintain full control over your agent and can override, correct, or reverse any agent action at any time.

Squidler does not use automated decision-making or profiling that produces legal effects or similarly significant effects on you without human involvement.

13. Cookies and Tracking

We use strictly necessary and functional cookies that do not require consent:

  • Strictly necessary cookies: Used for authentication and session management.
  • App sign-in cookies: on the address of an app your agent built (such as name.squidler.app), a strictly necessary cookie that keeps you signed in to that one app for up to 30 days, and one that protects the sign-in itself for 10 minutes. They are set only for that app's address and cannot be read by squidler.io or by any other app.
  • Functional cookies (A/B testing): We set a first-party sq_vid cookie containing an opaque, randomly generated identifier — no personal data — for all visitors. It is used to assign you to experiment variants so the site experience stays consistent across visits while we test improvements. It is purely functional, not used for advertising or marketing, and is not used to track you across other sites. It has a lifetime of about one year.
  • Functional cookies (arrival source): We set a first-party sq_attr cookie recording how you arrived at our site — the campaign parameters (utm_*) and ad-click identifiers (such as gclid or fbclid) present in the address of the page you landed on, together with the referring site. It contains only information that was already in your browser's address bar, is not used to track you across other sites, and expires after 90 days. If you create an account, this information is linked to your account only if you have consented to marketing cookies; otherwise it is discarded and never stored with your account.
  • Functional cookies (new blog posts): On your first visit, we set a first-party sq_blog_seen cookie holding that day's date; when you read a post published later, it moves to that post's date. It holds nothing else. It is used only to mark Blog in the menu when a post has been published since, is never sent anywhere or linked to your account, and expires after one year.

With your consent, we additionally use cookies set through Google Tag Manager:

  • Analytics cookies (Google Analytics): usage statistics about how the website is used.
  • Marketing cookies (Google Ads): measurement of our advertising campaigns, such as conversion tracking.

On your first visit you can accept, reject, or customize these categories in the cookie banner. No analytics or marketing cookies are set unless you opt in. You can change or withdraw your choice at any time via “Cookie settings” in the page footer. Your choice is stored in the sq_consent cookie for 180 days, after which we ask again. Where consent is denied, Google tags operate in cookieless consent mode and do not store or read information on your device.

We also collect aggregate, cookieless website analytics through Plausible Analytics, which sets no cookies and does not track you across sites.

14. Children

The Service is intended for users aged 18 and above. We do not knowingly collect personal data from children and do not provide parental consent mechanisms. If you believe a child has provided us with personal data, please contact us at legal@squidler.io and we will promptly delete such data.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on the platform at least 30 days before they take effect. Your continued use of the Service after such notice constitutes acceptance of the updated policy. We encourage you to review this page periodically.

16. Contact and DPA

For all privacy-related inquiries, data subject requests, or to obtain a Data Processing Agreement (DPA):

Squidler AB
Email: legal@squidler.io

A signed DPA is available upon request. For B2B customers who act as data controllers, we recommend executing a DPA before processing begins.