Legal
Privacy Notice
Effective Date: 15th July 2026
This Privacy Notice ("Notice") explains how PHANA AB and its affiliates (collectively, "Phana," "we," "us," or "our") collect, use, and disclose personal data when we act as a controller of that data — for example, when you visit phana.ai, engage with our sales team, register for an event, or otherwise interact with us outside of the Phana Velocity platform itself.
This Notice does not apply to personal data that our customers upload to, process through, or store within the Phana Velocity platform (for example, evidence, architecture data, or policy documents ingested for compliance monitoring). For that data, Phana acts as a processor on behalf of our customers, who act as the controller. If you have questions about how a specific Phana customer uses your personal data within the platform, please contact that customer directly — we are not responsible for their privacy practices.
This Notice also does not apply to personal data about current or former Phana employees, job applicants, contractors, or similar personnel.
1. Introduction
Phana is headquartered in Stockholm, Sweden, and operates Phana Velocity, an agentic AI compliance automation platform serving customers across frameworks such as SOC 2, HIPAA, PCI-DSS, ISO 27001, GDPR, and others.
This Notice applies when you:
- Visit or interact with phana.ai, our blog, or our social media pages (collectively, our "Digital Properties");
- Request a demo, contact our sales team, or engage in commercial discussions with us;
- Register for or participate in webinars, events, or marketing activities;
- Otherwise communicate with us directly (e.g., by email or contact form).
Capitalized terms not defined here have the meaning given in our Terms of Service. As a Swedish company processing personal data of individuals in the EEA, we are primarily subject to the EU General Data Protection Regulation ("GDPR"), and Section 9 below governs where it conflicts with the rest of this Notice.
2. Personal Data We Collect and Disclose
| Category | Examples | Disclosed To |
|---|---|---|
| Identifiers | Name, work email, phone number, job title, company name, IP address | Phana AB; service providers (e.g., CRM, hosting, email providers); professional advisors; parties involved in a corporate transaction |
| Commercial information | Products/plans discussed, billing and transaction details | Phana AB; payment processors; professional advisors |
| Internet/device activity | Browsing behavior on our Digital Properties, log data, cookies | Phana AB; analytics partners (see Section 5) |
| Geolocation | Approximate location inferred from IP address | Phana AB; service providers |
| Communications data | Sales call recordings, support tickets, chat logs | Phana AB; service providers (e.g., call/CRM platforms) |
| Inferences | Marketing preferences inferred from engagement | Phana AB; marketing platforms |
We do not knowingly collect Sensitive Personal Data (as defined under GDPR) through our Digital Properties.
We may also disclose personal data to respond to lawful requests from law enforcement or regulators, or as required by law.
3. How We Process Personal Data
| Purpose | Legal Basis (GDPR) |
|---|---|
| Responding to demo requests, sales inquiries, and support requests | Contract; legitimate interests |
| Operating, securing, and improving our website and Digital Properties | Legitimate interests |
| Sending marketing communications about Phana Velocity | Consent (where required); legitimate interests |
| Internal business operations, accounting, and reporting | Legitimate interests; legal obligation |
| Detecting and preventing fraud, abuse, or security incidents | Legitimate interests; legal obligation |
| Complying with legal obligations (e.g., tax, regulatory requests) | Legal obligation |
You may opt out of marketing emails at any time using the unsubscribe link in any email, or by contacting us at privacy@phana.ai.
4. Sources of Personal Data
- Directly from you — when you fill out a contact form, request a demo, or email us.
- Automatically — through cookies and similar technologies when you visit phana.ai.
- From third parties — such as business partners, event organizers, or publicly available business sources (e.g., LinkedIn) used for B2B outreach.
5. Cookies and Tracking Technologies
Our website uses analytics cookies to understand site usage, subject to your consent choices via our cookie banner. We do not share personal data collected via analytics cookies with third parties for advertising purposes. You can manage cookie preferences through your browser settings or our cookie banner. We do not currently respond to browser "Do Not Track" signals.
For full details on our use of tracking technologies, see our Cookie Notice.
6. Security and Retention
We maintain technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, or destruction — consistent with the compliance and security standards we help our customers achieve.
We retain personal data only as long as necessary for the purposes described in this Notice, or as required by applicable law (e.g., Swedish/EU tax and accounting rules), after which it is deleted or anonymized.
7. Children's Privacy
Our Digital Properties are intended for business use and are not directed to individuals under 16. We do not knowingly collect personal data from children.
8. External Links
Our Digital Properties may link to third-party sites (e.g., LinkedIn, YouTube, X). We are not responsible for the privacy practices of these third parties.
9. Supplemental Information for the EEA, Switzerland, and the UK
Controller: PHANA AB, Stockholm, Sweden, is the controller for the purposes of this Notice unless stated otherwise.
Your Rights. Subject to applicable law, you have the right to:
- Access your personal data and receive a copy of it;
- Rectify inaccurate or incomplete data;
- Erasure of your data in certain circumstances;
- Restrict or object to processing in certain circumstances;
- Data portability for data processed by automated means based on consent or contract;
- Withdraw consent at any time, without affecting prior lawful processing;
- Lodge a complaint with your local supervisory authority — in Sweden, the Integritetsskyddsmyndigheten (IMY).
To exercise these rights, contact us at privacy@phana.ai.
International Transfers. Where we transfer personal data outside the EEA, Switzerland, or the UK (e.g., to service providers in the United States), we rely on appropriate safeguards such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.
10. Supplemental Information for Other Regions
We process personal data in accordance with applicable local law, including (where relevant) the UK GDPR/Data Protection Act 2018, and other regional data protection frameworks for individuals located outside the EEA/UK.
11. Contact Information
If you have questions about this Notice or our privacy practices, contact us at:
PHANA AB
Stockholm, Sweden
Email: privacy@phana.ai
12. Changes to This Notice
We may update this Notice from time to time. Material changes will be reflected by updating the "Effective Date" above. The updated Notice applies to personal data collected or processed from that date forward.