Protocols for law enforcement

1. Scope and contact

These guidelines concern Aivelyn Relationship Platform AB and do not replace applicable law, a competent authority’s powers or valid service of legal process. They do not expand anyone’s entitlement to data. Official contact: linda.carrick@aivelyn.se. Mailing address: Varugatan 1, 931 76 Skellefteå, Sweden. This is a mailbox address.

Use an official authority email address and put Law enforcement request and the case reference in the subject line. Initially send a limited request and ask for a secure channel for sensitive attachments. This contact is not a guaranteed emergency response channel. For immediate danger, members of the public should contact police or emergency services, in Sweden 112.

2. Required request information

Identify the authority, country, officer’s name and position, official contact details and case reference. Explain the legal basis, jurisdiction, relevant decision or order, requested action and deadline. Include an authentic and complete instrument where required.

Identify the account as precisely as possible, for example by user ID or known account email. Specify each data category, time range and time zone, and why the information is necessary and proportionate. Any confidentiality or non-notification request must identify its legal basis and duration.

3. Checks before disclosure

Before disclosure, Aivelyn must verify the requester’s identity and authority, using independent official contact channels where necessary. Validity, scope and applicable legal duties must be assessed separately from authenticity. An official email address alone does not supply a legal basis.

An incomplete, overbroad or unauthorised request should be clarified, narrowed or refused where permitted by law. Legal advice or judicial review may be needed. Aivelyn must not voluntarily provide data beyond the lawful and proportionate scope of the request.

4. Data and limitations

Requests can cover only data that Aivelyn actually holds or controls, can access, and is legally permitted or required to disclose. Depending on the feature, user choices and what remains available, this may include account and profile information, reports, limited technical information or subscription references. This is not a representation that any particular record or history exists.

Private messages, AI conversations and other sensitive information require particular assessment and must not be included routinely. Payment providers may hold data that Aivelyn does not. These guidelines do not imply reconstruction of data, new general logging or access to private conversations by unauthorised staff.

5. Data protection and foreign requests

Every disclosure requires a legal basis under GDPR Article 6. Where special categories of data or criminal offence data are involved, the requirements of Article 9 or 10 respectively and applicable national law must also be met. Purpose limitation, data minimisation and security apply to authority requests as well.

A request or decision from outside the EU/EEA is not automatically enforceable in Sweden. Aivelyn must assess GDPR Article 48, Chapter V international transfer requirements and applicable international or European cooperation procedures. Both the basis for processing and any transfer must be satisfied. Use of a competent legal channel may be required.

6. Preservation requests

Preserving existing information and disclosing it are separate actions. A preservation request should state the legal basis, account, data categories, time range, proposed preservation period and anticipated legal process. Preservation does not itself entitle the requester to the content.

Legally justified preservation must be limited, documented and reviewed. It does not mean general collection of future data or indefinite retention. Previously deleted records may be unavailable. Extensions require reassessment and must not be automatic.

7. Urgent threats to life or safety

An authority requesting urgent handling should describe the specific and immediate risk of death or serious physical injury, the persons and accounts involved, the data required and why ordinary procedures cannot be awaited. Provide a verifiable emergency contact and legal basis.

Urgency does not replace identity checks or a legal basis. Any disclosure must be limited to what is lawful and necessary in the particular situation. Automated risk flags in the service do not themselves trigger disclosure to police. Aivelyn does not guarantee round-the-clock response or intervention.

8. Mandatory notifications

Where Aivelyn is subject to a statutory reporting duty and its threshold is met, the competent authority must be notified as required by that rule. One example is DSA Article 18 for hosting services where awareness of information gives rise to suspicion of a criminal offence involving a threat to the life or safety of one or more persons.

Applicability, the competent authority, required information and timing must be assessed under the law. This is not a general practice of reporting every rule violation, dating disagreement, health detail or automated safety signal to police.

9. Secure handling and user information

Access to requests and disclosures must be restricted to authorised personnel. The recipient and transfer method must be verified and safeguards matched to data sensitivity. The legal basis, scope, decision, transfer and any preservation must be documented with restricted access.

Affected users must be informed when and to the extent required by law. Where notice must be delayed or restricted, its legal basis, reasons and any time limit must be documented and reviewed. No blanket promise is made of either advance notice or secrecy. Preservation and documentation must follow an established retention assessment, without indefinite retention.

10. Private requests and complaints

These guidelines do not give private individuals, employers, partners or other third parties access to member data. Users may exercise their own data protection rights under the privacy policy and contact Aivelyn with questions. Data protection complaints may be raised with the Swedish Authority for Privacy Protection, imy.se, or another competent supervisory authority.