When a school or school organiser uses LessonLearnt, the school organiser is the controller for the data about teachers and other users in the service. LessonLearnt AB is the processor and processes the data only on the school organiser’s instructions in the data processing agreement. Read more on the Agreements and security page.
LessonLearnt AB is itself the controller for the processing described below: requests via the website, the customer relationship, agreements and invoicing, support, security logs, bookkeeping and visitor statistics for the website.
What we process and why
This applies where LessonLearnt AB is the controller.
The contact form on the website
Data
Subject, name, email, school or organisation and role, and – if you fill them in – phone, number of teachers and message. We also store the language of the form and which button on the page opened it.
Purpose
To reply to and follow up your request.
Legal basis
Legitimate interest – being able to reply to those who contact us.
Retention
The request is deleted automatically when it is 24 months old. An email about the request is also sent to our inbox and kept there for as long as it is needed for the matter.
Get started and Free trial
Data
Get started: school or school organiser, organisation number, municipality, number of teachers, types of school, preferred start date, name, role, email, phone, invoice address, reference and choice of agreements. Free trial: name, email, school and number of teachers.
Purpose
To prepare a quote, start a free trial and send login details.
Legal basis
Legitimate interest – handling the school’s request.
Retention
These details are not stored in a database on the website. They are sent to us by email, and a copy is sent to you. The emails are kept for as long as they are needed for the matter. If the request leads to an agreement, the section on the customer relationship applies.
Customer relationship, agreements and invoicing
Data
Name, email, phone, role and organisation of the customer’s contact persons, and agreement and invoicing details.
Purpose
To enter into and perform agreements with the school or school organiser, to invoice and to manage the customer relationship.
Legal basis
Legitimate interest – being able to perform the agreement with the customer.
Retention
For as long as the agreement applies and thereafter for as long as it is needed for the purpose. Accounting records are kept as described under Bookkeeping.
Support
Data
Name, email and what you write to us.
Purpose
To help you when you use LessonLearnt.
Legal basis
Legitimate interest – being able to help our users.
Retention
Support requests sent via the contact form are deleted after 24 months, as above. Emails are kept for as long as they are needed for the matter.
Security and logs
Data
Events in the service, such as logins and denied attempts, with the time they occurred, and technical data in operational and security logs. To stop abuse of the forms, a hash of your IP address is kept briefly in the server’s memory; the IP address itself is never stored.
Purpose
To protect the service and the website against unauthorised access, abuse and errors.
Legal basis
Legitimate interest – keeping the service secure.
Retention
For as long as it is needed for the purpose.
Bookkeeping
Data
Invoices and other accounting records, with the names and contact details they contain.
Purpose
To comply with the Swedish Bookkeeping Act.
Legal basis
Legal obligation.
Retention
Seven years from the end of the calendar year in which the financial year ended, as required by the Swedish Bookkeeping Act.
Visitor statistics for the website
Data
Which page was viewed, where the visit came from in broad categories (for example direct, a search engine or social media), type of device (computer, mobile or tablet), country and a visitor code. The visitor code is calculated from the IP address and the browser together with a random value that is valid for one day and is then deleted. The IP address is not stored and no cookies are used.
Purpose
To understand how many people visit the website and which pages are used.
Legal basis
Legitimate interest – improving the website.
Retention
For as long as it is needed for the purpose.
No pupil data
LessonLearnt is designed to work entirely without pupil data. The service does not require any information about pupils, and we ask teachers not to enter any, such as pupils’ names. Follow-up is at class level.
Google Drive and OneDrive
When teachers add material to LessonLearnt, they can choose a file from Google Drive or OneDrive.
Only files you choose. For Google Drive, LessonLearnt requests the drive.file permission, which only gives access to the files you choose in Google’s file picker. For OneDrive, LessonLearnt requests the User.Read and Files.Read permissions; while the file picker is open, LessonLearnt shows the names of the files in your folders so that you can choose, and only the file you choose is retrieved.
Read, not stored. The file is retrieved directly to your browser. Word, PowerPoint and PDF files are read in the browser, and only the text is sent on so that the AI support can suggest tasks and timings. Images are sent to LessonLearnt’s server for text recognition. Neither the file nor its text is stored.
What is saved: the file’s name and a link to the original, together with LessonLearnt’s own short summary (title, type of material, short task descriptions and estimated time).
The permission stays in your browser. The access token from Google or Microsoft is kept only in the browser’s memory and disappears when the tab is closed or reloaded. It is never saved in the browser’s storage and never sent to LessonLearnt’s servers.
You can revoke LessonLearnt’s access at any time in your Google account under Third-party apps and services, or in your Microsoft account – for work and school accounts under My Apps, for personal accounts under Apps and services.
LessonLearnt’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. LessonLearnt does not use information from Google APIs for advertising or to develop or train general AI models.
AI support
Text that a teacher sends to the AI support is processed by a sub-processor in order to produce the answer. The educational features, such as planning and lesson suggestions, use Anthropic. Some features that read images and text, such as reading timetable images and text recognition, use other sub-processors in the list of sub-processors.
Before text is sent, LessonLearnt automatically tries to mask personal names, personal identity numbers, email addresses and words describing diagnoses. The masking may miss something, and images cannot be masked. So please do not enter any information about pupils.
Under its commercial terms, Anthropic does not use the data to train its AI models.
Recipients and sub-processors
For the service, we use the sub-processors in the list of sub-processors on the Agreements and security page.
The website is run on Lovable, which also provides the database and sends the emails from the forms. The website’s typeface is loaded from Google Fonts, which means that your browser sends your IP address to Google when the page is displayed.
Some sub-processors are located outside the EU/EEA, for example in the United States. Personal data is then transferred only with safeguards under Chapter V of the General Data Protection Regulation, for example a European Commission adequacy decision or standard contractual clauses.
Cookies and browser storage
The website sets no cookies and uses no tools for tracking or advertising. Two things may be saved in your browser’s local storage: that you have closed the suggestion to read in English, and – only on LessonLearnt’s own devices – that the device should not be counted in the visitor statistics.
The LessonLearnt app saves your login session, your settings and choices in the interface, and copies and drafts of your planning in the browser so that your work is not lost. It is not used for tracking or advertising. The app uses a cookie only briefly during some logins, to protect the login.
Your rights
You have the right to access your personal data and to have it rectified or erased. You also have the right to restriction of processing, to object to processing and to data portability. Contact us at support@lessonlearnt.se.
If the data concerns your school’s use of LessonLearnt, please contact your school organiser first. The school organiser is the controller, and we help them to answer.
If you think that we process your personal data incorrectly, you can lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se.
Changes
We update this policy when our processing changes. The date at the top shows when it was last updated.