Privacy Policy for Fibbler

Last Updated: 17 June 2026

Information about us

“Fibbler”, “we”, “our” or “us” refers to Fibbler AB. We are committed to protecting and respecting your privacy. This “Privacy Policy” sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. By visiting our website at fibbler.co you are accepting and consenting to the terms in this Privacy Policy. For the purpose of the General Data Protection Regulation (EU 2016/679), the “Data Controller” is Fibbler AB, Teknikvägen 21C, 246 43 Löddeköpinge, Sweden, registered with the Swedish Companies Registration Office (Reg. No. 559476-3491). If you have any questions or if you want to exercise any of your rights, you are most welcome to contact us at: legal@fibbler.co.

Data controller

Fibbler AB, Reg. No. 559476-3491, having its registered address at Teknikvägen 21C, 246 43 Löddeköpinge, Sweden, is the data controller for the processing of personal data in accordance with this information.

Processing of your personal data

In the table below, you can find information about our processing of your personal data. We describe the purpose of the processing, i.e., why we process your personal data. For each purpose, we also specify which categories of personal data we may process to achieve the purpose, the legal basis for the processing, and for how long we will process the data.

Purpose	Categories of personal data	Legal basis	Deletion period
To provide services that you as a customer have requested.	Contact information, such as name, email address, and delivery address. Billing information. Information about your purchase. Login information to our website.	Fulfilment of the agreement with you or the company/organisation you represent.	During the warranty period and the following 12 months.
To be able to administer our contractual relationship with you or the company/organisation you represent regarding services and/or products you provide us.	Contact information, such as name, email address, and delivery address. Billing information. Information about your services and/or products we have bought or are considering buying.	Fulfilment of the agreement with you or the company/organisation you represent.	During the time we have an active business relationship with you and 12 months after the last purchase.
To comply with applicable legislation, such as accounting legislation.	Billing information. Information regarding your purchase.	Legal obligation.	Seven years.
For handling any potential warranty or complaint issues.	Contact information, such as name, email address, and delivery address. Information regarding your purchase.	Fulfilment of the agreement with you or the company/organisation you represent.	During the warranty period and the following 12 months.
To safeguard and protect the legal interests of the Company.	Contact information, such as name and email address. Correspondence. Information regarding your purchase. Name, social security number, address, contact details, photograph, professional title, current and former place of work, CV and other application documents, information on health status (if you provide such information) and certificates, grades, marks, testimonials and the like.	The Company bases such processing of your personal data on the legitimate interest of the company to protect and assert its rights in the event of a dispute.	The personal data will be processed until the legal dispute is completed.
To be able to market our services and/or products as well as our business through channels such as mailings, website, special offers, and social media.	Contact information such as name, email address, and delivery address. Information about your purchase. Information about your device, such as IP address, when you visit our website. Social media username.	For such processing of your personal data, we use the legal basis of legitimate interest, where our legitimate interest is to be able to market our services/products and our business.	12 months after your latest purchase.
To measure LinkedIn and Google ad effectiveness, identify visiting companies at company level, and analyse website visits and attribution on fibbler.co. No tracking cookies are used on app.fibbler.co.	IP address, page views, browsing data, company-level identification data, and cookie or persistent visitor IDs only after consent. Before consent, only aggregated pageviews without persistent identifiers.	Consent. No tracking takes place before consent via the cookie banner. You may also withdraw your consent at any time by changing your settings.	While consent applies. For more information about the cookies we use, please see our Cookie Policy.
To be able to provide customer service.	Contact information such as name, email address, and delivery address. Information about your purchase.	Fulfilment of the agreement with you or the company/organisation you represent.	During the time we have an active business relationship with you.
To enable general customer and supplier care (quality work, statistics, market and customer/supplier analysis, as well as business, method, and product development).	Contact information such as name, email address, and delivery address. Information about your purchase.	For such processing of your personal data, we use the legal basis of legitimate interest, where our legitimate interest is to be able to develop our business.	During the time we have an active business relationship with you and for five years thereafter.
To be able to administer and implement an efficient recruitment process and to recruit new staff after recruitment has been completed.	Name, social security number, address, contact details, photograph, professional title, current and former place of work, CV and other application documents, information on health status (if you provide such information) and certificates, grades, marks, testimonials and the like.	The processing is based on a balance of interests as a legal basis, where the Company’s legitimate interest is to be able to evaluate your merits and personal qualities in connection with recruitment decisions.	Until the recruitment process is finalised and the position is filled and for two years thereafter. If you consent, we may keep your application documents for future recruitments.
To provide MCP functionality to eligible customers, allowing them to query their own attribution and analytics data in natural language through supported LLM tools.	Fibbler API key, stored CRM data, stored advertising data, customer account attribution and analytics data.	Fulfilment of the agreement with you or the company/organisation you represent.	For as long as the customer uses MCP and for as long as the underlying customer data is stored by Fibbler in accordance with this policy and the applicable agreement.
To log API key usage for rate limiting and security purposes in connection with MCP use.	API key usage log data, including the tool called, response time, and success/failure status. No query content or response data is logged.	Legitimate interest, where our legitimate interest is to ensure the security, availability, and proper use of the MCP service.	For as long as necessary for rate limiting and security purposes, and no longer than required under the Company’s retention practices.

To whom may we transfer your personal data?

Only those individuals at the Company who need access to your personal data in order to perform their job duties will have access to the personal data.

All customer and application data is hosted in the EU on Google Cloud infrastructure. Website analytics and marketing email data may however be processed by providers outside the EU/EEA under appropriate safeguards (Standard Contractual Clauses or EU-US Data Privacy Framework). You can read more about which countries are considered to offer an adequate level of data protection on the European Commission’s website here. You can find more information regarding the standard contractual clauses here. We conduct a risk assessment before any transfer takes place, and we implement technical and organisational protection measures to ensure an appropriate level of protection. We transfer as little personal data as possible and anonymise the personal data before the transfer, whenever possible. For more information on which protection measures we take in individual cases, please contact us.

To provide certain services, we use selected third parties. The sharing of your personal data with third parties is based on the same purposes and legal bases as they were collected for. The Company takes technical and organisational measures to ensure that your personal data is handled in a safe and secure manner. Below are the categories of recipients with whom your personal data may be shared:

Suppliers and subcontractors: We use third-party suppliers to manage parts of our business, such as companies that deliver technical support, management of IT systems and marketing services. We may share personal data with these suppliers when they perform services on our behalf. When we use such suppliers, we enter into a data processing agreement and take other appropriate measures to ensure that your personal data is processed securely. We do not sell or share your data with third parties for their own purposes. Customer and application data is processed exclusively within the EEA, unless otherwise stated below. For a detailed list of our current sub-processors, please visit fibbler.co/security.

Other companies that we collaborate with: We also share your personal data with other independent data controllers, such as banks. These recipients are independent data controllers for their processing of your personal data.

We may transfer your personal data to a buyer/investor or potential buyer/investor in connection with a restructuring, sale or other transfer of all or part of the Company’s shares, assets or our business. Before such transfer, we will take measures to ensure that the receiving party processes your personal data in a manner consistent with the information provided in this Privacy Policy.

Social media:We use social media. When using social media, your personal data is collected and processed by each respective social media company. Kindly see each company’s privacy policy for more information regarding the processing related to the use of their social media.

Courts, authorities, and other public bodies:We will disclose your personal data if required to do so by law, government decision or court order, or if we, as a company, reasonably believe that the disclosure is necessary to protect the Company’s rights.

How do we protect your personal data?

To protect your privacy, detect, prevent, and mitigate the risk of attacks, etc., we take a variety of technical and organisational information security measures. We also take measures to protect your personal data from unauthorised access, misuse, disclosure, alteration, and destruction. Furthermore, we ensure that access to your personal data is only given to personnel who need it to perform their duties and that they observe confidentiality.

Your rights

You are entitled to receive information regarding our processing of your personal data. Below is a summary of the rights that you can exercise by contacting us.

Right to access

You have the right to request information about the processing of your personal data, free of charge. You also have the right to receive a copy of the personal data we process about you. We kindly ask that such requests are made to us in writing, with a clarification of which information you wish to access. We will respond to your request as soon as we can. If we cannot meet your request for access to the information you are requesting, we will provide a justification for this. The copy of your personal data will be sent to your registered address, unless otherwise agreed with you in writing.

Right to rectification

The main responsibility for ensuring that the personal data we process is correct lies with the Company as the data controller. If you inform us that the personal data you have provided is no longer correct, we will promptly correct, block, or delete such personal data.

Right to erasure

You have the right to request that the Company deletes your personal data without undue delay. Personal data shall be deleted in the following cases:

If the personal data is no longer necessary for the purpose for which it was collected,
If you have withdrawn your consent and the processing is based solely on consent as a legal basis,
If the processing is for direct marketing purposes and you object to the processing of your personal data for this purpose,
If you object to the processing of your personal data based on a legitimate interest and your interest outweighs ours,
If your personal data has not been processed in accordance with applicable data protection legislation, or
If deletion is required to comply with a legal obligation.

There may be obligations that prevent us from immediately deleting all of your personal data. These obligations are imposed by applicable legislation, such as accounting regulations. If certain personal data cannot be deleted due to legislation, we will inform you of this and ensure that the personal data can only be used for the purpose of fulfilling such obligations and not for any other purposes.

Right to restriction

You have the right to request that the Company temporarily restrict the processing of your personal data. Such a restriction may be requested in the following cases:

If you believe that the personal data we have about you is not correct and have requested correction in connection with this,
When the processing carried out regarding your personal data is not in compliance with applicable data protection legislation, but you still do not want your personal data to be deleted but instead restricted, and
When we no longer need your personal data for the purposes of our processing but we need it to establish, assert or defend a legal claim.

If you object to the processing of your personal data, the use of the personal data may be restricted while an investigation is being conducted. When restricting your personal data, the Company will only store your personal data and will seek your consent for any further processing.

Right to data portability

You have the right to request that, in the event we process your personal data with your consent or to fulfil a contractual obligation with you, we provide all personal data that we process regarding you and that is processed in an automated manner, in a machine-readable format. This can, for example, be an Excel file or a CSV file. If technically possible, you also have the right to request that we transfer your personal data to another data controller.

Right to object

You have the right to object to our processing of your personal data if the processing is based on our legitimate interest. In these cases, the Company will ask you to specify which processing you object to. If you object to any processing, we will only continue processing your personal data if we have legitimate interests that outweigh your interests. We will always inform you of this.

Right to withdraw consent

If we process your personal data based on your consent, you have the right to withdraw your consent at any time. To withdraw your consent, you can contact us using the contact information below.

Right to submit a complaint

If you have a complaint regarding the Company’s processing of personal data, you can contact us at legal@fibbler.co, or the supervisory authority in the member state where you have your place of residence or where the alleged breach has occured to file a complaint. The current supervisory authority in Sweden is the Swedish Authority for Privacy Protection. Their contact details are as follows:

Webpage: https://www.imy.se/en/
Phone: +46 (0)8-657 61 00
Email: imy@imy.se

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The latest version will always be available on our website. We will notify you by email when significant changes are made. Continued use of the service after changes take effect constitutes acceptance of the changes.

Contact information

For any privacy-related inquiries or concerns, please contact us at legal@fibbler.co.