Privacy policy

Data controller

Elevante AB (“Elevante”, “we”) is the controller for personal data on this website and for accounts created directly with us. Contact: john@elevante.se. Postal address and company registration number are available on request.

For personal data processed as part of a school’s use of the service (students’ and teachers’ lesson data), the school is the controller and Elevante is the processor. That processing is governed by a data processing agreement (DPA) between the school and Elevante.

What data we process

• Account data: name, email address, role (student/teacher/admin) and school.
• Lesson data: audio recording (temporary), the lesson transcript, and the student’s questions and AI answers in the chat.
• Technical data: login session, logs and anonymised usage statistics.
• Data you provide in the contact form: name, email, school and message.

Purposes and legal basis

• Providing the service to the school – performance of a contract and, for student data, the school’s task carried out in the public interest (GDPR Art. 6(1)(e)).
• Transcribing and making lessons available for revision – same basis.
• Managing accounts and login – performance of a contract.
• Improving and securing the service and producing statistics – legitimate interest.
• Responding to contact-form enquiries – legitimate interest.

How long we keep the data

Raw audio is deleted automatically as soon as the lesson has been transcribed. Transcripts and related lesson data are kept for as long as the school wants to use them and are deleted on the school’s request or when the agreement ends. Account data is kept for the term of the agreement. Contact-form messages are kept for as long as needed to handle the enquiry.

Where data is stored – no transfer outside the EU

All processing of personal and lesson data takes place inside the EU. Transcription runs on Swedish infrastructure. The database and storage are located inside the EU, and the application runs in Stockholm. Calls to the language model go to an EU-based endpoint. No student or teacher data is transferred to a third country.

Processors

We use providers that process data on our behalf, including for transcription and AI infrastructure, database and storage, website hosting and sending email. The public website additionally uses services that show, based on IP address, which organisations visit us, on the basis of legitimate interest, and an analytics tool for anonymised statistics after consent – see our cookie policy. If you want to know which providers we use for a particular processing activity, email john@elevante.se and we will tell you.

Your rights

You have the right to request access to, rectification or erasure of your personal data, to object to or request restriction of processing, and to data portability. Where the processing concerns student data, please contact your school in the first instance, as it is the controller. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY).

Security

We protect the data with technical and organisational measures, including per-school access control (row-level security), encryption in transit and limited authorisation. No AI model is trained on students’ data.

Changes and contact

We may update this policy. We will announce material changes on the website. Questions about personal data are answered at john@elevante.se.