Privacy policy

1. Controller

Addable Labs AB, registration number 559602-2615, VAT number SE559602261501, with its registered office in Eslöv, Sweden (“we” or “us”), is the controller for the processing of personal data described in this policy, unless stated otherwise below. Questions about the processing of personal data should be sent to support@fluentor.se.

Where an organisation uses the service, the organisation is the controller for the data it enters about its members, such as role, team and reporting line, and for the processing that takes place when its members submit assessments to it. We process that data on the organisation's behalf as processor under the data processing agreement (see section 8). The organisation is responsible for informing you of its processing. We are the controller for your sign-in, your display name and language preference, for your private account, for assessments you have not submitted to an organisation, and for billing data.

You sign in once with your email address and may have several accounts behind it: one in each organisation you belong to and a private account that belongs to no organisation. In an account in an organisation, the organisation decides over the data for which it is the controller, as set out above; no organisation has access to your private account. What you assess for yourself, in your private account or in a role you do not hold, is shown to you in each of your accounts and is not visible to any organisation unless you create a link to it. An organisation that invites you learns nothing about your other accounts.

2. Personal data we process

We process the following personal data:

• Your email address, which is used to sign you in and to send invitations and messages about the service, and the times at which you sign in.
• Your display name and language preference, if you provide them, and how often you wish to repeat your assessment.
• Your answers: the level from 1 to 5 you have chosen in each area, the version of the maturity model and the role the answers relate to, and when you completed and submitted the assessment.
• If you complete a self-assessment for your organisation without submitting it: whether you asked to be reminded about it later and on which day, and whether the reminder has stopped and why: because you asked not to be reminded again, because your membership of the organisation ended or because you completed it before the reminder was introduced. Only you can see this, and it is deleted together with the self-assessment.
• Your current level in each area, the history of changes to it, and any note you write when you raise a level.
• Next steps you choose, areas you mark as blocked and the reason you give, and which tips you have been offered and marked as done.
• If you use Guidance outside an organisation: when your trial period began and when it ends, including any extension we have granted.
• For each organisation you belong to: your membership and the information the organisation provides about you — your role, your team, your position in the organisation's reporting structure, and when the membership began or ended.
• Changes to your organisation's teams or reporting structure that wait for approval because they would let someone see more people's individual results, or place someone above more people: the change, who asked for it, who was asked to approve it and whether we emailed them, which members it would affect and how, whether it was approved, rejected, withdrawn or not made, and when. Only the person who asked for the change and the person asked to approve it can see it; others it concerns can download their own part of it.
• Requests to complete a new self-assessment that are sent to you within your organisation: the team the request concerns, whether it came from the owner or from the team's manager, the date to submit by, whether we emailed you about it, and whether you submitted a self-assessment in answer. Those who can see the request see only whether you submitted, not whether you completed a self-assessment and kept it private.
• Links to results that you create, and invitations sent to an email address.
• If we stop sending email to an address, whether or not it has an account, we keep a note of the reason (it could not be delivered, it was reported as spam, or invitations were declined) and the date, but not the address itself.
• For paying organisations: an organisation that pays by card gives its name, billing address and, if it chooses, its VAT number to our payment provider Stripe on Stripe's payment page. We give Stripe the email address of the organisation's owner for receipts and invoices, and change it when the owner changes. The card details go to Stripe and never reach us. We keep Stripe's customer number for the organisation, whether a card is saved and whether a payment is overdue, and for each charge the invoice number, amount and status.
• If you contact us through the contact form: your name, company, email address and message.
• If you report misuse: what you write, the address you give (if any), your account if you are signed in, and what the report is about, such as a link to a result or an organisation. If a report is about a link to your result, we keep which link and whose result it is with the report. Reports are kept for 12 months.
• If, before you can sign in, you ask to be told when the service opens, or accept an invitation before we have let your address in: your email address, the language you used and when you did so. The data is used to tell you when we let your address in, and you may at any time request its erasure by contacting us at the address given in section 1.
• If you have been granted access to the service before it is open to everyone: your email address, when access was granted and any note we make about it.
• Records of requests you make under Regulation (EU) 2016/679, the General Data Protection Regulation (“GDPR”), and, if you have created or own an organisation, the record that you accepted the terms and the data processing agreement on its behalf, with your email address.
• If your organisation's owner can no longer act for it, and a person entitled to represent the organisation asks us in writing to make another member the owner: the address the request came from, the organisation's registration number, the members concerned, the kind and date of the document that showed the person's authority, and a note of what we checked.
• When you visit the front page or these legal pages: the page, the site that linked to it, your approximate location (country and, where Vercel records it, region and city), the type of device, browser and operating system, and whether you pressed the button on the front page to get started. We count these with Vercel Web Analytics, without cookies and without storing anything on your device, and see only totals.
• Server and security logs, kept by us and our providers, which contain IP addresses and, in our own logs, which account made a request, what was asked and the answer, and audit records of actions taken on your account. To prevent abuse, we also store, for certain requests, a hashed value of the IP address, which is deleted on a rolling basis.
• For a phone registered for push notifications: the token the phone assigns so that Apple can deliver notifications to it, which of Apple's two server environments it belongs to, the app version and when we last received the token. At present only nivå's own staff can register a phone. The only notification sent informs them that an organisation has asked to take part in a preview. A token we have not received for 90 days is deleted. The reminders the nivå app shows are scheduled on the phone itself and are not sent through Apple.

3. What we do not process

We do not store passwords. Sign-in is by one-time link sent by email only, and the service is designed so that passwords cannot be stored.

We never receive or store card details. They are entered on Stripe's payment page and stay with Stripe.

We do not use cookies or similar technologies for analytics, advertising or tracking, and we do not sell personal data or disclose it for marketing purposes. We do not use your data to train AI models.

We do not ask for sensitive personal data (special categories of personal data under Article 9 GDPR). You should not enter such data in free-text fields, such as a note or a reason.

4. Purposes and legal bases

To provide the service to you — creating and managing your sign-in and accounts, storing and displaying your assessments and providing the organisation features — the legal basis is that the processing is necessary for the performance of our contract with you (Article 6(1)(b) GDPR).

To maintain the security of the service, prevent abuse and improve the service at an aggregate level, the legal basis is our legitimate interest in doing so (Article 6(1)(f)), balanced against your interests and fundamental rights.

To answer enquiries sent through the contact form and, if you have asked us to, to inform you when the service opens, the legal basis is our legitimate interest in answering you (Article 6(1)(f)). We send only the message you have asked for. To decide who may sign in before the service is open to everyone, the legal basis is that the processing is necessary for the performance of our contract with you or to take steps at your request before entering into one (Article 6(1)(b)).

To take payment for paid plans, by card through Stripe, the legal basis is that the processing is necessary for the performance of our contract with the organisation (Article 6(1)(b)) and, for the people who act for it, our legitimate interest in being paid (Article 6(1)(f)).

To comply with accounting and tax obligations relating to paid plans, the legal basis is compliance with a legal obligation (Article 6(1)(c)).

Where an organisation processes data about its members in the service, the organisation is the controller and determines the legal basis for its own processing. Consent is rarely an appropriate legal basis in an employment relationship.

5. Who can see your data

The following determines who can see your data:

• An assessment is a private draft until you submit it to the organisation. The organisation's owner chooses who sees submitted results: your managers, or nobody. The choice applies at once to every result, including those already submitted, and the owner may change it at any time. Where the owner has chosen your managers, once you have submitted an assessment, the managers above you and the owner see your level in each area and when you completed the assessment, as well as your earlier submitted assessments. The managers above you means the manager of the team to which you belong or, where you are the manager of that team, the manager of the team immediately above it, and the manager of every team above that one; if one of them is replaced, the new manager also sees your earlier submitted assessments. If you are the owner, nobody sees your results individually. Where the owner has chosen nobody, only you see your results. An assessment that has not been submitted is not visible to anyone else in the organisation.
• Where the owner has chosen your managers, they and the owner also see the next steps you have chosen from a submitted result, except those you have set aside, and the areas you have marked as blocked, including the reason you have given.
• Managers see aggregate results for the teams they are responsible for, and the owner for the whole organisation, such as averages per area and trends over time. Aggregate results show no individual answers beyond what is set out in this section. Where the owner has chosen that nobody sees results, no aggregate results are shown.
• The organisation's owner sees which members have submitted an assessment and when, and the managers above you see it for you. Where the owner has chosen that nobody sees results, they see only whether you have submitted, not when. If the organisation has access to the service's API, the owner may give other systems access to the member list — names, email addresses, roles, teams, dates and whether each member has submitted — and to the averages the owner sees, but never to individual answers or levels.
• Other members never see your individual levels. No setting can make them visible; the only way is a link that you create yourself. Beyond that, a member who is neither the owner nor the manager of a team sees no data about you, apart from your display name if you are the owner or a team's manager. The owner and the managers see your display name. If you have not set one, the owner sees your email address instead. The manager of your team or of any team above it sees it too.
• Averages are shown only to the owner and to managers, never to other members, and to nobody where the owner has chosen that nobody sees results. The owner and the managers above you always see the current average, even when the group is small. If yours are the only answers in an average, it shows your level. Knowing where the people they lead stand is part of their role. If the owner allows it, other managers can see the average for the team above their own and for the whole organisation. There, you are always part of a group of at least three people, and the average updates only once at least three people outside the manager's own teams have changed their answers.
• A link that you create makes that result readable by anyone who has the link, without signing in. A link expires after 90 days and may be revoked at any time. The organisation may turn off links, and the setting applies to the owner as well. While it is off, no new links can be created in the organisation's account, and links already created there stop opening, including a link to a result of your own that you made in that account. They open again if the organisation turns the setting back on, unless they have expired or been revoked. A link in your private account to a result of your own, outside any organisation, is not affected.
• An organisation sees only what belongs to your account in that organisation, under the rules above. Nothing you do in your private account, or in your account in another organisation, is visible to it, except your display name (which is the same in every account) and a result you have created a link to.
• Persons outside your organisation have no access to your data, except anyone who has a link you have created, the limited access our staff need for operations and support, and the processing by our processors set out in sections 6 and 7. Separation between organisations is enforced in the database by row-level access rules, not only in the application.

6. Where data is processed

Your answers and your account data are stored in the service's database with Supabase in the eu-north-1 region (Stockholm). The service's server functions run with Vercel in the arn1 region (Stockholm), and email is sent through Resend from the eu-west-1 region (Ireland).

Our providers are established outside the EU/EEA, and some data is processed in third countries: Supabase processes operational logs in Google Cloud and provides support from the United States; Vercel states that its primary processing facilities are in the United States; and Resend stores account data, metadata about emails sent, and logs in the United States. Transfers to Vercel and Resend take place on the basis of the European Commission's adequacy decision for the EU–US Data Privacy Framework and, should that decision cease to apply to them, on the basis of the Commission's standard contractual clauses, which both have agreed with us. Transfers to Supabase take place on the basis of the standard contractual clauses.

Card payments, invoices and receipts are handled by Stripe Payments Europe, Limited, Ireland. Stripe states that it may process data in any country where it does business, and transfers data to Stripe, LLC in the United States. Transfers to the United States take place on the basis of the European Commission's adequacy decision for the EU–US Data Privacy Framework, under which Stripe, LLC is certified, and, should that decision cease to apply, on the basis of the Commission's standard contractual clauses in Stripe's data processing agreement. A copy of the safeguards may be requested from support@fluentor.se.

Push notifications to the nivå app are delivered through the Apple Push Notification service by Apple, which for users in the EU/EEA is Apple Distribution International Limited, Ireland. Apple processes the data as an independent controller under its own privacy policy, including for any transfers outside the EU/EEA. Apple receives the device token and the text of the notification. At present only nivå's own staff can register a device for notifications. The text of a notification names the customer organisation and the module concerned and contains no personal data about the organisation's users.

7. Processors and other recipients

We use the following processors. To the extent that they process personal data that we process on behalf of an organisation, they are sub-processors under the data processing agreement.

Supabase, Vercel, Resend and Google each publish a list of the sub-processors they use themselves: supabase.com/legal/customer-resources/subprocessor-list, vercel.com/legal/sub-processors, resend.com/legal/subprocessors and workspace.google.com/terms/subprocessors.

Apple receives the data needed to deliver push notifications as set out in section 6, as an independent controller; it is not our processor and not a sub-processor under the data processing agreement.

• Supabase (Supabase Pte. Ltd., Singapore) — database and authentication. The database is located in Stockholm; operational logs are processed in Google Cloud, and support is provided from the United States.
• Vercel (Vercel Inc., United States) — application hosting and counting visits to the public pages. The server functions run in Stockholm; Vercel's primary processing facilities are in the United States.
• Cloudflare (Cloudflare, Inc., United States) — checking that a sign-in is made by a person (Turnstile). Everyone who opens or submits the sign-in form reaches Cloudflare, whether or not their address has been let in: the browser or the nivå app sends Cloudflare the IP address, technical details of the browser and the answer to a challenge. When the form is submitted, we send Cloudflare the resulting token and the IP address to check it. Cloudflare processes this in its network of data centres, which includes data centres outside the EU/EEA, on the basis of the EU–US Data Privacy Framework. Cloudflare also uses it as an independent controller to improve its detection of automated traffic. Cloudflare is not a sub-processor under the data processing agreement.
• Resend (Plus Five Five, Inc., United States) — delivery of sign-in links, invitations and messages about the service. Emails are sent from Ireland; account data, metadata about emails sent, and logs are stored in the United States.
• Google (Google Cloud EMEA Limited, Ireland) — our email. Google may process email outside the EU/EEA, under the safeguards in Google's data processing terms.
• Stripe (Stripe Payments Europe, Limited, Ireland) — card payments, invoices and receipts, for paying organisations only. Stripe processes the payment data on our behalf. For its own purposes, such as preventing fraud and meeting its legal obligations, including rules against money laundering, Stripe is an independent controller under its own privacy policy (stripe.com/privacy). Stripe is not a sub-processor under the data processing agreement.
• Our accounting system — for paying organisations only, and only for what their invoices from Stripe show.

8. Processing on behalf of organisations

Where we act as processor for an organisation, the processing is governed by the data processing agreement, which the organisation accepts when it is created in the service and whose later versions its owner accepts in the service. A signed copy of the agreement may be requested from support@fluentor.se.

9. Security and personal data breaches

Access to data is governed by row-level access rules in the database, designed so that a fault in the application cannot give access to another organisation's data. Submitted assessments cannot be altered, which is enforced in the database. Data is encrypted in transit and at rest, the keys in links and invitations are long random values, and the application sends security headers that prevent it from being embedded in other websites.

If a personal data breach occurs in processing for which we are the controller, we will notify the Swedish Authority for Privacy Protection (IMY) without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk to your rights and freedoms. If the breach is likely to result in a high risk to you, we will inform you without undue delay. Where your organisation is the controller, we notify the organisation, which decides on notification.

10. Retention

Your sign-in, your accounts and your profile are kept for as long as your sign-in exists. The same applies to your assessments, since the purpose of the service is to allow you to compare earlier results with new ones. If your account has not been used for two years, we delete it. We email you 30 days before, and keep the account if you sign in. If you have been a member of an organisation, we check first that nothing stands in the way.

You may request deletion from your profile page. Deletion covers your sign-in and every account behind it. If you have no account in an organisation, your sign-in is deleted immediately. If you have such an account, we examine the request and respond within one month, because each organisation is the controller for the assessments you have submitted to it. Deletion removes your sign-in and the data linked to it, including your profile, your assessments and answers, your next steps, the areas you have marked as blocked and your links. What remains is the record of your request, which is kept as set out below.

If the organisation's owner ends your membership, your results are removed from the organisation's averages and you lose access to the organisation. The assessments you have submitted to the organisation are, however, retained and become visible again if the membership is reactivated; they are deleted when your sign-in is deleted. If the organisation is removed, your assessments remain with you, in your private account, no longer connected to it.

In addition, the following retention periods apply:

• The dates of a trial period of Guidance are kept for as long as your account exists.
• A notification token is deleted 90 days after we last received it.
• An invitation is valid for 14 days. An invitation that has not been accepted is deleted 30 days after it expired, and an accepted invitation 90 days after it was accepted.
• A link to a result is valid for 90 days and is deleted 90 days after it expired or was revoked.
• A request to complete a self-assessment is deleted 3 months after its date to submit by.
• A record of a change to the teams or reporting structure that waited for approval is deleted 12 months after the change was approved, rejected, withdrawn or not made.
• Enquiries sent through the contact form and requests to be told when the service opens are deleted after 12 months. An address on the list because its invitation was accepted is deleted earlier if the organisation withdraws the invitation.
• The record that an email address has been granted access before the service opens is kept for as long as that address may sign in, and is deleted when the sign-in is deleted.
• The database is backed up daily and a backup is kept for seven days. What you delete is therefore gone from our backups at the latest seven days later.
• Records of requests under the GDPR are kept for three years from the decision.
• If an email to an address could not be delivered and the error was permanent, or its recipient reported our email as spam, we send that address no more invitations or other messages from the service. Sign-in links are still sent. The record of the stop is kept until we lift it.
• If you stop an organisation's invitations to your address, the record is kept for as long as the stop applies and is deleted when we lift it. After that the organisation can invite you again.
• The record that an organisation accepted the terms and the data processing agreement is kept for as long as it is needed as evidence of the agreement. The email address of the person who accepted is removed after 12 months, or earlier if that person's sign-in is deleted.
• The record that we changed an organisation's owner is kept for 3 years after the change. The address the request came from is removed after 12 months.
• Stripe's customer number for an organisation is kept for as long as the organisation exists. When the organisation is removed, we delete it at Stripe as well, so no card stays saved; Stripe keeps what the law requires it to keep, under its own privacy policy.
• The messages Stripe sends us about payments are kept for 90 days.
• Accounting records are kept for as long as the Swedish Bookkeeping Act (1999:1078) requires, currently until the end of the seventh year after the end of the calendar year in which the financial year ended.
• Vercel discards the value that tells one visit to the public pages from another after 24 hours. The totals are available to us for 12 months, and Vercel may keep them longer.
• Our own server and security logs are kept for at most 90 days. Our providers keep theirs for a limited period in accordance with their terms.
• Audit records of actions taken on your account are kept for as long as the action has effect or is needed as evidence of it.

11. Your rights

Under the GDPR you have the right to request access to your personal data, rectification, erasure and restriction of processing, and to receive your data in a structured, machine-readable format (data portability). Much of this you can do yourself in the service. Otherwise you may write to support@fluentor.se; we will respond to your request within one month. Where your organisation is the controller, you may also contact the organisation directly.

Right to object. Where we process your personal data on the basis of our legitimate interest (Article 6(1)(f)), you have the right to object at any time, on grounds relating to your particular situation. We will then stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is for the establishment, exercise or defence of legal claims.

Providing your email address is a condition for signing in; without it we cannot provide the service. You are not obliged to provide any data to us, but without the answers you give in an assessment the service cannot show a result. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22).

If you consider that we process your personal data in breach of the GDPR, you have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), Box 8114, 104 20 Stockholm, imy@imy.se, or with the supervisory authority in the country where you live or work.

12. Cookies and local storage

The service uses only cookies that are necessary to provide the service you have requested: cookies that keep you signed in, a cookie that holds your sign-in request for ten minutes so that the sign-in link returns you to where you started, and a cookie that remembers the language you have chosen. They are not used for analytics, advertising or profiling, and your consent is therefore not required (Chapter 9, Section 28 of the Swedish Electronic Communications Act (2022:482)). Your choices of theme and navigation layout are stored in your browser's local storage and are not sent to us. The nivå app keeps a copy of your most recent data on your device so that it opens quickly; the copy is deleted when you sign out. If your organisation pays by card, Stripe's payment page, on Stripe's own website, sets Stripe's cookies, including one used to prevent fraud; Stripe's privacy policy covers them. Visits to the public pages are counted without cookies; see section 2.

13. Changes to this policy

We update this policy when the service or the processing changes. The date at the top of the page shows the version currently in force. Material changes to how we process your personal data are published here before they take effect, together with the date from which they apply.