Privacy Policy
- Last updated
- 1 November 2026
- Company
- Tavan Insights AB, 559547-1862
- Data storage
- Sweden (Microsoft Azure, Sweden Central)
- Contact
- business@navainsights.io
- Published at
- beclair.io/privacy
This Privacy Policy explains how Tavan Insights AB, reg. no. 559547-1862, c/o JRS Asset Management AB, Box 586, 114 11 Stockholm, Sweden ("Clair", "we", "us") processes personal data in connection with Clair and related services (the "Services").
It applies to our customers and the people who use the Services, to visitors to our website, and to people who contact us in a business capacity. People who talk with Clair are covered by the separate Participant Privacy Notice (call.beclair.io/participant-privacy) and by the privacy notice of the company that contacted them.
1. Our roles
- Our customers are controllers for the personal data they process in the Services, including data about their own customers and conversation data.
- We are the processor for that data. We process it only on the customer's instructions and under a data processing agreement (DPA).
- We are controller for the limited data we process for our own purposes: user accounts, billing, customer support, marketing, usage analytics, security and legal compliance.
- Where a customer's DPA covers user account data, we process it as processor.
2. Personal data we process as controller
- Users of the Services: name, email address, organization, role and access rights, login data, usage of the Services and support communication.
- Billing: billing contact details and invoices. Card payments are handled by Stripe, and we never see or store card details.
- Website visitors and business contacts: contact details you give us, our communication with you, and technical data about website use.
- Usage analytics, only with consent: usage events, device data and session replays with all text masked, from the website, the Services and the pages people use to talk with Clair. We use them to understand how people move through the pages and to find technical faults. Our customers do not decide this and have no access to the data.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the Services, managing accounts and access, and customer support | Contract (Article 6(1)(b) GDPR) where you are our customer; otherwise legitimate interests (Article 6(1)(f) GDPR) in providing the Services under our contract with your organization |
| Billing and bookkeeping | Legal obligation (Article 6(1)(c) GDPR) |
| Security, fraud prevention and improving the Services | Legitimate interests (Article 6(1)(f) GDPR) |
| Marketing to business contacts | Legitimate interests, and consent where the law requires it |
| Optional analytics and marketing cookies | Consent (Article 6(1)(a) GDPR) |
4. Data we process for customers
Our customers use Clair to reach the people at their own business customers, never consumers, with an AI assistant that speaks in the customer's name: for example to help them get started with something they have bought, to hear how things are going, or to follow up at the right time. Clair talks with them by voice or text, in a browser through a personal link or by phone, and reaches them by email, SMS or a call.
On the customer's behalf we process the contact details and account data the customer chooses to use, from its CRM or a file it uploads; conversation recordings and transcripts; summaries, quotes and outcomes, such as what was done, what the person asked for and what Clair heard about value, risks and opportunities; follow-ups for the customer's team; requests not to be contacted; and technical data. If the customer connects its CRM, we write the outcome of a conversation back to it. The customer decides who is contacted, why, through which channels and how often, and informs them in its own privacy notice.
Every conversation starts by saying that the person is speaking with an AI on behalf of our customer, and the person is told that a voice conversation is recorded. The person can ask for a person, end the conversation or ask not to be contacted again at any time.
Each conversation stays connected to the person's name, email address and phone number, so that the customer can see who it was with. Names and other direct identifiers are removed from the transcript text automatically before it is stored and analyzed. Conversation data is never used to train AI models, by us or by our sub-processors. Voice recordings are not used to identify people or to recognize emotions, and no decisions with legal or similarly significant effects are made about people by automated means alone.
5. How long we keep personal data
| Data | Retention |
|---|---|
| Conversation recordings and transcripts | Deleted no later than 90 days after the conversation, unless the customer's DPA sets another period |
| Summaries, quotes, outcomes and follow-ups | 12 months after the last conversation with the person, unless the customer's DPA sets another period |
| Contact details and account data | As long as the customer keeps them in Clair, and no longer than the end of its agreement |
| Requests not to be contacted | As long as the customer uses Clair |
| Reports and other anonymized results | As long as the customer account is active, or until the customer deletes them |
| User account data | The customer relationship plus 30 days |
| Billing and bookkeeping records | Seven years after the end of the financial year, under the Swedish Bookkeeping Act (bokföringslagen (1999:1078)) |
| Usage analytics | 12 months |
| Technical logs | 30 days |
| Backups | Overwritten within 35 days |
If an account on our standard terms is inactive for 12 months, we may notify the account holder and delete or anonymize its data if there is no response within 30 days. For customers with a signed agreement, the agreement decides.
6. Sub-processors
We use a small number of sub-processors to provide the Services: hosting, AI voice and language processing, sign-in, monitoring, and SMS and phone calls. Each is bound by a data processing agreement with obligations at least as protective as ours.
The current list, with where each sub-processor runs and the transfer safeguard, is in your DPA and available on request. Customers are notified at least 30 days before we add or replace a sub-processor. A customer's own systems, such as its CRM, are not sub-processors.
For our own purposes as controller we also use Stripe (card payments), HubSpot (customer relationship management) and PostHog (usage analytics, hosted in the EU).
7. Transfers outside the EU and EEA
Personal data is stored in Sweden. Sign-in data, technical logs and analytics are stored in the EU. Some AI processing and the connection of phone calls take place outside the EU and EEA, mainly in the United States, under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. The AI providers keep copies for at most 30 days, unless the law requires longer storage.
8. Security
- Hosting on Microsoft Azure in Sweden, in data centers certified to ISO/IEC 27001 and covered by SOC 2 reports
- Encryption in transit (TLS 1.2 or higher) and at rest (AES-256)
- A web application firewall, and databases without public network access
- Role-based access control, separation between customers, and least-privilege access for our staff
- Logging and monitoring, and a documented incident response process
9. Your rights
You have the right to access, rectify and erase your personal data, to restrict or object to processing, to data portability, and to withdraw consent at any time. Contact business@navainsights.io and we answer within one month. Where we process your data on behalf of a customer, we forward your request to that customer.
You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se) or to the data protection authority where you live or work.
10. Cookies
We use necessary cookies to run the website and the Services. Analytics (PostHog), including session replays with all text and form inputs masked, and marketing cookies are used only if you accept them. You can change your choice at any time under Cookie settings. If someone who talks with Clair chooses to have their agreement remembered, a cookie saves it in that browser, for that conversation, for 30 days. We never send conversation content, transcripts or reports to analytics providers.
11. Changes to this policy
We update this policy when our processing changes. We inform customers of material changes through the Services or by email before they take effect.
12. Contact
Tavan Insights AB, c/o JRS Asset Management AB, Box 586, 114 11 Stockholm, Sweden. Email: business@navainsights.io.