Effective Date: October 10, 2026
Effati Consulting AB ("Effati", "we", "us", "our") is a Swedish company based in Stockholm. We are the data controller for the personal data described in this policy: data processed when you visit https://effati.se (the "Website"), use our consulting services, or use a product we build and operate (our "Products"), including Hejobb, TryggMap and Lyra. All our Products handle customer data in the same way, described in section 2, and this policy applies to every current and future Product unless a Product states otherwise.
We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and Swedish data protection law. Questions and requests: info@effati.se.
Which of these categories apply depends on the Product and on what you choose to use. We collect no more than the feature needs.
Every use of personal data rests on a legal basis under GDPR Article 6:
We share personal data only with providers that help us run the Website and Products, under data processing agreements, and only what each task requires:
Beyond this, we disclose personal data only if the law requires it, or in connection with a corporate transaction such as a merger, in which case this policy continues to protect your data and we will notify you of any change of controller.
Storage stays in the EU, and so does AI processing outside the Lyra pilot. Some supporting services involve providers established outside the EU/EEA: sign-in with Google or LinkedIn, email sent and received through Google Workspace, payments through Stripe, which may transfer payment data to the United States, and, during the Lyra pilot, OpenAI and ElevenLabs in the United States. For every such transfer we rely on the safeguards in GDPR Chapter V: adequacy decisions (Article 45), including the EU–U.S. Data Privacy Framework for certified providers, and Standard Contractual Clauses (Article 46) with supplementary measures where needed. Only what the specific task requires is transferred. You can request a copy of the safeguards for a specific transfer at info@effati.se.
Under the GDPR you have the right to:
To exercise any of these rights, email info@effati.se (for Hejobb, you can also use privacy@hejobb.com). We answer within one month and the request is free of charge. If you believe we handle your data unlawfully, you can lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, imy.se) or with the supervisory authority where you live or work in the EU.
All traffic to our Website and Products is encrypted with TLS, stored data is encrypted at rest, sign-in uses OAuth or single-use email links, and session tokens are stored only as cryptographic hashes. No system is perfectly secure; if a breach ever puts your rights at risk, we will notify you and IMY as the GDPR requires.
Our Products are not directed at children under 16 and we do not knowingly collect data from them. If you believe we have, contact us and we will delete it.
Everything above applies to every Product. The notes below add only what is particular to one Product.
Hejobb matches your CV with job openings from Swedish universities and Arbetsförmedlingen. You sign in with Google, LinkedIn or an email link. Your CV is converted to text and read by AI on Vertex AI and Amazon Bedrock in the EU to fill your profile, compute matches and, when you ask, draft cover letters; the original file is deleted as soon as processing finishes. Optional Pro plans are billed by Stripe. Hejobb publishes a detailed privacy policy at hejobb.com/privacy, which takes precedence for Hejobb where it is more specific than this policy. Privacy contact: privacy@hejobb.com.
TryggMap lets you report a place as safe or unsafe, from the app or from iOS lock screen controls, and shows a shared map built from all reports. It has no account. Report data is sent to our server only when you submit a report: the status you chose (safe or unsafe), the time, and, if you have consented in the app and allowed location access in iOS, the precise location and accuracy of your device at that moment. Submitting any report requires your consent in the app; without iOS location access, or when no position is available within five seconds, the report is sent without a location. A random, pseudonymous installation identifier created by the app is sent with reports to limit repeated submissions (at most five per place per 24 hours); it links reports from the same installation to each other, not to you by name.
The app asks for location access only "While Using the App", never "Always", and does not track you in the background; a lock screen control reads the location only at the moment you tap it. Withdraw consent at any time under Location in the app menu, and change the iOS permission in Settings → Privacy & Security → Location Services → TryggMap. Withdrawing consent stops all future location collection and disables reporting until you consent again.
The map shows reports only in aggregated form, as counts per map cell or street segment; it never shows individual reports, their times or identifiers. Viewing the map sends no report or location data to us, only a request for aggregated counts for the visible map area, which carries the technical data described in section 3. Your own position on the map is processed on your device. Reports are kept for as long as TryggMap operates, so the map reflects the history of a place, or until you ask us to delete them; a copy of your own reports stays on your device until you delete the app. To access or delete your reports, email us from About → Contact Effati about privacy in the app and include the report ids shown under Your reports, or the approximate places and times.
Lyra answers questions about Swedish tax and accounting and is currently used by a limited number of pilot participants. It processes the questions you ask, the documents you upload, voice input when you use the microphone, and the business profile you enter, such as an organisation number and VAT period. During the pilot, questions and document text are processed by OpenAI and voice input by ElevenLabs, both in the United States, under data processing agreements and the safeguards in section 6; Lyra will move to the EU providers described in section 2 before it opens to the public. Lyra gives information, not tax advice, and files nothing on your behalf. Pilot participants are also covered by their pilot agreement. Before Lyra opens to the public, this policy will be updated with any details specific to the launched service.
We update this policy when our services or the law change. The date at the top shows the current version. Before a material change takes effect, such as a new category of data or a new AI provider, we will notify you in the Product or by email.
