Privacy Policy

1. Data Controller

Skrol is the data controller for the personal data you provide when using the Skrol app and website. Contact us at privacy@skrol.se for any privacy-related enquiries.

This policy explains how we collect, use, store, and share your personal data in accordance with the EU General Data Protection Regulation (GDPR, Regulation 2016/679) and the Swedish Lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning.

2. Data We Collect

Category	Examples	Legal Basis (GDPR Art. 6)
Account data	Email address, hashed password	Art. 6(1)(b) — contract
Learning progress	Lessons completed, vocabulary scores, streaks	Art. 6(1)(b) — contract
Payment data	Transaction reference, subscription status (card details held by Stripe, not Skrol)	Art. 6(1)(b) — contract
Technical data	IP address, device type, browser version, crash logs	Art. 6(1)(f) — legitimate interest (security & improvement)
Communications	Support emails you send us	Art. 6(1)(f) — legitimate interest (customer service)

We do not sell your personal data and we do not use it for advertising profiling.

3. How We Use Your Data

Provide and personalise the Skrol learning experience.
Process subscription payments via Stripe.
Send transactional emails (email confirmation, password reset, subscription receipts).
Improve app performance and fix bugs.
Comply with Swedish and EU legal obligations.

4. Third-Party Processors

We share your data only with trusted processors under GDPR-compliant Data Processing Agreements:

Stripe Payments Europe Ltd — payment processing (PCI-DSS certified, EU-based).
Microsoft Azure — cloud hosting and blob storage (EU data-centre region).
Google OAuth (optional) — if you choose to sign in with Google.

We do not transfer your personal data outside the EU/EEA without appropriate safeguards.

5. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we erase your personal data within 30 days, except where we are legally required to retain records (e.g. accounting records under bokföringslagen, SFS 1999:1078 — retained for 7 years).

6. Your Rights

Under the GDPR you have the following rights. To exercise any of them email privacy@skrol.se — we will respond within one month.

Access (registerutdrag) — request a copy of the data we hold about you.
Rectification (rättelse) — ask us to correct inaccurate data.
Erasure (radering) — ask us to delete your data ("right to be forgotten").
Restriction — ask us to pause processing while a dispute is resolved.
Data portability — receive your data in a machine-readable format.
Objection — object to processing based on legitimate interest.
Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.

7. Cookies & Local Storage

Skrol uses strictly necessary cookies to keep you signed in and remember your language preference. A session cookie is set by ASP.NET Core Identity for authentication. No third-party advertising or tracking cookies are used. You can clear cookies through your browser settings at any time.

8. Supervisory Authority

You have the right to lodge a complaint with the Swedish Data Protection Authority, Integritetsskyddsmyndigheten (IMY):

Website: www.imy.se
Phone: +46 8-657 61 00
Email: imy@imy.se

You may also contact the data protection authority in the EU member state where you reside or work.

9. Changes to This Policy

We will notify you of material changes by email or in-app notice at least 30 days before they take effect. The current version is always available in the app and on our website.