Privacy policy

Who we are

The controller is Sallra AB, org.nr 559577-1790, Gjutmästargatan 3, 302 47 Halmstad, Sweden. Contact: support@sallra.se. We do not currently appoint a separate data protection officer; privacy requests go to the same address.

Who the service is for

Sallra is built for business users: B2B sellers and account owners who follow up on quotes. The product is not intended for consumers acting in a private capacity.

Categories of data

Depending on how you use Sallra, we may process:

• Account and membership data: name, work email, login identifiers, role, and company affiliation.
• Company and tenancy data: company name, settings, invites, and admin choices.
• Quote data the seller enters: customer details, amounts, status, timing, and related activity in Sallra.
• Uploaded quote PDFs stored for the seller’s company.
• Mailbox connection data: OAuth tokens for the connected work mailbox (Gmail or Outlook).
• Mail messages relevant to connected quotes: thread content synced into Sallra so the product UI and follow-up can show replies and context.
• Brand-site form data: waitlist email; demo name, work email, company, and optional role, phone, and message, plus consent records.
• Technical data needed to run and secure the service (for example IP addresses processed by hosting).

Mailbox access (Google and Microsoft)

A seller may connect one work mailbox at a time: Outlook or Gmail, not both at once in the product model. Connection is via OAuth. The seller must have the right to connect that mailbox.

Gmail (Google) scopes we request: https://www.googleapis.com/auth/gmail.readonly (restricted) to find and match quote threads and sync replies; https://www.googleapis.com/auth/gmail.send (sensitive) to send mail only when the seller explicitly confirms in Sallra.

Outlook (Microsoft Graph) delegated permissions we request: offline_access, User.Read, Mail.Read, Mail.ReadWrite, and Mail.Send, for the same purposes.

What we do with mailbox data: search and read mail to attach a quote to the right thread and to sync reply content into that quote’s activity; send mail only when the seller sends from Sallra (usually a follow-up; rarely an initial mail if they started in Sallra); on a new thread started from Sallra, we may attach a quote PDF the seller uploaded in Sallra.

What we do not do: we do not use mailbox content for advertising, credit scoring, selling data, or training unrelated AI products for third parties. We are not a general inbox manager.

AI drafts (“Sally”) may use quote context and thread content the seller already has in Sallra to draft follow-ups the seller can edit. Drafting runs through our EU-based provider (Berget AI). Quote and customer data are not used to train models.

Google user data: Sallra’s use of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Where practical, we describe Google/Gmail data separately from other product data in this policy.

Microsoft Graph / Outlook mailbox data is used with the same purpose limits: match threads, sync quote-related replies, and send only on seller action. No ads, no sale of mailbox data.

Why we use the data (legal bases)

For the product: to provide quote follow-up, mailbox matching, activity sync, drafts, and account administration. The usual legal bases are performance of a contract with the customer, and (where required) the user’s consent when connecting a mailbox via OAuth.

For the brand site: to respond to waitlist and demo requests. The legal basis is your consent when you submit the form, together with our legitimate interest in answering people who asked about Sallra.

We may also process data where required by law.

Where data is hosted and who we share it with

Sallra AB is based in Sweden. The brand site and product application are hosted with Vercel in the EU (Stockholm region). Database processing for the product is in Stockholm, under EU law.

We share data only with subprocessors needed to run the service, or when required by law, or on the customer’s instruction (for example their IT admin). We do not sell personal data.

Current subprocessors and related providers:

• Vercel: hosts sallra.com and app.sallra.com (EU / Stockholm).
• Berget AI: EU-based drafting for follow-up suggestions the seller can edit.
• Slack: carries waitlist and demo form notices to our team (brand site only).
• Google and Microsoft: as the mailbox providers the seller connects via OAuth (access to the user’s mailbox APIs, not a sale of data to them).

Retention, disconnect, and deletion

Mailbox disconnect: the seller can disconnect the mailbox in settings. OAuth tokens are removed immediately. Synced mailbox content for that connection is deleted promptly. Quote metadata and PDFs the seller entered in Sallra are not automatically wiped by disconnect alone; they remain until account or company deletion.

Account or company deletion: account, membership, quotes, PDFs, and any remaining mail copies are deleted promptly (without undue delay).

Brand-site forms: we keep waitlist and demo details for up to 12 months from submission, or until you ask us to remove them, whichever comes first. We do not keep a separate waitlist or demo database on the marketing website beyond the notice sent to our team.

Security

We use access controls and encryption in transit. OAuth refresh and access tokens are stored server-side and encrypted at rest. Product data is encrypted at rest. We do not publish low-level key management details here.

International transfers

We aim to keep hosting and primary processing in the EU/EEA. If a supporting service processes data outside the EU/EEA, we use appropriate safeguards (such as Standard Contractual Clauses) as required by GDPR. Our privacy and security pages describe the EU-first approach; ask support@sallra.se if you need transfer details for a specific provider.

Your rights

Under the GDPR you can ask us for a copy of your data, correction, erasure, restriction, objection, or portability where applicable. Email support@sallra.se. If you are not satisfied, you can complain to the Swedish Authority for Privacy Protection (IMY).

Cookies

The brand site (sallra.com) sets no tracking cookies and uses no third-party analytics. Hosting may process limited technical data to deliver and secure the site.

The product app (app.sallra.com) uses cookies or similar storage needed for authentication and session security. We do not use them for advertising.

Changes to this policy

If we change how we handle your data, we will update this page and the date above.