Privacy Policy

This Privacy Policy explains how SitePoint Systems ApS ("Freyja", "we", "us") collects, uses, shares and protects personal data when you visit heyfreyja.com, use the Freyja chat agent embedded on a customer's website, or use our configuration console at app.heyfreyja.com.

1. Who we are

SitePoint Systems ApS is the data controller for this website and for the Freyja product offering. For chat conversations that take place inside a customer's deployment, our customer (the website operator who embeds Freyja) is typically the controller and we act as a processor on their behalf, under a data processing agreement.

Contact: privacy@heyfreyja.com

2. Data we collect

• Conversation data — messages you send to the chat agent, and replies, including any information you choose to provide (such as name or email).
• Context metadata — page URL, referrer, an anonymous visitor identifier, locale, device/browser information and timestamps.
• Account data (console users) — name, email, organisation and authentication details.
• Technical logs — IP address and request logs used for security, debugging and abuse prevention.

3. How we use data

• To operate the chat agent: understand your message, generate a relevant reply, and maintain conversation context.
• To route conversations to a human agent when needed and deliver their replies back to you.
• To improve answer quality and our knowledge base (for example, summarising closed conversations into help articles).
• To provide, secure and support the configuration console.
• To comply with legal obligations.

4. Legal bases (GDPR)

Where the GDPR applies, we rely on: performance of a contract (providing the service you request), legitimate interests (securing and improving the service), consent (where required, e.g. optional communications), and legal obligation.

5. AI processing

Replies are generated using large language models accessed through OpenRouter and the underlying model providers. Conversation content is sent to these providers solely to generate a response. We do not sell your data, and we do not use your conversations to train third-party foundation models beyond what is necessary to produce a reply.

6. Service providers & sub-processors

We share data only with providers that help us run the service, including:

• OpenRouter and model providers — generating AI responses.
• Missive — human hand-off and team inbox.
• Managed infrastructure for conversation state and search (e.g. Redis, Elasticsearch) and transactional email delivery.

Each sub-processor is bound by appropriate data protection terms.

7. Data retention

Live conversation state is short-lived (typically expiring within 24 hours). Transcripts and knowledge content are retained for as long as needed to provide the service or as instructed by the relevant controller, then deleted or anonymised. Console account data is retained for the life of the account.

8. Cookies & local storage

The chat widget uses minimal local storage (for example, an anonymous visitor identifier and session continuity). The marketing website uses only strictly necessary storage. We do not use third-party advertising trackers.

9. International transfers

Some providers may process data outside the EU/EEA. Where this happens, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

10. Your rights

Subject to applicable law, you may have the right to access, correct, delete, restrict or object to processing of your personal data, and to data portability. To exercise these rights, contact privacy@heyfreyja.com. For chat data held on behalf of a website operator, please contact that operator; we will assist them as their processor. You may also lodge a complaint with your supervisory authority (in Denmark, the Datatilsynet).

11. Security

We use industry-standard measures including encryption in transit, access controls and tenant isolation. No method of transmission or storage is completely secure, but we work to protect your data and to notify of incidents where required.

12. Children

The service is not directed to children under 16, and we do not knowingly collect their data.

13. Changes

We may update this policy from time to time. Material changes will be posted here with a new "last updated" date.

14. Contact

SitePoint Systems ApS — privacy@heyfreyja.com.