Privacy Policy

Vigo workspace (go.vigo.nu) · Effective 24 October 2026

Vigo is a service operated by KVL-TECH AB (“Vigo”, “we”, “us”), Sweden. This policy explains what data we handle when you use the Vigo workspace at go.vigo.nu — in particular the Google account data we access when you choose to deploy your generated app to your own Google Cloud. Questions or requests: info@kvl-tech.se.

What Vigo does

Vigo turns a short business description into a branded mobile/web app. When you choose the “Google Cloud” deployment option, Vigo provisions the app’s backend inside your own Google account (Google Cloud, Firebase Hosting, an Apps Script project and a Google Sheet used as the app’s database), on your behalf and at your explicit request.

Google user data we access, and why

To perform that setup we request the following Google OAuth scopes. We request the minimum needed and use each scope only for the purpose below:

• cloud-platform — create and configure the resources and enable the APIs required to host your app in your Google Cloud project.
• firebase — set up Firebase Hosting to serve your app’s web version.
• script.projects and script.deployments — create and deploy the Apps Script backend that runs your app’s API.
• drive.file — create and manage only the specific files Vigo creates: the Google Sheet that stores your app’s catalog, orders and settings, the Apps Script project and related assets. This is per-file access; Vigo cannot see or touch your other Drive files.
• openid, email — identify you and display your account email in the workspace.

How we use the data

We use Google account access solely to provision, configure and maintain your app’s backend in your own Google account at your request. We do not use Google user data for advertising, and we do not use it to train machine-learning or AI models. We access only what is necessary to perform the actions you initiate.

Limited Use disclosure

Vigo’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Storage & security (data protection)

To carry out provisioning and ongoing maintenance on your behalf, we store your Google OAuth refresh token. We do not store the contents of your Google Sheets, Drive files or any other Google account data; we keep only the identifiers of the resources Vigo created for you (for example the IDs of the Google Cloud project, the Sheet and the Apps Script project) so we can maintain them at your request.

• Encryption of credentials: the refresh token is encrypted before it is stored, using AES-256-GCM. The encryption key is held in the server environment, separately from the database, and is never written to the database or to logs.
• Encryption in transit: all connections to Vigo and to Google APIs use HTTPS (TLS).
• Access control: stored credentials are accessible only to the Vigo service itself and to a small number of authorised KVL-TECH AB administrators. Server access requires SSH key authentication; password login is disabled.
• No tokens in logs: OAuth tokens are not written to application logs.
• Data minimisation: we request only the Google scopes listed above and use them only for the actions you start.
• Location: our servers are hosted with Amazon Web Services in the EU (Stockholm).

AI services

Vigo uses AI models to generate your app’s specification and content, to run and analyse the interview on vigo.nu, and to answer questions in Vigo Colab. These models receive only text, web page addresses and files that you provide inside Vigo (for example your business description, interview answers or menu).

• Where it runs: Claude models (Anthropic) on Amazon Web Services (Amazon Bedrock) using an EU inference profile, so requests are processed inside the EU (Stockholm and other EU regions). Amazon Web Services acts as our processor; the model provider does not receive your content. AWS may retain inputs and outputs for abuse prevention as described in its terms.
• Images: images for catalogue items are generated from short text descriptions of the items with Stability AI models on Amazon Bedrock in the US (Oregon). Do not put personal data in item descriptions.
• Your own AI key: if you choose to use your own API key (Anthropic, OpenAI or xAI), your content is sent to that provider under your own agreement with them.
• Vigo does not use your content to train AI models, and we do not send it to other AI providers.

Google user data — the contents of your Google Sheets or Drive files, and any other data obtained through Google APIs — is never sent to any AI model or AI service, and is never used to develop, improve or train AI or machine-learning models.

Sharing

We do not sell your data and do not share Google user data with third parties, except with infrastructure sub-processors strictly necessary to run the service, and where required by law. Any resources Vigo creates live in your Google account, which you control.

Retention, revocation & deletion

You can revoke Vigo’s access to your Google account at any time at myaccount.google.com/permissions. If you revoke access there, the stored token stops working. When you delete a project in Vigo we revoke Vigo’s access at Google, remove the Google resources Vigo created for that project and permanently delete the stored refresh token. We keep the token only for as long as the project exists. Other account data is kept while your account is active and deleted on request, except records we must keep by law. To request deletion of your account data, email info@kvl-tech.se and we will action it promptly.

Who is responsible

The controller of the personal data described in this policy is KVL-TECH AB (org. no. 559304-6195), Luleå, Sweden, contact info@kvl-tech.se. Where you use Vigo to run an app for your own customers, you are the controller of your customers’ data and we process it on your behalf; contact us if you need a data processing agreement.

Why we process data (legal bases)

• Contract (GDPR Art. 6(1)(b)) — to create your account, generate and provision your app and operate the service you asked for.
• Consent (Art. 6(1)(a)) — for the optional marketing interview on vigo.nu and for optional emails. You can withdraw consent at any time.
• Legitimate interests (Art. 6(1)(f)) — keeping the service secure, preventing abuse and fixing errors.
• Legal obligation (Art. 6(1)(c)) — for example Swedish accounting law, which requires us to keep payment and invoice records for seven years.

International transfers

Account data, interviews and AI processing of text run in the EU (see “AI services”). Images for catalogue items are generated in the US (Amazon Web Services, Oregon); that transfer is covered by the EU Standard Contractual Clauses that form part of the AWS Service Terms and Data Processing Addendum. Data stored in your own Google account stays under Google’s terms and your control.

Your rights

Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent. Email info@kvl-tech.se and we will reply within one month. If you believe we handle your data unlawfully you may lodge a complaint with the Swedish Authority for Privacy Protection (IMY, imy.se) or with the supervisory authority in your country.

Other data

The workspace also stores basic account information (your email and workspace balance) and the app specifications you generate, so we can operate the service. This is separate from the Google account access described above.

Changes

We may update this policy; material changes will be reflected here with a new effective date.

Contact

KVL-TECH AB (org. no. 559304-6195), Luleå, Sweden · info@kvl-tech.se