Effective 26 October 2026.

1. About this notice

This notice explains how Vesence AB ("Vesence", "we", "us") processes personal data as a controller in connection with the Service. The Service means the workspace at desktop.vesence.com, the Vesence desktop app, and related features and support. It applies to Users of the Service, to administrators and billing contacts of our Customers, and to people who contact us about the Service, including through the contract withdrawal form. Section 3A also describes how we process connected Google data on behalf of Customers.

Customer Content and personal Workspaces. The documents, emails, chats and other content that Users put into or connect to the Service belong to our Customer. That may be an organization or you personally. Where the Customer acts as a controller, we process Customer Content as its processor under the Vesence Data Processing Agreement. If you use the Service for purely personal or household purposes and we act as controller, this notice applies to that processing: we process the content and connected-account data necessary to provide the features you request, on the basis of our contract with you, and retain it under the export and deletion periods in the Terms. The same security and no-training commitments apply. You can contact us directly about data in your personal Workspace. For a Workspace managed by an organization, contact that organization about content it controls.

The Vesence add-ins for Microsoft Word, Excel, PowerPoint and Outlook, the web application at app.vesence.com and our website are covered by the privacy notice at vesence.com/privacy.

2. Who we are

Vesence AB, reg. no. 559456-6902, Biblioteksgatan 11, 111 46 Stockholm, Sweden, is the controller. Contact us about privacy at [email protected].

3. What we process and why

We collect this data from you, from your organization when it invites you or manages your account, from the sign-in provider you use (Microsoft or Google), and from your use of the Service.

We do not use your personal data for automated decisions that have legal or similarly significant effects on you. We never sell personal data. We do not use it, or Customer Content, to train AI models.

3A Google sign-in and connections

Sign-in. Google provides your name, email address, account identifier and, where applicable, Google Workspace domain so we can authenticate you and associate your account with the right Workspace. Signing in does not itself give us access to Gmail, Drive or Calendar.

Connected services. You connect Gmail, Google Drive and Google Calendar separately. Access can cover the connected mailbox, files or calendars within your Google account permissions, rather than just an individual item. We use it for the connected features you use and tasks you request:

• Gmail: message content, headers, labels and attachments to read and search mail, organize messages, and prepare and send mail, and email signature settings to read and update your signature.
• Google Contacts: contact names and email addresses, including other contacts, to suggest recipients when composing email.
• Google Drive: file and folder names, content and metadata to browse, search, open, create, upload, update, move and trash files and folders.
• Google Calendar: calendar and event details, attendees and responses to display schedules, check availability, create, change, delete or respond to events, and create, change, share or delete calendars.

Processing and sharing. We manage these connections and carry out Google API requests directly or through Pipedream. For direct connections, we store access and refresh tokens encrypted on our servers; otherwise, Pipedream holds the authorization credentials. We store connected-account identifiers and permissions and receive the requested content. We do not receive your Google password. Cloudflare hosts and stores data for Vesence. When Vesence's AI features use connected content, relevant content and instructions are sent to OpenAI or Amazon Web Services through Bedrock to produce the requested result. Content may also be shared with recipients you choose, such as when you send an email or share a file.

Limits on connected data. Our use and transfer of information received from Gmail, Contacts, Drive and Calendar will comply with the Google API Services User Data Policy, including its Limited Use requirements, and the Google Workspace API policy. These limits cover copies and derived data and take precedence over general permissions elsewhere in this notice.

We do not use this information to develop, improve or train non-personalized AI or machine-learning models, or permit our providers to do so. We do not sell it, use it for advertising, disclose it to data brokers or information resellers, or use it for creditworthiness or lending purposes.

We share this information only as needed for the features you use and with your consent; where necessary for security or to comply with law; or in a merger, acquisition or asset sale with your explicit prior consent. Human reading by us or our providers requires your prior, explicit, documented consent to read specific data, unless necessary for security or to comply with law.

Disconnection and deletion. You can disconnect each service in Vesence or revoke access in your Google Account connections settings. Disconnecting stops new requests through that connection. For direct connections, we delete the stored access and refresh tokens; for connections managed through Pipedream, we start removal of the credentials from Pipedream. It does not delete content already stored in Vesence, including chats, files, previews and task results, or copies shared with others. Use the available deletion controls or contact [email protected] to request deletion; for an organization-managed Workspace, contact its administrator. Retention and deletion of stored content follow clause 14.6 of the Terms and the DPA where applicable.

The security measures in section 7 and the international-transfer safeguards in section 6 also apply to connected Google data.

4. Cookies

The Service uses only the cookies it needs to keep you signed in and to complete sign-in. These are strictly necessary, so we do not ask for consent. We use no analytics, advertising or tracking cookies in the Service.

5. Who we share personal data with

• Service providers acting for us. Examples are Cloudflare (hosting, storage and logs), Microsoft Azure (withdrawal notice storage and email acknowledgements), and Stripe (payments). They process personal data only on our instructions.
• Your organization. For an organization-managed Workspace, its administrators can see your account details, role and activity in the Workspace, and manage or close your account.
• People you choose to share with. For example, other Vesence users you add to a shared drive can see your name and email address.
• Microsoft and Google. When you sign in or connect an account, we exchange data with them to authenticate you and to act on your instructions.
• Authorities, courts and advisers, where the law requires it or to establish, exercise or defend legal claims.
• A buyer or successor, if our business is reorganized or sold. Your data stays protected under this notice.

6. Transfers outside the EU/EEA

Some of our service providers process data outside the EU/EEA. Cloudflare, Inc., for example, is based in the United States. We transfer data only with a valid safeguard: the EU–US Data Privacy Framework where the recipient is certified, or the EU Standard Contractual Clauses. Ask us at [email protected] for a copy of the relevant safeguards.

7. Security

We protect personal data with technical and organizational measures, including encryption in transit and at rest, encrypted storage of access tokens, and access restricted to personnel who need it.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy;
• rectify inaccurate data;
• erase your data, where there is no longer a reason to keep it;
• restrict our processing, for example while we check a complaint;
• data portability, for data you gave us under a contract;
• object to processing based on our legitimate interests.

To exercise a right, email [email protected]. We respond within one month. If your request concerns Customer Content, we will refer you to the relevant Customer where it is the controller; if you are the Customer of a personal Workspace, contact us directly.

You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se, or to the data protection authority where you live or work.

9. Changes to this notice

We may update this notice. We will post the new version with its effective date and keep earlier versions, which we provide on request. If a change materially affects you, we will tell you by email or in the Service before it takes effect.