Privacy Policy

Last updated 9 July 2026

This policy explains what personal data Norskprøven.ai collects, why, and your rights under the EU/EEA General Data Protection Regulation (GDPR). The data controller is the Norwegian sole proprietorship (enkeltpersonforetak) that operates Norskprøven.ai, org.nr 935 930 596. Contact: [email protected].

What we collect

  • Account data — your email address and authentication details, so you can log in and keep your progress.
  • Practice data — your level (A2/B1), settings, and any personal phrases you add, so the app works the way you left it.
  • Voice recordings— when you use the record and "were you understood?" features (see below).
  • Payment data — handled by our payment provider Paddle, not by us. We receive only what we need to grant access (e.g. your plan and its status); we never receive or store your full card number.
  • Basic technical data — standard server logs and essential cookies needed to run the site and keep you signed in.

How your voice recordings are handled

The A/B waveform comparison against the native recording happens in your browser. When you use the AI "understood?" check, your recording is sent to our processing partners to produce a transcript and feedback: ElevenLabs (speech-to-text) and Anthropic (which judges how intelligible the transcript is). We do not keep a permanent copy of your audio on our servers, and these partners process it to return the result rather than to train their models on your voice. If you never use the understood-check, your recordings stay on your device.

Why we're allowed to use it (legal basis)

  • To perform our contract with you — running your account, subscription, and the practice features you ask for.
  • Legitimate interests — keeping the Service secure and working, and improving it.
  • Legal obligation — Paddle retains transaction records required for tax and accounting.

Who we share data with (sub-processors)

We use a small set of trusted providers, each only for the purpose named:

  • Vercel — website and app hosting, plus cookieless, privacy-friendly traffic analytics.
  • Google — Google Analytics (aggregate usage analytics) and Google Ads (measuring which ads lead to sign-ups). Both stay cookieless until you allow the matching cookies.
  • Meta (Facebook/Instagram) — advertising measurement for our Facebook and Instagram ads. Loads only after you allow advertising.
  • Supabase — account authentication and database.
  • Paddle — payments, billing, invoicing, and tax as Merchant of Record.
  • ElevenLabs — speech-to-text for the understood-check (and native-voice audio).
  • Anthropic — AI evaluation of your transcript.

Some providers are located outside the EEA; where that is the case, transfers rely on the EU Standard Contractual Clauses or an equivalent safeguard. We do not sell your personal data.

Cookies and analytics

Essential cookies keep you signed in and remember your settings on this device — these are always on because the site can't work without them. We do not use analytics or advertising cookies unless you allow them: both are off by default, and you can change your choice anytime via Cookie settings in the footer.

  • Google Analytics (GA4) — used with Google Consent Mode. By default it runs in a cookieless mode that sets no analytics cookies and stores nothing that identifies you. It sets first-party cookies (such as _ga) to measure, in aggregate, how the site is used only once you allow analytics, and returns to the cookieless mode if you withdraw consent. Provided by Google; data may be processed outside the EEA under the EU Standard Contractual Clauses.
  • Google Ads — used with Google Consent Mode. It sets advertising cookies only once you allow advertising, to measure which ads lead to sign-ups and what a new user costs us. Until then no advertising cookies are set and no advertising signals are shared. Provided by Google; data may be processed outside the EEA under the EU Standard Contractual Clauses.
  • Meta Pixel — from Meta (Facebook/Instagram). It loads only after you allow advertising, and measures which of our Facebook/Instagram ads lead to sign-ups so we don't waste budget. Until then no Meta script loads and no advertising cookies are set. Data may be processed outside the EEA under the EU Standard Contractual Clauses.
  • Vercel Analytics — a cookieless, privacy-friendly count of page views and traffic. It sets no cookies, does not track you across sites, and does not collect data that identifies you, so it runs without a separate consent.

How long we keep it

We keep account and practice data while your account is active. If you delete your account, we remove your account and practice data, except records we must keep by law (for example, Paddle's transaction and tax records). Voice recordings are not retained by us after the understood-check returns its result.

Your rights

Under the GDPR you can request access to, correction of, or deletion of your personal data, object to or restrict certain processing, and receive a copy of your data in a portable format. Email [email protected]and we'll respond within the statutory time. You also have the right to complain to the Norwegian Data Protection Authority (Datatilsynet).

Changes

We'll update this policy as the Service grows; the "Last updated" date above reflects the current version.

Terms of ServicePrivacy PolicyRefund Policy[email protected]