Last updated: October 4, 2026

Privacy Policy & GDPR

This page describes the personal data itbutler AB ("IT Butler", "we") handles when you call us, visit itbutler.se or subscribe to our newsletter. It explains why we do it, who receives the data and what rights you have under the EU General Data Protection Regulation (GDPR). If you'd rather have a short version, see our Your rights under GDPR page.

Good to know: the phone service is new. Some things, such as the legal basis for the phone service and how long call data is kept, are still being determined together with legal counsel. Where that applies it says so clearly below, and we will update this page once it is settled.

Summary

Overview. The details are in the sections further down.
What	Why	Legal basis	How long
Phone calls: the call as text, notes on your case, times	To help you with your problem and pick up where we left off next time	Being determined with legal counsel	No automatic deletion yet
BankID identification	To know it is you calling	Being determined with legal counsel	No automatic deletion yet
Linked phone number (optional)	To let you call again without BankID	Your consent	Until the link is removed or replaced
Customer account and cases	To keep track of your cases and your weekly tech help	Being determined with legal counsel	No automatic deletion yet
Newsletter (email)	To send you updates about IT Butler	Your consent	Until you unsubscribe
Visitor statistics	To understand how the site is used	Your consent	At most 14 months
Fonts from Google	To display the site's fonts	Being determined with legal counsel	We store nothing ourselves
Server logs (IP address)	Operations and protection against overload and abuse	Being determined with legal counsel	No fixed limit yet

Who is the data controller?

itbutler AB, org. no. 559592-3508, Edinsvägen 1, 131 45 Nacka, Sweden, is the data controller for the information described here. You can reach us at info@itbutler.se.

When you call us

When you call 076-686 24 07, our AI assistant answers, not a person. You are told this at the start of the call the first time you call. This is how the call is handled:

The call goes through our telephony provider 46elks, which receives your phone number.
What you say is sent directly to OpenAI. OpenAI provides the AI assistant's voice and turns the call into text.
We keep the call as text (both what you say and what the assistant says), notes on your case and details about the call, such as when it started, when it ended and how it ended.
We do not keep the audio of the call.
After the call we use OpenAI to summarise and sort your case, so we can help you further the next time you call.
You enter your Swedish personal identity number with the phone's keypad. It is sent only to our BankID provider and never to the AI assistant.
Authorised staff at IT Butler can read the call text and your case. That requires signing in.
Today the AI assistant does not transfer you to a person during the call. If it notices something that needs a person, for example a risk of fraud, it stops helping with that and flags the case so our staff look at it.
46elks also keeps its own call history, for example which number called and when.

Everything you say becomes part of the call text. So never tell the AI assistant passwords, card numbers or codes.

BankID and your customer account

We use BankID, through our provider Idura, to know that it is you calling. From the identification we keep an identifier that links your BankID identity to your customer account, not your personal identity number.

Your customer account may contain your name, phone number, email address and postal address if we have received them, your case history and how much of your weekly tech help you have used.

When you choose to become a customer, a customer account can be created after successful BankID identification. We also keep started signups, their status and staff follow-up notes, even if you never reach the AI assistant. The number displayed when you call may be stored as unconfirmed contact information for follow-up. It does not prove who you are. A name and email address are not required to become a customer.

Link your number (optional). After BankID we ask whether you want to link the number you are calling from to your customer account, so you can call up to nine times without BankID. If you say yes, we store a protected lookup for the phone link and when you said yes. That link is separate from the phone number that may be held as contact information in your customer account or started signup. If you say no, you still get help on the call. If you link a new number, it replaces the old one.

Automated decisions

Some steps in the phone service happen automatically, without a person deciding in the moment:

After BankID the system checks whether you have a customer account. If you said you are already a customer and no account is found, you receive the offer to become a customer. If you accept and the BankID identification is still valid for the same call, an account is created; otherwise you need to identify yourself again. The account itself does not mean a subscription has been signed or that you are charged.
About 30 minutes of tech help is included each week. When the time is used up, help ends automatically, and it is topped up again on Monday.
If the AI assistant judges that a case involves risk, for example fraud, money or security, it stops helping with that and hands the case to our staff.
Cases are sorted automatically by the type of problem.

We do not use your data to show you advertising. If you think an automated step got something wrong, email info@itbutler.se. How these steps should be assessed under the GDPR rules on automated decisions is something we are reviewing with legal counsel.

The "Keep me updated" newsletter

If you sign up for the newsletter on the site, we keep:

Your email address.
Whether the sign-up is for yourself or for a parent or relative, so we can send relevant information.
Where on the site you signed up, and (automatically, via our email provider Brevo) the time and IP address of your confirmation. This shows that it really was you who asked for the emails.

We don't ask for your name or phone number for the newsletter. The legal basis is your consent: you tick a box and then confirm via a link in an email (double opt-in). No newsletter emails are sent until you have confirmed, and every email has a link to unsubscribe.

Cookies, statistics and fonts on the site

Visitor statistics with Google Analytics

We use Google Analytics to see how many people visit the site, which pages are read, and how visitors found their way here. It helps us make the site better. We do not use it to target ads at you.

We measure nothing until you say yes. The first time you visit, you get a question at the bottom of the page. If you answer no, or don't answer at all, Google Analytics is never loaded: no analytics cookies are set and no statistics are sent to Google. Measurement starts only when you actively click "Yes, that's fine". The legal basis is your consent.

If you say yes, we measure in aggregate: page views, approximate location (country and region), device and browser type, and how you arrived at the site (for example via a search engine). We also see whether you click our phone number on the site. Google Analytics 4 does not store your IP address. We have turned off the advertising features in the tag, so no advertising cookies are set, no profiling for advertising purposes takes place, and we do not sell the data on.

On our ad pages (itbutler.se/ring and itbutler.se/en/call) the same statistics are also sent to a second Google Analytics account, which we use to follow up on our ads. The same rule applies there: nothing is measured until you say yes, and the account is not linked to Google Ads.

Change your mind whenever you like

You can change your mind at any time via the Cookie settings button at the bottom of every page. Choosing no there stops measurement immediately, and the analytics cookies we set (_ga and _ga_…) are deleted right away. In your browser settings you can also remove cookies yourself or block them entirely.

Your answer is stored locally in your browser (localStorage) so we don't have to ask every time. It is needed in order to respect your choice, is kept only on your device, and is never sent to us or to Google.

Fonts from Google Fonts

The site's fonts are loaded from Google Fonts. When a page loads, your browser fetches the fonts directly from Google's servers, and Google then receives your IP address and information about your browser. This happens when the page loads, before you have answered the statistics question, and regardless of your answer.

Server logs

As with any website, our server receives your IP address when you visit the site. We use it to protect forms and sign-in against overload and abuse, and our web server may keep it in technical logs.

Who receives the data?

We never sell your data and we do not share it with others for their marketing. We use these providers:

46elks: telephony. Receives the call and your phone number.
OpenAI: the AI assistant's voice, turning the call into text, and summarising and sorting cases.
Idura: identification with BankID.
Hostinger: the server that runs the site, the phone service and our database.
Brevo (Sendinblue SAS): the newsletter, under a data processing agreement.
Google Ireland Limited: visitor statistics as a data processor under Google's data processing terms, only if you said yes.
Google: fonts (Google Fonts).
Our email provider: when you email us at info@itbutler.se.

What role each provider has under the GDPR, and which agreements should apply, is something we are reviewing with legal counsel.

Transfers outside the EU/EEA

OpenAI is a US company. What you say on the call and the call text may therefore be processed in the United States. What safeguards apply to that transfer is something we are reviewing with legal counsel.

If you have said yes to statistics, data about your visit may also be processed by Google outside the EU/EEA, including in the United States. The same may apply when fonts are loaded from Google Fonts. Google relies on the European Commission's standard contractual clauses and its certification under the EU-US Data Privacy Framework for this.

Brevo stores and processes the newsletter data within the EU (France). Where 46elks, Idura and Hostinger store data is something we are checking and will add here.

How long do we keep the data?

Calls, cases, customer account, started signups, follow-up notes and BankID link: we have not yet decided how long these are kept, and today they are not deleted automatically. We are determining this with legal counsel. Until then, we delete your data if you ask us to, as far as the law allows.
Linked phone number: until the link is removed, for example because you ask us to, or replaced by a new number.
Newsletter: until you unsubscribe or ask us to delete your data.
Visitor statistics: at most 14 months in Google Analytics, and after that only as aggregated statistics with no link to individual visits.
Server logs: no fixed limit yet.

The data is also present in backups of our database. Our providers may also keep data under their own terms.

Do you have to provide the data?

The newsletter, the visitor statistics and linking your phone number are optional. To get help by phone you need to identify yourself with BankID, and the call is handled by the AI assistant and kept as text. If you don't want that, you cannot use the phone service, but you can always email us with questions.

Your rights under GDPR

Under the GDPR you have the right to:

Withdraw your consent at any time: the newsletter via the link in any email from us, the statistics via Cookie settings, and a linked phone number by emailing us.
Access: get a copy of the data we hold about you.
Rectification: have inaccurate or incomplete data corrected.
Erasure ("the right to be forgotten"): have your data deleted.
Restriction: have the use of your data temporarily limited, for example while an objection is being reviewed.
Objection: object to how we process your data.
Data portability: get your data in a machine-readable format to move it elsewhere.

Reach out to info@itbutler.se for any of the above. We respond within a reasonable time and no later than one month. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se, if you feel we've mishandled your data.

Changes

On October 4, 2026 we rewrote this policy so that it describes the phone service, BankID and what the site does today. Before that it only covered the pre-launch sign-up. The legal basis and retention periods for the phone service are being determined with legal counsel. Once that is settled we will update this page and the date at the top.