Howwe Privacy Policy
Version 2026-10-22 ยท Last updated 22 October 2026
1. Who we are
This Privacy Policy explains how Howwe Technologies AB (publ) (org. no. 556655-7509, Grev Turegatan 30, 114 38 Stockholm, Sweden) ("Howwe", "we", "us") processes personal data when you use the Howwe service, connect an AI assistant to Howwe, visit our website or contact us. Questions about privacy can be sent to contact@howwe.io.
2. Our role
When your organisation uses Howwe, the organisation is the controller of the personal data in its Howwe account, such as names, teams, goals and activities. Howwe processes that data as processor on the organisation's behalf, under the data processing terms in the customer agreement or our standard Data Processing Agreement. Requests about that data are best sent to your organisation, and we will help it respond.
For our own purposes, such as securing the service, product analytics, AI assistant usage logs, customer relationships, sales and our website, Howwe is the controller. The table in section 4 shows which is which.
3. What we collect
- Account data: name, email address, user ID, organisation, teams and roles.
- Content you enter: goals, initiatives, activities, comments and other text you or your colleagues enter in Howwe.
- Usage and error data: which features are used and when, errors that occur, browser type, language and operating system, linked to your user ID and organisation.
- Session recordings: recordings of how the app is used. All content you and your colleagues enter, and all form fields, are masked. Only the app's own labels and buttons are visible.
- Server and security logs: requests to the service, including IP address.
- Support conversations: messages you send to our support.
- Business contacts: name, email, company and, if provided, phone number and message when you contact us, fill in the form on our website, register for an event or meet us.
4. Purposes, legal basis and retention
| Purpose | Data | Our role and legal basis | Retention |
|---|---|---|---|
| Providing the service to your organisation, including login and access control | Account data, content, login events | Processor. Your organisation determines the legal basis | Agreement term plus six months |
| Service and account emails | Name, email, notification content | Processor, on your organisation's behalf | Agreement term plus six months |
| Customer support | Support conversations | Processor, on your organisation's behalf | 24 months after the request is closed |
| Securing and troubleshooting the service | Server and security logs, error data | Controller. Legitimate interest in a secure, working service | 90 days |
| Understanding and improving how Howwe is used | Usage data, session recordings | Controller. Legitimate interest in improving the service | Recordings 30 days, usage data 24 months |
| AI assistant (MCP) usage logs | See section 7 | Controller. Legitimate interest in operating and securing the MCP server | 12 months |
| News about Howwe to customer contacts | Name, email | Controller. Legitimate interest. You can unsubscribe in every email | Until you unsubscribe or the customer relationship ends |
| Sales and website inquiries | Business contact data | Controller. Legitimate interest in answering and following up | 24 months after the last contact |
| Recording of online meetings with customers and partners | Recording, transcript, participant names | Controller. Consent of the participants, asked at the start of the meeting | 12 months |
Backups are kept for up to 90 days and are then deleted automatically. When personal data is deleted, we anonymise it so it can no longer be linked to a person. We may also combine data from many customers into aggregated statistics, such as benchmarks, from which no customer or person can be identified.
5. Product analytics
We use PostHog, hosted in the EU, to understand how Howwe is used, to find and fix errors, and to improve the service.
- PostHog does not store anything in your browser or on your device.
- Events are linked to your Howwe user ID and your organisation.
- Content you enter and form fields are masked in session recordings, and text is not collected when you click.
- We do not store IP addresses in PostHog.
You can object to this processing by contacting contact@howwe.io. We then stop collecting analytics for your account.
6. Howwe's own AI features
Some Howwe features use AI, such as Strategy Planner, Strategic Pulse and Intelligence Hub. They use Google's Gemini models through Google Cloud, which is listed as a sub-processor.
- Customer data is not used to train or fine-tune AI models, whether Google's, other external or public models, or Howwe's own.
- Your organisation can ask us to turn the AI features off.
- The features support people in their work and do not make decisions about individuals. We assess them as minimal risk under the EU AI Act.
See our AI Policy.
7. Using Howwe through AI assistants (MCP server and connectors)
You can connect AI assistants, such as Microsoft Copilot, Claude, ChatGPT and Gemini, to Howwe through our MCP server. To connect, you sign in to Howwe with your own account and approve the connection. The assistant then acts with your own permissions in Howwe. It cannot see or change anything you could not see or change yourself. How it works is described at howwe.io/mcp.
Your organisation's choice. Your organisation decides whether AI assistants may be connected to Howwe, and which ones. The assistant is provided by a third party under its own agreement with you or your organisation. When you ask it something, the Howwe data needed to answer is sent to that provider and handled under its terms and privacy policy, which this policy does not cover. Your organisation's administrator can ask us to turn off access through AI assistants for the organisation.
What Howwe records. For each request from an assistant, we record which tool was used, when, by which user and organisation, from which assistant, how long it took and whether it succeeded. We do not record what you write to the assistant, the content you create or change, the data a tool returns, search terms or your IP address. The record is stored with PostHog in the EU.
Your choices. You can disconnect an assistant at any time in the assistant's settings. Your organisation's administrator can remove your access to Howwe, which also ends the assistant's access.
8. Who receives personal data
Sub-processors for the Howwe service. We use carefully selected sub-processors for hosting, database, login, AI features, support, analytics and email, under written data processing agreements. See the full list of sub-processors, including where each one processes data.
Service providers for our own purposes. For sales, customer relationships, meetings and our website we use:
| Provider | Purpose | Location | Transfer safeguard |
|---|---|---|---|
| HubSpot | Customer relationship management and emails to business contacts | EU | Not applicable, EU |
| Google Workspace | Email, calendar and documents | EU and USA | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Fathom | Recording and transcription of online meetings, with consent | USA | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Formspree | Delivery of messages sent through the form on howwe.io | USA | Standard Contractual Clauses |
We do not sell personal data. We may disclose personal data when the law requires it, for example under a court order.
9. Login
All users sign in through login.howwe.io, provided by Auth0 in the EU. Auth0 processes your name, email address, IP address and login events to authenticate you.
10. Cookies and similar storage
In the Howwe app we only store what the app needs to work and what you choose yourself:
- login and session data, so that you stay signed in securely,
- your own settings, such as language, colour mode and how menus and views are arranged,
- support and help (Intercom), which is part of the service. Our support, help center, service messages and in-app guides run in Intercom. It stores identifiers for your session and your device in your browser, so that these work and to prevent abuse. We do not use it for marketing.
Product analytics does not use cookies or other storage in your browser, see section 5.
On our website howwe.io we set no cookies and use no tracking or advertising tools. If you send us a message through the form, it is delivered to us through Formspree.
11. Your rights
You have the right to request access to your personal data, and to ask us to correct, delete or restrict it. You may object to processing based on our legitimate interest, and in some cases ask to receive your data in a portable format. Where processing is based on consent, you can withdraw it at any time.
Contact contact@howwe.io. We reply within one month. If the data belongs to your organisation's Howwe account, we will involve your organisation.
You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), www.imy.se.
12. Security
We protect personal data with encryption in transit and at rest, access control, multi-factor authentication for administrative access, logging and regular backups. Read more in our security overview.
13. Changes to this policy
We update this policy when our processing changes. Material changes are announced by email or in the app before they take effect. The version and date at the top show when the policy was last updated.
14. Contact
Howwe Technologies AB (publ), Grev Turegatan 30, 114 38 Stockholm, Sweden. contact@howwe.io.