Privacy policy

Data controller

Elevante AB (“Elevante”, “we”) is the controller for personal data on this website and for accounts created directly with us. Contact: john@elevante.se. Postal address and company registration number are available on request.

For personal data processed as part of a school’s use of the service (students’ and teachers’ lesson data), the school is the controller and Elevante is the processor. That processing is governed by a data processing agreement (DPA) between the school and Elevante.

What data we process

• Account data: name, email address, role (student/teacher/admin) and school.
• Lesson data: audio recording (temporary), the lesson transcript, and the student’s questions and AI answers in the chat.
• Technical data: login session, logs and anonymised usage statistics.
• Data you provide in the contact form: name, email, school and message.

Purposes and legal basis

• Providing the service to the school – performance of a contract and, for student data, the school’s task carried out in the public interest (GDPR Art. 6(1)(e)).
• Transcribing and making lessons available for revision – same basis.
• Managing accounts and login – performance of a contract.
• Improving and securing the service and producing statistics – legitimate interest.
• Responding to contact-form enquiries – legitimate interest.

How long we keep the data

Raw audio is deleted automatically as soon as the lesson has been transcribed. Transcripts and related lesson data are kept for as long as the school wants to use them and are deleted on the school’s request or when the agreement ends. Account data is kept for the term of the agreement. Contact-form messages are kept for as long as needed to handle the enquiry.

Where data is stored – no transfer outside the EU

All processing of personal and lesson data takes place inside the EU. Transcription runs on Swedish infrastructure via Berget AI. The database and storage are hosted by Supabase inside the EU, and the application runs on Vercel (Stockholm). Calls to the language model (Anthropic Claude) go to an EU-based endpoint. No student or teacher data is transferred to a third country.

Processors

We use providers that process data on our behalf, including: Berget AI (transcription and AI infrastructure, Sweden), Supabase (database and storage, EU), Anthropic (language model, EU endpoint), Vercel (hosting) and Resend (sending email from the contact form). The website also uses Google Analytics for anonymised statistics – see our cookie policy.

Your rights

You have the right to request access to, rectification or erasure of your personal data, to object to or request restriction of processing, and to data portability. Where the processing concerns student data, please contact your school in the first instance, as it is the controller. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY).

Security

We protect the data with technical and organisational measures, including per-school access control (row-level security), encryption in transit and limited authorisation. No AI model is trained on students’ data.

Changes and contact

We may update this policy. We will announce material changes on the website. Questions about personal data are answered at john@elevante.se.