Last updated: October 10, 2026

Privacy Policy

This policy explains how Barrion AB ("Barrion" or "we") processes personal data about you when you visit our website, contact us, work for a customer, supplier or prospective customer, use our platform or apply for a job with us. We only process the data we need, and we never sell personal data.

This is the English version of our Swedish privacy policy (Integritetspolicy), version 1.1. If the two differ, the Swedish version prevails.

1. Controller and contact

Barrion AB, organisation number 559569-0917, Stampgatan 62, 411 01 Göteborg, Sweden, is the controller. Send questions about data protection to legal@barrion.io.

2. When this policy applies

This policy applies when we decide why and how personal data is processed. It does not apply when we process personal data on behalf of a customer in our service, for example data that appears in the customer's systems during a test. The customer is then the controller and we act as its processor under our Data Processing Agreement (DPA). Please direct questions about that data to the customer.

3. What data we process and why

For each situation below you can see what data we process, why, on which legal basis and for how long we keep it.

Visiting the website

  • Data. IP address, device and browser details, and data from cookies.

  • Purpose and legal basis. Running and securing the website (legitimate interest). Statistics and marketing only with your consent.

  • Retention. As set in your cookie settings, and otherwise for as long as the data is needed to run and secure the website.

Advertising and retargeting

  • Data. A pseudonymous advertising identifier and the pages you viewed, collected by advertising pixels (LinkedIn, Reddit and X, with Meta prepared but not active) only if you accept the advertisement cookies.

  • Purpose and legal basis. Measuring conversions from our ads and showing relevant ads to people who have visited the site, shared with those advertising networks (consent). You can withdraw consent at any time in the cookie settings.

  • Retention. As set in your cookie settings. The networks keep the data under their own policies. See the Cookie Policy for the cookies and their lifetimes.

Contact and enquiries

  • Data. Name, email, phone, company, role and your message.

  • Purpose and legal basis. Answering and following up your enquiry (legitimate interest).

  • Retention. For as long as needed to answer and follow up the enquiry.

Prospective customers

  • Data. Name, role, work email, phone, company and professional network profile.

  • Purpose and legal basis. Marketing and sales contact with businesses (legitimate interest). You can always object.

  • Retention. No more than 24 months after our last contact with you, or until you object.

Customers and suppliers

  • Data. Contact persons' names, roles and contact details, and contract and billing details.

  • Purpose and legal basis. Entering into and performing contracts, invoicing and managing the relationship (legitimate interest). Bookkeeping (legal obligation).

  • Retention. For the term of the contract and then for as long as needed to manage the relationship and any claims. Accounting records for seven years under the Swedish Bookkeeping Act.

User accounts in the platform

  • Data. Name, email, role, your user ID at Google or Microsoft if you sign in with them, and sign-in and security logs.

  • Purpose and legal basis. Managing accounts, giving support and protecting the platform (legitimate interest).

  • Retention. For as long as the account exists, and then for as long as needed for security and follow-up.

Platform usage statistics

  • Data. How you use the platform, such as page views and clicks, linked to your account. The statistics are designed not to collect content from test results, and any such content that is captured is deleted.

  • Purpose and legal basis. Improving and troubleshooting the platform (legitimate interest). Cookies for the statistics are only used with your consent.

  • Retention. For as long as needed to improve and troubleshoot the platform, and no longer than the account exists.

Email from the platform

  • Data. Recipient, subject and delivery status of email the platform sends, such as invitations, verification and notifications.

  • Purpose and legal basis. Delivering email and troubleshooting sending (legitimate interest).

  • Retention. No more than 30 days.

Job applicants

  • Data. Contact details, CV, cover letter and interview notes.

  • Purpose and legal basis. Recruitment (legitimate interest).

  • Retention. Until the recruitment is finished and for the time needed to handle any claims. Longer only with your consent.

Legal claims

  • Data. The data needed in the specific case.

  • Purpose and legal basis. Establishing, exercising or defending legal claims (legitimate interest).

  • Retention. For as long as the claim can be brought.

If we need data to enter into or perform a contract, we cannot do so without it. Otherwise, providing data is voluntary.

4. Where the data comes from

We get the data from you, from your employer or from public sources such as company websites and professional networks. For prospective customers, the data can also come from providers of business data.

5. Who we share the data with

We never sell personal data. We only share it with these recipients.

  • Processors that help us with IT operations, sign-in, email, statistics, error monitoring, customer records, e-signing, accounting and payments, such as Google Cloud, Firebase (Google), Cloudflare, Mailgun, PostHog and Sentry. PostHog processes the platform usage statistics in the EU. Processors may only use the data on our behalf. You can ask us for a current list.

  • Advisers such as auditors and lawyers, who are bound by confidentiality.

  • Authorities, when the law requires it.

  • A buyer or a new company, if our business is transferred or reorganised.

6. Transfers outside the EU/EEA

Some of our providers may process data outside the EU/EEA. When they do, we use a valid basis under the GDPR, such as an adequacy decision by the European Commission (for example the EU-US Data Privacy Framework) or the EU standard contractual clauses. You can ask us which basis is used. Sign-in with Google or Microsoft runs through Firebase Authentication, where Google LLC processes the data in the United States under the EU-US Data Privacy Framework.

7. Security

We protect the data with technical and organisational measures such as encryption, access control and logging. Only people who need the data have access to it.

8. Your rights

You have the right to access your data and to have it corrected or erased. You can also ask us to restrict processing, and to receive data you have provided yourself in a machine-readable format when the processing is based on consent or a contract. You have the right to object to processing based on legitimate interest. If you object to direct marketing, we always stop. If you have given consent, you can withdraw it at any time.

Contact us at legal@barrion.io. We answer within one month. If your request is complex, we can extend that by up to two more months, and we will tell you if we do.

9. Complaints

If you think we process your data incorrectly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), www.imy.se.

10. Automated decisions

We make no decisions about you that are based solely on automated processing and that have legal effects for you or affect you in a similarly significant way.

11. Cookies

We use cookies on our website and in the platform. Cookies that are not needed for the website or the platform to work are only used with your consent. You can change your choices in the cookie settings on the website and in the platform. Our Cookie Policy lists every cookie.

12. Changes

We update this policy when our processing changes. The latest version is always on barrion.io. If we make significant changes, we will tell you in a suitable way.