Bmetrix Sweden AB is a Swedish company, so everything we do falls under the EU General Data Protection Regulation (GDPR). This page explains, in plain English, what rights you have and how to use them.
1. Who is the controller?
Bmetrix Sweden AB is the data controller for personal data processed in the Service. Contact: andreas.waleij@bossmetric.com.
2. Your rights
- Access - get a copy of the personal data we hold about you.
- Rectification - correct data that is wrong or incomplete.
- Erasure ("right to be forgotten") - delete your account and associated data.
- Portability - receive your project data in a machine-readable format.
- Restriction - ask us to pause processing while a dispute is resolved.
- Objection - object to processing based on legitimate interest.
- Withdraw consent - where processing is based on consent, you can withdraw it at any time.
- Complain - lodge a complaint with the Swedish IMY (imy.se) or your local EU supervisory authority.
3. How to exercise them
Delete your account (self-service)
Open the app → Settings → Delete account. This removes your profile, projects, calendar slots, drafts, checklists, and Steam assets from our database. Backups roll off within 30 days.
Export your data
Email us and we will send a JSON export of your account within 30 days. We are also happy to walk through the data structure with you.
Everything else
Email andreas.waleij@bossmetric.com with the subject line "GDPR request" and describe what you want. We respond within 30 days (extendable to 60 for complex requests, in line with Art. 12(3) GDPR). There is no charge unless a request is manifestly unfounded or excessive.
4. What we process and why
See the Privacy Policy for the full breakdown of data categories, legal bases, and subprocessors.
5. Automated decision-making
The Momentum Score and checklist statuses are computed automatically from the data you enter. They are informational only - they do not produce legal effects or significantly affect you in the sense of GDPR Art. 22, and they can always be overridden by you.
6. AI processing
When you use AI features, prompts are sent to Google (Gemini) via the Lovable AI Gateway. We do not use your prompts to train models. Do not paste personal data about other people into AI prompts.
7. International transfers
Where a subprocessor operates outside the EEA, transfers rely on the EU Standard Contractual Clauses and any supplementary safeguards published by that provider.
8. Data breach
In the unlikely event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the supervisory authority within 72 hours and inform affected users without undue delay, as required by Art. 33 and 34 GDPR.