Lowkey Vision - Privacy Notice
This Privacy Notice explains how Lowkey Vision AS (“Lowkey Vision”, “we”, “us” or “our”) processes personal data when you use our website or Service, create an account, communicate with us or otherwise interact with our business. It mainly describes processing for which Lowkey Vision decides the purposes and means. The Standard Terms of Service (the “Terms”) govern contractual rights in Customer Data.
At a glance
- Our roles: We are controller for account, website, billing, security and business-relationship activities, and normally processor when we handle personal data in Customer Data solely for a customer.
- AI training: A plan is training-enabled only where this is clearly disclosed and accepted. Enterprise and negotiated arrangements default to No Training. If training later stops, this stops collection of new Training Data only; previously collected Training Data remains governed by the Terms and the retention rules below.
- Your rights: Depending on applicable law, you may request access, correction, deletion, restriction or portability, and object to certain processing.
1. Who We Are and Our Roles
Lowkey Vision AS, organisation number 937 674 694, is incorporated in Norway and has its registered address at Gaustadalléen 21, 0349 Oslo, Norway.
We act as controller where we decide why and how personal data is processed, including for accounts, billing, security, compliance, website operations, communications and any separately assessed model-development activity involving personal data.
When we process personal data in Customer Data solely on a customer’s documented instructions to provide the Service, we act as processor or subprocessor. The customer or another organisation is the controller, and a separate data processing agreement must be entered into before such data is submitted. If your data was supplied through a customer account, you should normally contact that customer first; we will assist or respond as required by law and the applicable agreement.
2. Personal Data We Process and Sources
- Account, relationship and billing data: name, business contact details, organisation, role, login identifiers, plan or Order information, billing address, invoice status and payment-provider references. We do not normally receive full card details.
- Usage, technical and security data: logins, feature use, timestamps, IP address, device and browser data, authentication events, logs, diagnostics and telemetry.
- Communications and marketing data: emails, support and demo requests, meeting or event records, marketing preferences and Feedback.
- Website and device-storage data: pages viewed, referrals and interactions, browser local storage used for authentication and application state, and aggregated cookieless website analytics.
- Training and screening data: cell-image pixels and related technical or statistical features used under a Training Arrangement, and personal data encountered only when candidate images are reviewed to exclude non-conforming content.
Account and authentication information is required to create and administer an account, and billing information is required for paid use. Without required information, we may be unable to provide the Service.
The Service is designed for non-identifying microscopy images. Customers must not submit identifiable, sensitive or regulated personal data unless Lowkey Vision has approved the processing and the required agreements and safeguards are in place. If such data is submitted contrary to the Terms, we may process it only as needed to review, isolate or delete it. Lowkey Vision is not a HIPAA business associate by default and does not accept PHI unless the required written arrangements are in place.
We obtain personal data from you, your organisation or account administrator, your use of the Service, our service providers and, for the limited screening described below, Customer Data submitted through a customer account.
3. Purposes and Legal Bases
| Purpose | Legal basis |
|---|---|
| Provide the Service, accounts and customer relationship | Contract where the individual is a party; otherwise legitimate interests in providing and administering a business-to-business service. |
| Billing, accounting and statutory records | Contract or legitimate interests for billing and payment; legal obligations for accounting, tax and required records. |
| Security, fraud prevention and compliance | Legitimate interests in protecting the Service and preventing misuse; legal obligations where specifically applicable. |
| Enquiries, support and service communications | Contract or pre-contract steps where applicable; otherwise legitimate interests in managing business relationships. |
| Service analytics and product improvement | Legitimate interests in performance and feature improvement. Consent applies where required for non-essential device technologies. |
| Marketing | Consent where required by electronic-marketing rules; otherwise legitimate interests in permitted business-to-business or existing-customer marketing. |
| Reviewing candidate images before training | Legitimate interests in excluding personal data or unsuitable content, enforcing the Terms and maintaining training-data quality. Identified personal data is excluded and deleted rather than used for training. |
| Legal claims and corporate transactions | Legitimate interests in claims and corporate transactions; legal obligations where specifically applicable. |
Where we rely on legitimate interests, we assess the interest pursued, necessity and the impact on individual rights. Standard Training Data is intended not to contain personal data. Before any intended use of personal data for Lowkey Vision’s own model development, we will identify and disclose the applicable legal basis and implement the required safeguards. Special-category personal data also requires a valid Article 9 GDPR condition or equivalent rule.
4. Customer Data and AI Model Development
Training-Enabled Plans. Where a plan is clearly identified and accepted as training-enabled, the covered Training Data may be used for model development, training, validation and Service improvement under the Terms.
Enterprise and negotiated arrangements. No Training applies unless another option is selected in the Order.
Later disabling. A later disabling of training stops collection of new Training Data only. Previously collected Training Data may continue to be used and retained for the disclosed purposes under the Terms and Section 6 below.
Standard Training Data is limited to cell-image pixels and related technical or statistical features unless additional categories are disclosed. Candidate images are reviewed before training, which may include review by authorised personnel, to identify and remove personal data or other non-conforming content. Available identifiers are removed before Training Data enters the training infrastructure, and non-conforming images are excluded and deleted. Pseudonymised data remains personal data; data is anonymous only when it no longer relates to an identifiable person.
We do not permit service providers to use Customer Data to train their own or general models unless that use is expressly disclosed to and accepted by the customer.
5. Recipients, Locations and International Transfers
We do not sell personal data. We may disclose it to providers of hosting, storage, security, authentication, payment, analytics, support and communications; professional advisers; customer account administrators; authorities where required; and parties to a financing or corporate transaction. Some act on our instructions and others as independent controllers. Information about material providers is available on request.
The standard cloud Service may use global or dynamically distributed infrastructure, so uploaded images and related data may be stored, replicated, accessed or processed in multiple countries. Images selected for training may be transferred to training infrastructure in the United States. A plan or Order may provide specified data-location or residency commitments where available.
Where these data are personal data and a transfer outside the EEA, United Kingdom or Switzerland requires safeguards, we use an applicable adequacy decision or certification framework, such as the relevant US Data Privacy Framework for an actively certified recipient, or approved contractual safeguards such as the EU Standard Contractual Clauses, the UK IDTA or Addendum, or corresponding Swiss adaptations. We use transfer assessments and supplementary measures where appropriate. You may request further information or a copy of relevant safeguards, subject to permitted redactions.
6. Retention
We retain personal data only as long as needed for the relevant purpose, operations, legal obligations, disputes and security. More specific periods may be stated in account settings, a plan, an Order or a data processing agreement.
| Data category | Retention criterion |
|---|---|
| Account, relationship and support data | For the relationship and a reasonable period afterwards for support, records and legal claims. |
| Billing, accounting and legal records | For applicable statutory accounting, tax, payment and limitation periods. |
| Security and usage logs | For a limited period based on security, fraud-prevention and operational needs. |
| Operational Customer Data | Generally for the account term and the 30-day post-termination download period, then deleted from active systems in accordance with Lowkey Vision’s deletion processes, unless a plan, Order or data processing agreement states otherwise. |
| Training Data | For as long as reasonably necessary for the disclosed model-development and Service-improvement purposes, subject to periodic review, applicable law and any shorter period stated in the Training Arrangement or Order. |
| Review-excluded content | Personal data or other non-conforming content is excluded from training and deleted promptly after identification, except for a minimal record needed for security, legal compliance or enforcement. |
Residual copies may remain for a limited period in backups or archives. Irreversibly anonymised data and Model Improvements that do not contain personal data fall outside this Notice.
7. Your Rights and Automated Decisions
Depending on applicable law, you may have rights to access, correct, delete or restrict personal data, receive portable data, object to processing based on legitimate interests, and withdraw consent without affecting earlier processing. You may object at any time to direct marketing. We do not make solely automated decisions using personal data that produce legal or similarly significant effects.
Requests may be sent to [email protected]. We may verify your identity or an agent’s authority. If data is processed for a customer acting as controller, we may refer the request to that customer and assist it as required. You may complain to a competent supervisory authority; in Norway this is Datatilsynet.
Where required, we delete personal source data and stop future processing. Deletion may not remove the influence of data from an existing model where that influence cannot reasonably be isolated, subject always to rights and remedies under applicable law.
8. Security and Personal Data Breaches
We use administrative, technical and organisational measures designed to protect personal data, taking account of the data, deployment model and risks. Measures may include access controls, encryption in transit, logging, vulnerability management, backups and incident response. No system is completely secure, and customers remain responsible for their accounts, devices, networks and customer-controlled environments.
Where we act as controller, we notify authorities and affected individuals of personal data breaches when required by law. Where we act as processor, we notify and assist the relevant customer under applicable law and the data processing agreement.
9. Device Storage, Marketing and Third-Party Services
We use browser local storage where necessary for sign-in and application state, and cookieless web analytics. We do not use advertising or cross-site tracking technologies. External sign-in or infrastructure providers may use their own technologies under their privacy notices. If we introduce non-essential device storage or tracking, we will provide required information and obtain consent where applicable.
We may send service communications and marketing permitted by applicable law. You may opt out of marketing at any time; necessary account, security, legal and transaction messages may still be sent. Third-party integrations and services operate under their own terms and privacy notices.
10. Children, Changes and Contact
The Service is intended for business, academic, research and professional users, not children. We do not knowingly permit children to create accounts.
We may update this Notice as our practices, services or legal obligations develop. The updated version will state the new effective date, with additional notice where required or material to active users.
Lowkey Vision AS, organisation number 937 674 694, Gaustadalléen 21, 0349 Oslo, Norway. Privacy enquiries and rights requests: [email protected]. Website: www.lowkey-vision.com.