Privacy policy

Data controller

Elevante (“we”) is the controller for personal data on this website and for accounts created directly with us. Contact: john@elevante.se. Postal address and company registration number are available on request.

For personal data processed as part of a school’s use of the service (students’ and teachers’ lesson data), the school is the controller and Elevante is the processor. That processing is governed by a data processing agreement (DPA) between the school and Elevante.

What data we process

• Account data: name, email address, role (student/teacher/admin) and school.
• Lesson data: audio recording (temporary), the lesson transcript, and the student’s questions and AI answers in the chat.
• Technical data: login session, logs and anonymised usage statistics.
• Data you provide in the contact form: name, email, school and message.

Purposes and legal basis

• Providing the service to the school – performance of a contract and, for student data, the school’s task carried out in the public interest (GDPR Art. 6(1)(e)).
• Transcribing and making lessons available for revision – same basis.
• Managing accounts and login – performance of a contract.
• Improving and securing the service and producing statistics – legitimate interest.
• Responding to contact-form enquiries – legitimate interest.

How long we keep the data

Raw audio is deleted automatically as soon as the lesson has been transcribed. Transcripts and related lesson data are kept for as long as the school wants to use them and are deleted on the school’s request or when the agreement ends. Account data is kept for the term of the agreement. Contact-form messages are kept for as long as needed to handle the enquiry.

Where data is stored and processed

Transcription and search in lesson content run on Swedish infrastructure (Berget AI). The database and storage are located in Zurich, Switzerland, which has an EU Commission adequacy decision. The application runs in Stockholm.

Answers to students, test grading and summaries are written by the language model Claude from Anthropic, which processes the data in the United States. What students write is stripped of names from the class list, email addresses and personal identity numbers before it is sent. Lesson transcripts are sent as they are and may contain names mentioned during the lesson. The data is not used to train models and is deleted by the provider within 30 days.

Email from the service, such as invitations, is sent via Loops, which processes the data in the United States.

Processors

We use providers that process data on our behalf, including for transcription and AI infrastructure, database and storage, website hosting and sending email. The public website additionally uses services that show, based on IP address, which organisations visit us, on the basis of legitimate interest, and an analytics tool for anonymised statistics after consent – see our cookie policy. If you want to know which providers we use for a particular processing activity, email john@elevante.se and we will tell you.

Your rights

You have the right to request access to, rectification or erasure of your personal data, to object to or request restriction of processing, and to data portability. Where the processing concerns student data, please contact your school in the first instance, as it is the controller. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY).

Security

We protect the data with technical and organisational measures, including per-school access control (row-level security), encryption in transit and limited authorisation. No AI model is trained on students’ data.

Changes and contact

We may update this policy. We will announce material changes on the website. Questions about personal data are answered at john@elevante.se.