Privacy notice (beta)

Short version: we store as little as we can, we never sell it, and you can export or delete it yourself. Last updated 25 October 2026.

Who is responsible

Dennis Erichsen, a registered sole trader (enskild firma), Dalvägen 11, 697 34 Hallsberg, Sweden, runs Varselio and is responsible for your data (the controller). Contact: dennis@varselio.se.

What is stored, and for how long

• Account: your e-mail address, organisation name and a scrypt hash of your password (never the password itself). Kept until you delete your account.
• Sign-in sessions and a security log (sign-ins, keys, approvals, with timestamps). Kept up to 90 days.
• Checks your AI agents send (agent, tool, action, resource, description). Deleted automatically after 90 days.
• Traps and trap evidence: the traps you create and, when a trap is touched, what the visitor sent (IP address, approximate country, browser details, request), encrypted at rest. Deleted automatically after 90 days.
• E-mail confirmation: when it is switched on, new accounts get a 6-digit code by e-mail that is valid for 24 hours. Only a one-way hash of the code is stored. Accounts that are not confirmed within 48 hours are deleted automatically, with everything in them.
• Abuse limits: a keyed one-way hash of the IP address used to sign up, and a count of AI replies per account. Each entry is deleted after 24 hours. Short-term sign-in limits are kept in memory only.
• Honeytokens for your agents: a fake API key, a fake customer record (made-up name, e-mail, customer number and phone) and a fake link, created for your organisation and stored encrypted. They are not real data. If an agent tries to use one, the check is blocked and recorded like any other check.
• Shared attack memory: when an attack pattern proves itself in your account, a short, anonymised version of it (a few words of attack phrasing, never e-mail addresses, IP addresses, numbers, links or your names) may be shared so other customers are protected too. It is linked only to a keyed one-way code, never to your organisation's name. The owner can turn this off at any time by telling the Eye "stop sharing"; patterns not yet in use are then withdrawn. You still receive the shared protection.
• Stated intent: an agent may send a short note of what the user asked for, so the checkpoint can spot actions that do not match. It is used for that one check and not stored.
• Notifications: if you turn on alerts, your browser's push address for this device.

There are no tracking or advertising cookies. Your session token is kept in your browser's storage and removed when you sign out.

Who else processes it

• Render hosts the app and database in its Frankfurt (EU) region.
• xAI (Grok) writes the Eye's free-form answers. When you chat freely with the Eye, or ask it to explain an alert, your message, a short summary of your account (for example how many traps and unread alerts you have), coarse alert details and an anonymous account ID are sent to xAI. If you write in a language the Eye does not have built in, its reply (which can mention your traps or alerts) may also be sent there to be translated. Do not type secrets or other people's personal data into the chat. Fixed commands such as "set a trap" are handled by Varselio itself.
• E-mail delivery: confirmation e-mails (your address and the code, nothing else) go out through our e-mail provider's mail servers.
• Voice: speech-to-text and text-to-speech use your browser's built-in features. Depending on your browser, its maker may process the audio. Varselio never receives or stores your recordings.

We do not sell your data, use it for advertising, or use it to train AI models.

Your rights

Under the GDPR you can access, export, correct and delete your data, and object to processing. In the app go to Account, privacy & notifications, then Download my data or Delete account, or e-mail us. You can also complain to the Swedish Authority for Privacy Protection (IMY, imy.se).

Security

HTTPS, hashed passwords and API keys, encrypted trap evidence, data separated per organisation, and automatic deletion after the periods above. This is a beta: report anything that looks wrong to the e-mail above.