Privacy Policy

This Privacy Policy describes how Avidemic AB (reg. no. 559252-4267, Sweden), operating the Validemic service (“Validemic”, “we”, “us”), collects, uses and protects personal data when you use validemic.com and the Validemic platform. For privacy questions or to exercise your rights, contact us at privacy@validemic.com or write to Avidemic AB, Sweden.

Our core commitments

• You own your data. Your university's assessments, documents and policies remain yours.
• Everything is stored in the EU, encrypted in transit and in backups.
• You can export your content at any time from Settings, as JSON plus your original files.
• Your data is never used to train AI models.

Who is responsible for your data

Workspace content. Everything a university stores in its Validemic workspace, such as vendor reviews, uploaded documents, policies, DPIAs, agreements, survey answers and the names of colleagues and vendor contacts in it, is processed on behalf of that university. The university is the controller and we are its processor under Article 28 GDPR, bound by a data processing agreement. The university’s own privacy notice applies to that data, and requests about it should go to the university; if you contact us, we pass the request on and help the university answer it. The same applies to vendors who answer an assessment or sign an agreement through a link a university sent them.

Everything else. For user accounts, sign-in and security, our website, contact and demo requests, billing and our own email, Avidemic AB is the controller. The rest of this policy describes that processing.

What we process, why, and on what legal basis

• Your account (name, work email, organisation, country, job role, and a salted hash of your password; we never store the password itself). Used to give you access and run the service. Legal basis: performance of a contract (Art. 6(1)(b)), or, where the contract is with your university rather than you, our and the university’s legitimate interest in providing the service it has bought (Art. 6(1)(f)).
• Sign-in and security data (session cookie, one-time email codes, and short-lived request counters per IP address used to block abuse). Legal basis: legitimate interest in keeping the service and your data secure (Art. 6(1)(f)).
• Web server logs (IP address, time, page requested and browser type). Used to operate the site, detect attacks and troubleshoot. Legal basis: legitimate interest (Art. 6(1)(f)). These logs, kept on our own servers, are how we find and fix problems; we use no external analytics, tracking or advertising tools.
• Contact and demo requests, and emails with us (name, email, organisation and what you write). Used to answer you and follow up. Legal basis: steps at your request before a contract (Art. 6(1)(b)) or legitimate interest in answering enquiries (Art. 6(1)(f)).
• Service and marketing emails. We send service emails about your account (for example sign-in codes, invitations, review updates and change alerts). We may occasionally send work-related product news to people at institutions, based on legitimate interest (Art. 6(1)(f)); you can opt out at any time by replying to any such message or by emailing us, and we keep a record of opt-outs so we respect them.
• Billing records (invoice contact, institution details and payment history). Legal basis: legal obligation under Swedish accounting law (Art. 6(1)(c)).

You need to provide account details to use the platform; everything else is optional. We do not make decisions based solely on automated processing that produce legal or similarly significant effects (Art. 22). The AI in Validemic prepares material and cites its sources; people make every decision.

How long we keep it

• Accounts: while the account exists. Deleted within 30 days after you or your university close it, or after the university’s subscription ends and its export period has passed.
• Workspace content: as instructed by the university; after a subscription ends it can be exported for 30 days and is then deleted within a further 30 days (see our Terms of Service, section 19).
• One-time codes: 15 minutes. Sessions: 30 days. Abuse counters: in memory, at most 24 hours.
• Web server logs: about five weeks, then deleted by automatic rotation.
• Contact requests and emails: up to 24 months after our last contact, unless they become part of a customer relationship.
• Billing records: seven years after the end of the financial year, as Swedish accounting law requires.
• Backups: encrypted copies of the above expire automatically after at most 35 days, so deleted data disappears from backups within that time.

Who receives personal data

We never sell personal data and we show no advertising. Service providers process personal data on our behalf only under GDPR data processing agreements. The platform’s providers (hosting, backup storage, AI inference and transactional email) are all EU companies processing in the EU; the complete list with locations and safeguards is on our Compliance page. Our own email, which receives contact-form requests and messages you send us, runs on Google Workspace, provided by Google Ireland Limited. Beyond these, we disclose personal data only where the law requires it, for example to a court or authority.

Transfers outside the EU/EEA

Workspace content and account data are stored and processed only in the EU/EEA. The one exception is our own email: Google may process email in other countries, including the United States. Those transfers rely on the EU-US Data Privacy Framework, under which Google is certified, and on the European Commission’s standard contractual clauses. Please upload vendor documents to your workspace rather than emailing them to us.

Where your data is stored and how it is protected

Validemic stores customer content on servers in Sweden, with encrypted nightly backups in Finland. Data is encrypted in transit with TLS 1.2 or higher, and backups are encrypted before they leave our servers. Access within a workspace is role-based, and single sign-on through your institution’s identity provider is available on request. We sign a data processing agreement (DPA) with every institutional customer.

Your rights

Under the GDPR you have the right to:

• get access to the personal data we hold about you and a copy of it;
• have inaccurate data corrected;
• have your data erased, or its use restricted, in the cases the GDPR provides;
• receive data you gave us in a machine-readable format (data portability);
• object to processing based on legitimate interest, and object at any time to marketing, which we then stop;
• withdraw any consent you have given, without affecting earlier processing.

Email privacy@validemic.com to use these rights. We answer within one month. For workspace content, we forward your request to the university that controls it. You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se), or to the data protection authority where you live or work.

Cookies

Validemic uses only strictly necessary cookies: those required for logging in, keeping your session active and remembering your language and cookie preferences. Because we set no optional cookies, no cookie consent is required beyond this notice.

Changes

We may update this policy from time to time to reflect changes in our practices or for legal reasons. The date at the top shows the latest version, which is always available at validemic.com/privacy.