Privacy Policy

Last updated: 29 October 2026

This policy explains how Molnify AB collects and uses personal data when you visit molnify.com, use app.molnify.com, build applications with the App Builder, or get in touch with us. We have written it to be read, so it says what we actually do.

1. Who we are

Molnify AB (corporate registration number 559085-2025), Surbrunnsgatan 16, 114 27 Stockholm, Sweden, is the controller for the personal data described in this policy. For questions about privacy, or to use any of your rights, email info@molnify.com.

2. When we are not the controller

Organisations build their own applications on Molnify and decide what data those applications collect. For personal data stored in an application, such as answers in a form or records in an app’s database, the organisation that owns the application is the controller and Molnify processes the data on its behalf as a processor, under a data processing agreement. The sub-processors we use for that are listed on our sub-processors page. If you have questions about data in an application, please contact the organisation that provides it. We will help them answer you.

3. What we collect, why, and on what legal basis

Account data: name, email address, profile picture URL and organisation, as provided by your sign-in method (Google, Microsoft, email or your organisation’s single sign-on). Used to create your account, sign you in and control access to applications. Legal basis: contract, GDPR Art. 6(1)(b).
Billing data: company name, VAT number, billing address, contact person, invoices and payment records. Card details are handled by our payment provider and never stored by us. Used to invoice, take payment and keep accounting records. Legal basis: contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c).
Technical and log data: IP address, user ID, timestamps, requests and errors. Used to run the service securely, troubleshoot and prevent abuse. Legal basis: legitimate interest, Art. 6(1)(f).
Usage data: which features and applications you use, how often, and App Builder activity such as model, token usage and build outcome. Used to operate, measure and improve the service. Legal basis: legitimate interest, Art. 6(1)(f).
App Builder conversations: what you write to the App Builder and the applications it builds for you. Used to provide the App Builder, to support you, and to understand how it is used so we can improve it. Legal basis: contract, Art. 6(1)(b), and legitimate interest, Art. 6(1)(f).
Sales and follow-up: your contact details and what you have built or tried in Molnify. Used to follow up personally on how it went, offer help and tell you about relevant Molnify services. Legal basis: legitimate interest, Art. 6(1)(f).
Newsletter: email address, name and whether you open or click our emails. Used to send our newsletter and product news. Legal basis: consent, Art. 6(1)(a), or for existing customers our legitimate interest, Art. 6(1)(f).
Contact form and email: name, email address and your message. Used to answer you. Legal basis: legitimate interest, Art. 6(1)(f).
Cookies and analytics: necessary cookies, and with your consent Google Analytics cookies. Necessary cookies keep you signed in and the service working; analytics help us improve the website. You make your choice in the cookie banner on molnify.com. More detail is in our Cookie Policy. Legal basis: necessary cookies, legitimate interest, Art. 6(1)(f); analytics, consent, Art. 6(1)(a).

Where we rely on legitimate interest, we have weighed our interest against yours and concluded that the processing is expected and limited. You can always object, see section 7.

4. App Builder conversations

The App Builder works through a conversation. We store these conversations so you can continue building, and members of our team may read them to help you when something goes wrong, to improve the App Builder, and to follow up personally on how your build went. We do not use your conversations to train AI models, and neither do our AI providers. You can delete your conversations in the App Builder, and we delete them permanently on request.

5. Who we share data with

We do not sell personal data. We share it only with service providers that process it on our behalf under data processing agreements, and where the law requires it. Where a provider processes data outside the EU, the safeguard is stated next to it.

Google Cloud Platform (Google Ireland Limited): hosting, databases, file storage and backups, in data centres in the EU.
Firebase Authentication (Google): sign-in with Google, Microsoft or email. Not used when you sign in with your organisation’s SAML single sign-on. United States, EU-US Data Privacy Framework.
Email and office tools (Google): our own email and documents. May be processed in the United States, EU-US Data Privacy Framework.
Mailjet (Paris, France): sending service emails.
Brevo (Paris, France): sending our newsletter.
Google Analytics (Google): website analytics, only with your consent. United States, EU-US Data Privacy Framework.
AI providers, only when you use the App Builder or an AI feature, for example Google Gemini (EU), Lyceum running GLM and Kimi models (EU) and Anthropic Claude (outside the EU, Standard Contractual Clauses). If you choose only EU-hosted models, your prompts stay in the EU. The current list of models and where they run is on our pricing page.
Anthropic (Claude): AI assistant our team uses in its own work, for example to help answer support questions and to review App Builder conversations. Outside the EU, Standard Contractual Clauses, on terms that do not allow the data to be used for training.
Stripe (Stripe Payments Europe, Dublin, Ireland): card payments. Card details are handled by Stripe and never stored by us. May be processed in the United States, EU-US Data Privacy Framework.
Accounting: our accounting system and auditor, for bookkeeping we are required to keep.

Other providers process data in the EU.

6. How long we keep it

Account data: while your account is active. When you ask us to close your account, we delete it within one month.
Billing records: until the end of the seventh year after the end of the calendar year in which the financial year ended, as required by the Swedish Bookkeeping Act.
Application and security logs: 30 days. Audit logs of administrative actions on our infrastructure: 400 days.
Backups: overwritten within 30 days.
Usage data: Google Analytics data is deleted automatically after 14 months.
App Builder conversations: until you or we delete them.
Newsletter: until you unsubscribe.
Contact form messages and email: as long as needed to handle your question and any customer relationship that follows. We delete them on request.

7. Your rights

You have the right to:

get a copy of the personal data we hold about you
have incorrect data corrected
have your data deleted, unless we must keep it by law
restrict our processing while a question is being resolved
object to processing based on legitimate interest, and always to direct marketing
receive data you gave us in a machine-readable format
withdraw your consent at any time, without affecting earlier processing

Email info@molnify.com and we will respond within one month. Every newsletter has an unsubscribe link.

If you think we handle your data wrongly, please tell us first. You also have the right to complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se) or to the supervisory authority where you live or work.

8. Security

We protect personal data with encryption in transit and at rest, individual accounts with two-factor authentication for our staff, least-privilege access, audit logging and regular vulnerability scanning. More detail is in our security documentation, available on request. To report a suspected vulnerability, email security@molnify.com.

9. Changes

We update this policy when our processing changes. The date at the top shows the latest version. If a change matters to you, we tell you by email or in the service.