Privacy policy

Who is responsible

KörkortAkademi, [FÖRETAGSNAMN SAKNAS], [POSTADRESS SAKNAS], is the data controller for personal data processed on korkortakademi.se.

You can reach us at info@korkortakademi.se.

What we process

Account data: first name, last name, email address and phone number you provide at registration.

Study data: your answers to practice questions and mock exams, results, bookmarked questions, your own notes, study goals and how far you have progressed. This is tied to your account so you can pick up where you left off.

Purchase data: which licence you bought, its validity period and receipt records. Card details are handled solely by Stripe — we never receive or store your card number.

Technical data: IP address, browser, device type, language preference, cookies and similar technologies. See our cookie policy.

If you register interest in a course that has not launched yet, we keep your email address and the course it concerns so we can tell you when it opens.

Purposes and legal basis

Providing the account and course content, including saving your progress — performance of a contract (Art. 6(1)(b) GDPR).

Handling payment, access and renewal — performance of a contract (Art. 6(1)(b)).

Bookkeeping and retaining records — legal obligation (Art. 6(1)(c)), the Swedish Accounting Act.

Sending transactional messages, such as account confirmation or a reminder that your membership is about to expire — performance of a contract (Art. 6(1)(b)).

Keeping the service secure, preventing abuse and debugging — legitimate interest (Art. 6(1)(f)).

Understanding how the service is used and improving it through analytics — consent (Art. 6(1)(a)). You may withdraw consent at any time.

Who we share data with

We never sell your personal data. We use the following processors to run the service:

Supabase — accounts, sign-in and the database holding your course data and progress.

Stripe — payments and payment data. Stripe is an independent controller for its part of the processing.

Vercel — hosting and delivery of the website.

Resend — sending transactional email.

Google Analytics and Microsoft Clarity — usage statistics and analytics. Used only with your consent.

Sentry — technical error reports so we can fix bugs.

We may also disclose data where the law requires it, or to an authority on a valid request.

Transfers outside the EU/EEA

Some of the providers above process data outside the EU/EEA. Such transfers rely on an EU Commission adequacy decision or on standard contractual clauses together with supplementary safeguards.

[Confirm the mechanism in force with each provider at review time and state it here.]

How long we keep data

Account data and study data are kept for as long as you have an account. Deleting your account removes them, except where we are legally required to retain something.

Accounting records are kept for seven years under Swedish law.

Technical logs and error reports are kept for no longer than [state a period, e.g. 90 days].

Course interest registrations are deleted once the course has launched, or on your request.

Your rights

You have the right to access the data we hold about you, to have inaccurate data corrected and to have data erased.

You have the right to request restriction of processing and to object to processing based on legitimate interest.

You have the right to data portability — to receive the data you provided in a machine-readable format.

Where you have given consent you may withdraw it at any time. This does not affect processing that has already taken place.

Contact info@korkortakademi.se to exercise any of these rights.

If you believe we handle your data incorrectly you may lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se.

Changes to this policy

We may update this policy. The date of the latest update is shown at the top of the page. We will tell you by email or in the service before any material change takes effect.