Who we are
Afternoon is provided by Adam Jafer AB (organisation number 559442-4912), Styrmansgatan 5, 114 54 Stockholm, Sweden ("Afternoon", "we", "us"). For anything about privacy, write to adam@afternoon.app.
Our two roles
For the firms that use Afternoon, we are a data processor. When a real estate firm lets its agents use Afternoon, the firm decides why and how its agents' email, calendars and client information are used. The firm is the controller of that data; we process it on its behalf, only to provide Afternoon, under a data processing agreement (in Swedish, personuppgiftsbiträdesavtal). If you are a buyer, seller or other contact of an agent and have questions about your data, the agent's firm is the right place to start. You can also write to us and we will pass it on.
For a smaller set of data, we are the controller: the agent's account, requests sent through our website, and the logs we need to keep the service secure. Those are described in Data we are responsible for.
Data we process for firms
Afternoon only reaches what the signed-in agent can reach in Microsoft 365, and only after the agent connects their account and, where the firm requires it, the firm's IT approves. It cannot read other people's mailboxes, shared mailboxes or SharePoint. To provide the service it processes:
- Email: incoming email, to find questions about the agent's listings and draft replies; and the agent's sent email, to learn how they write. Email that is not about the agent's listings is left alone and its text is not stored.
- Calendar: times, titles and locations, to suggest free times, to book a meeting once a time is agreed, and to check that nothing from the calendar ends up in a reply.
- Contacts and conversations: the people the agent corresponds with and what they wrote, so a reply fits the conversation.
- Listing documents: annual reports, statutes and descriptions the agent adds, so every fact in a draft can point to its source.
- The agent's own work in Afternoon: drafts, edits, approvals, assistant conversations, and voice dictation (audio is turned into text and not kept).
- Ratings the agent gives: when the agent marks one of the assistant's answers as good or bad, we keep that answer with what the assistant saw when it wrote it, to check whether changes to Afternoon make its answers better. Only answers the agent chooses to rate are kept this way.
Nothing is sent, booked or published without the agent approving it. The full description, including each Microsoft permission and what Afternoon does with it, is on our security page.
Data we are responsible for
| What | Why | Legal basis |
|---|---|---|
| Agent account: name, email address, organisation and Microsoft account identifiers, sign-in sessions | To let the agent sign in, keep the account secure, and provide the service the firm signed up for | Performance of our agreement with the firm, and our legitimate interest in running a secure service (GDPR art. 6.1 b and f) |
| Website requests: name, work email, firm, market and office size | To answer and arrange the walkthrough you asked for | Legitimate interest in responding to business enquiries (art. 6.1 f) |
| Security and operational logs: time, request details and technical identifiers such as IP address. They do not contain email text. | To keep the service secure and working, and to investigate errors and misuse | Legitimate interest in security and reliability (art. 6.1 f) |
| Service messages: notifications to the agent about their work in Afternoon | To tell the agent when something needs them | Performance of our agreement (art. 6.1 b) |
We do not sell personal data, use it for advertising, or build profiles of the people agents correspond with.
AI models
Incoming email is sorted, and drafts are written, by Claude, a model from Anthropic, through Anthropic's API. Each new incoming email is read by the model to decide whether it concerns the agent's listings, before Afternoon knows whether it is relevant. When a reply is written, the model reads the question, the conversation and the relevant parts of the listing's documents. A second check compares each reply with the agent's calendar entries and other contacts, so none of them end up in it.
Customer data is never used to train AI models, neither by us nor by Anthropic. Answers an agent has rated are only shown to the model again to test a new version of Afternoon, inside our own systems in the EU and through the same Anthropic API. Instructions found inside email or documents are treated as content, never as commands.
Who else processes data
We use these sub-processors, each bound by a data processing agreement and only for the purpose listed:
| Provider | Purpose | Location |
|---|---|---|
| Google Cloud | Hosting, database, files, voice-to-text and text recognition in scanned documents | EU (Stockholm, and Google's EU locations) |
| Anthropic | The AI model (Claude) that sorts incoming email, writes drafts and checks replies | United States |
| Microsoft | The agent's email and calendar, in the firm's own Microsoft 365 | The firm's tenant |
| Google Firebase | Notifications to the iPhone app (a short summary only) | Global |
| Browserbase | Secure browser sessions, only for tasks the agent starts in their CRM | As set out in our data processing agreement |
We may also disclose data where the law requires it, or to protect the rights and safety of our users and others.
Transfers outside the EU
Data is stored in the EU. Some processing happens outside the EU and EEA, notably the AI model at Anthropic in the United States. Such transfers are protected by the European Commission's Standard Contractual Clauses in our providers' data processing terms, and where the provider is certified, by the EU–US Data Privacy Framework. You can ask us for a copy of the safeguards that apply.
How long we keep data
| Data | Kept |
|---|---|
| Email unrelated to the agent's listings | The text is not stored. Only the sender, subject and a short note on why it was left alone, deleted after 90 days. |
| Email about the agent's listings, and the replies sent | 90 days, then deleted automatically. |
| Drafts, decisions, assistant conversations, examples of the agent's replies | 12 months. Decisions are then kept only as anonymous statistics. |
| The assistant's work log | 30 days. |
| Answers the agent rated, with what the assistant saw | 180 days, then deleted. |
| Security and operational logs | 30 days. |
| Website requests | 24 months, then deleted. |
| When an agent disconnects | Afternoon stops reading at once. Everything is deleted after 30 days unless they connect again. |
| When an account is deleted | Microsoft access is revoked and everything is deleted within 24 hours. Backups are gone within 14 days. |
A firm can also ask us to delete its data at any time, and agents can export their data from the app.
Cookies
This website sets no cookies and uses no analytics or tracking. The Afternoon app uses only the cookies it needs to keep an agent signed in and to protect against forged requests. These are strictly necessary, so they need no consent, and they are never used for tracking or advertising.
Security
Data is encrypted in transit and at rest, and Microsoft access tokens are encrypted with their own key. Row-level security in the database keeps each agent's data apart. Sign-in always goes through Microsoft, so the firm's own MFA and access rules apply. More on our security page.
Your rights
Under the GDPR you have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on our legitimate interest, you can object to it at any time.
To use these rights, write to adam@afternoon.app. For data we process for a firm, we will help that firm answer you. We reply within one month.
You can also complain to the Swedish Authority for Privacy Protection, Integritetsskyddsmyndigheten (IMY), or the data protection authority where you live.
Changes and contact
If we change how we handle personal data, we update this page and the date at the top. Firms using Afternoon are told in advance of changes that affect them, including new sub-processors.
Questions about privacy or this policy: adam@afternoon.app. Adam Jafer AB, Styrmansgatan 5, 114 54 Stockholm, Sweden.