Privacy policy

[FYLL I: företagsnamn], corporate identity number [FYLL I: organisationsnummer], [FYLL I: postadress], is the data controller for the processing in Learnia. Send questions about personal data to [FYLL I: kontakt-e-post].

We process the following data about you:

• Account details: email address (and username for older accounts). Your password is only stored as a salted checksum (hash) – we can never see it.
• Answer history and results: which questions you have answered, your answers, test sessions, points, your estimated score and when you practised.
• Purchases: plan, billing period, amount, payment method, receipts and the ID numbers Stripe gives your customer record and subscription. Your card and payment details are handled by Stripe – we never receive them.
• Consent at checkout: that and when you accepted the terms and immediate delivery.
• Emails we send you: recipient, subject and content of account emails (welcome emails, receipts, links for passwords and email confirmation).
• Technical data: a login cookie, your IP address (temporarily, to stop misuse such as repeated login or reset attempts) and server logs.

• To give you an account and the service, save your answer history and show your progress – to perform our contract with you (Article 6(1)(b) GDPR).
• To take payment, send receipts and manage the subscription – to perform the contract (Article 6(1)(b)) and to comply with the Swedish Bookkeeping Act (Article 6(1)(c)).
• To send necessary emails about the account, such as login details, receipts and links to change your password – to perform the contract (Article 6(1)(b)).
• To protect the service against intrusion and misuse, for example by limiting the number of login and reset attempts – our legitimate interest in a secure service (Article 6(1)(f)).
• To improve questions and explanations using aggregated statistics that do not identify any individual – our legitimate interest in developing the service (Article 6(1)(f)).

We don’t send newsletters or marketing without asking you first. We never sell personal data and don’t use it for advertising or profiling.

We only use cookies that the service needs to work: a login cookie that keeps you logged in (at most 30 days) and a cookie that remembers which language you chose. Your browser also stores your answers from Try without an account locally, so that you can see your progress there. We don’t use cookies for analytics or advertising, and our emails contain no tracking.

We have data processing agreements with the suppliers that process data on our behalf. We only disclose data to authorities when the law requires it.

• Stripe (Stripe Payments Europe Ltd., Ireland) receives payments and manages subscriptions. Stripe is an independent data controller for some data, for example to prevent fraud, under Stripe’s own privacy policy.
• Resend (Resend, Inc., USA) sends our emails. The data may therefore be transferred to the USA. The transfer is protected by the European Commission’s standard contractual clauses and/or the EU–US Data Privacy Framework. [FYLL I: kontrollera Resends personuppgiftsbiträdesavtal och vilken mekanism som gäller.]
• Hosting of the website and database: [FYLL I: driftleverantör och land].

• Account and answer history: for as long as you keep your account. Accounts that have not been used for [FYLL I: t.ex. 24 månader] are deleted after a reminder by email.
• Purchases and receipts: seven years after the end of the calendar year in which the purchase was made, under the Swedish Bookkeeping Act.
• Links to change your password are valid for 60 minutes and links to confirm your email for 24 hours. They are deleted no later than seven days after they expire.
• IP addresses for misuse protection: at most 24 hours. Logins (sessions): at most 30 days.
• Email logs at Resend: [FYLL I: enligt inställningen hos Resend].

You have the right to know what data we hold about you (a copy of your data), to have incorrect data corrected, to have data erased, to restrict processing, to object to processing based on legitimate interest and to receive your data in a machine-readable format (data portability).

Email [FYLL I: kontakt-e-post] and we will reply within one month. If you delete your account, we remove the account and answer history, but data about purchases is kept for as long as the Swedish Bookkeeping Act requires.

If you think we are processing your personal data incorrectly, please contact us first. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), Box 8114, 104 20 Stockholm, imy.se.

All traffic is encrypted over HTTPS. Passwords and one-time links are only stored as checksums, login is protected against repeated guessing and only the people who need it have access to the database.

We update the policy when the service or the law changes. We will tell you about significant changes by email. The date at the top shows when the policy was last changed.