Privacy
Privacy notice
How Norriteo handles personal data. Updated 2026-11-02. The Swedish text applies.
The short version (for students 13–17 and everyone else)
- We only collect what Norriteo needs to work: your email, a nickname, your grade and what you study.
- We never sell your data, show you ads on study pages or track you for marketing.
- Your parent may see your progress, depending on what you chose. Under 13, your parent sees everything.
- Your data is stored in the EU. You can download it or delete your account any time under Settings.
- Questions? Write to [email protected]. You can also complain to IMY, the Swedish privacy authority.
Who is responsible
SCKY Partners AB (org.nr 559362-5865, Kungstensgatan 29, 113 57 Stockholm) is the controller for the personal data in Norriteo. Contact: [email protected]. We answer in Swedish or English.
What we store, and why
Account: email address, password (only as a hash we cannot read) or the id of your Google or Facebook account if you sign in that way, nickname, parent/student/teacher, grade, county (län), language. Why: to run your account under our terms (contract).
Studying: answers, mistakes, progress, points, streak, topics marked done, study plan, and written answers sent for feedback. Why: this is the service (contract). Practice adapts to what you got right or wrong; we never use it for marketing.
Family links: which parent is linked to which student and the sharing level the student chose. Why: contract.
Protection logs: which lesson pages and answers an account opened, sign-ins, and a mark on printed and shown pages (nickname · #number · date, never your real name). Why: to stop our material being copied and accounts being shared (legitimate interest).
Messages and reports you send us. When you explain an error in a report, our AI service in the EU may make a short summary of what is wrong with the exercise (without your details), so we can check and fix it. Why: to answer and to fix errors (legitimate interest).
Confirmations: when you accepted the terms, confirmed your age or your guardianship, and which text version. Why: we must be able to show it (legal obligation).
News emails and the Sunday brief: your email address, only if you said yes and confirmed. Why: consent, which you can withdraw any time.
Payments (when they open): plan, price, dates and the payment provider's reference — never your full card number. Why: contract and the Swedish Accounting Act.
We never ask for personal identity numbers (personnummer), school logins, school grades or photos of children.
Children
You need to be 13 to have your own account. A child under 13 can only use Norriteo through an account their parent or guardian creates and manages; the parent sees everything the child does and confirms being the guardian. Children under 13 answer in text only (no photos or voice), never use the forum or groups and cannot change their privacy settings.
A parent always pays. From 13 a student chooses what a linked parent may see (everything, progress only, or nothing) and can change it on their dashboard.
Norri, Teo and AI feedback
Norri and Teo are AI study coaches, not people. Feedback on written and oral answers (Premium) is produced by AI. The answer is sent without your name or nickname to our AI provider, which processes it within the EU and does not keep it or train on it. The feedback is an estimate for practice, never a grade. Our team checks some results to keep quality high, without seeing who wrote them. Photos are deleted after 7 days; voice recordings right after assessment. My own material (Standard Plus): the study pages you upload (a PDF or photos) are sent the same way to make your set; they are not used after 24 hours and are deleted at the latest 36 hours after upload. The set made from them stays until you delete it or the account.
Where your data is, and who helps us
We keep your data in the EU and choose providers who process it there. They act only on our instructions under a data processing agreement:
• Server and database: Vultr, data centre in Stockholm, Sweden. • Network protection, and storage of videos and encrypted backups: Cloudflare, EU storage. • Email: Resend (US company): sent from EU servers, stored in the USA. • AI feedback (Premium) and short summaries of error reports: Google Cloud (Vertex AI), EU regions only. • Sign-in with Google or Facebook: only if you choose it. We ask Google only for your email address (no name or photo); Google then knows you signed in to Norriteo.
Some of these companies have a parent company in the USA, and email data is stored there. Data that reaches the USA is protected by the EU–US Data Privacy Framework or the EU's standard contractual clauses. Fonts are served from our own server, so your visit does not reach Google.
How long we keep it
• Account and study records: until you delete the account. • Free accounts nobody signs in to for 12 months: deleted, after emails at 6, 9 and 11 months. • Detailed protection logs: 90 days, then daily counts for 12 months. • Feedback photos: 7 days; voice: deleted right after assessment. • Uploaded study pages (My own material): not used after 24 hours, deleted within 36 hours. • Unconfirmed Sunday-brief sign-ups: 7 days. • Reports and messages: 12 months after we handled them. • Payment records: 7 years (Accounting Act). • Backups: 7 days on the server, encrypted copies 30 days (monthly copies 6 months) — so deleted data is gone from every backup within 6 months.
Your rights
You can see, correct and download your data (Settings → Download my data), delete your account (Settings → Delete account), object to processing based on legitimate interest, ask us to restrict processing, and withdraw consent (Settings, or the link in every news email). We answer within one month.
You can complain to Integritetsskyddsmyndigheten (IMY), imy.se.
Security
Encrypted connections, hashed passwords, up to 3 devices signed in at a time, limited staff access, and encrypted off-site backups. If a breach puts your data at risk we report it to IMY within 72 hours and tell you when the law requires it.