Privacy Policy for Testappen
Short summary
This summary is here to help you understand the policy quickly. The sections below are what applies.
- Lau Engineering AB decides how your personal data is used and is responsible for it.
- We collect what running the service needs: your email address, your account, your results and your purchases.
- Your data is stored in the EU. Some of our suppliers are companies outside it. See section 5.
- We use analytics cookies only if you say yes, and you can change your mind at any time.
- You can ask to see, correct or delete your data. Write to support@testappen.se.
- We never sell your data, and we never hand it to anyone to advertise to you.
1. Who is responsible for your data
| Controller | Lau Engineering AB |
|---|---|
| Company reg. no. (organisationsnummer) | 559212-3409 |
| Address | Kivra: 559212-3409, 106 31 Stockholm, Sweden |
| Email for anything about your data | support@testappen.se |
| Website | testappen.se |
2. What we collect, why, and for how long
| What | Why | Legal basis | How long we keep it |
|---|---|---|---|
| Email address, if you give us one to have your free mock result sent to you | To send you the result and a study plan, and offers and study tips if you also asked for those | Contract for the result you asked for, and consent for the marketing (Art. 6.1.b and 6.1.a) | Until you ask us to delete it. Unsubscribing does not delete it: we keep a record that you unsubscribed, so that we do not mail you again |
| Record of your marketing consent: the version of the wording and when you agreed | To be able to show that you agreed, and to what | Legal obligation and our legitimate interest in being able to prove consent (Art. 6.1.c and 6.1.f) | 3 years after the consent ends |
| Record that you unsubscribed: your email address, when you asked, and whether you used the link in the mail or the unsubscribe page | To make sure we never send you marketing again | Legal obligation, and our legitimate interest in honouring your request reliably (Art. 6.1.c and 6.1.f) | Kept indefinitely |
| Account: your email address, and the link we email you to sign in with | To give you an account, sign you in, and keep your results | Contract (Art. 6.1.b) | Until your account is deleted |
| Your acceptance of the terms: version, time, language | To show which terms your purchase was made under | Contract and legal obligation (Art. 6.1.b and 6.1.c) | 8 years |
| Practice and exam attempts: which mode, when, your score, your score per chapter | To show you your result and your progress | Contract (Art. 6.1.b) | Until your account is deleted |
| Which questions you were shown and what you answered | To show explanations, and to avoid giving you the same questions again | Contract (Art. 6.1.b) | Until your account is deleted |
| Purchases: which pass, the price, when it expires, and Stripe's reference for the payment | To give you access, and to keep our accounts | Contract and legal obligation, Bokföringslagen 7 kap. 2 § (Art. 6.1.b and 6.1.c) | 8 years after the end of the financial year |
| Withdrawal requests and complaints: your reference, email, language, what you had bought, and our handling note | To handle your request and show that we did | Contract and legal obligation (Art. 6.1.b and 6.1.c) | 8 years after the end of the financial year |
| Technical data: your IP address, your browser and device, which pages you asked for and when, and any error they caused | To deliver the site to you at all, to keep it secure, to stop abuse and fraud, and to find and fix faults | Our legitimate interest in running the service and keeping it secure (Art. 6.1.f) | Held in our suppliers' logs and in our own diagnostic logs, and kept only as long as the purpose needs. In practice that is months, not years |
| Abuse limits: a one-way code made from your IP address and browser so we can tell devices apart, your account identifier with the minute it was active, the date, how many requests and questions were served, and when you were last active | To prevent abuse of our service | Our legitimate interest in protecting the service (Art. 6.1.f) | As long as the limits need it. The device code is not your IP address and cannot be turned back into one |
| Usage counters: how many visitors reached a step, on which day, in which language | To see whether the site works | Our legitimate interest in running the service (Art. 6.1.f) | Indefinitely. These are counters only and identify nobody |
Stripe handles the payment itself. We never see or store your full card number.
We do not collect any special category data (health, religion, political opinion and so on). Please do not send us any.
3. Cookies and similar storage
3.1 Necessary, and not offered as a choice
These are needed to deliver what you asked for, and Swedish law (lagen om elektronisk kommunikation 9 kap. 28 §) allows them without consent. They are set by us and by the suppliers listed in section 4.
| What it is for | How long |
|---|---|
| Signing you in, and keeping you signed in | Up to 400 days |
| Remembering what you have chosen or entered, so you do not have to do it again | Up to 400 days |
Your browser's settings show you the exact cookies any site has set, including ours. If you would rather ask us, write to support@testappen.se and we will list them.
3.2 Analytics, only if you agree
If you accept analytics we load Google Analytics, which sets its own cookies to count visits. Until then it does not load and sets nothing.
You can change your mind at any time using the cookie link in the footer. If you say no, we remove the analytics cookies.
4. Who we share your data with
We use the suppliers below, and they may only use your data to do the job we give them. We never sell your data, and we never share it so that anyone can advertise to you.
Anything your browser connects to receives your IP address, because that is how a reply finds its way back to you. That applies to every supplier in this table that your browser reaches directly, and most of them record it for a while in their own logs. We send it deliberately in one case: Cloudflare is told the address alongside the bot check, because that is part of what the check weighs.
| Supplier | What they do for us | Where your data is stored | The company we contract with |
|---|---|---|---|
| Supabase | Database and sign-in | EU | Supabase Pte. Ltd, Singapore |
| Vercel | Runs the website | EU | Vercel Inc., USA |
| Stripe | Takes the payment | EU and the USA | Stripe Payments Europe, Limited, Ireland |
| Resend | Sends sign-in links and receipts | USA | Plus Five Five, Inc., trading as Resend, USA |
| Cloudflare | Bot check (Turnstile) | Worldwide network | Cloudflare, Inc., USA |
| Google Analytics | Counts visits, if you agreed to analytics | EU and the USA | Google Ireland Limited, Ireland |
Where a company sits and where your data sits are two different questions, and both matter. Your account and your results are stored in the EU. The company we contract with for that storage is Singaporean. Section 5 covers what protects that.
We also hand over data if the law requires it, for example to an authority or a court.
5. Data outside the EU and EEA
We store your data in the EU wherever we get to choose where it sits. That covers your account, your results and your purchases.
Where a supplier is outside the EEA, or sends data outside it, the transfer is covered by the European Commission's standard contractual clauses. Where a supplier is also certified under the EU-US Data Privacy Framework, that applies in addition.
Write to support@testappen.se if you want to know which of these covers a particular supplier, or to get a copy of the clauses themselves.
6. Your rights
You have the right to:
- see what data we hold about you, and get a copy,
- correct anything that is wrong,
- have your data deleted,
- restrict or object to how we use it,
- take your data with you in a common file format,
- withdraw a consent you gave, at any time. This does not affect what we did before you withdrew it.
How: write to support@testappen.se. Write from the address your account uses if you can. If you cannot, tell us which address the account uses. If we cannot tell that the request is yours, we will ask you for more before we act.
We answer within one month. It costs you nothing.
6.1 What survives a deletion
Deleting your account does not delete everything.
- Purchase records stay for 8 years. Swedish accounting law requires it, and Article 17.3.b of the GDPR allows us to refuse erasure for that reason. This is the record of the sale, not your results.
- Usage counters stay, because they are numbers that identify nobody and cannot be traced back to you.
7. If you are unhappy
Contact us first, at support@testappen.se. We would rather fix it.
You also have the right to complain to the Swedish authority for data protection:
| Authority | Integritetsskyddsmyndigheten (IMY) |
|---|---|
| Website | imy.se |
| Postal address | IMY, Box 8114, 104 20 Stockholm, Sweden |
8. Automatic decisions
We grade your practice exams automatically. That is the whole point of the service, and it has no legal effect on you. We do not profile you, and no decision about you is taken by a machine alone.
9. Children
You must be 18 to buy an access pass. If you are under 18, your guardian makes the purchase. We do not knowingly collect data from children on their own.
10. Changes to this policy
We may need to change this policy. If we change something that matters we tell you by email and on the site before it takes effect. The version and the date at the top always say which policy is in force.