Privacy Policy

Who this policy covers

This policy explains how Svala Labs ("we", "us") collects and uses personal data when you use svalalabs.com and the Svala Labs product (the "Service"). Svala Labs is a Sweden-based hobby/side project, operated informally by its founder rather than through a registered company, and "Svala Labs" below refers to that operation. You can reach us at info@svalalabs.com for anything in this policy.

What data we collect

• Account data. Your email address (used to sign in via magic link or Google), and — if you sign in with Google — the basic profile info Google shares as part of that sign-in (typically your name).
• Job details you give us. The role, employer and start date you enter when creating a plan, used to build your personalised readiness plan.
• Preferences. Language, timezone, email frequency/send-time, and marketing-email consent (off by default, a separate opt-in, never pre-ticked).
• Product usage. The plans, sessions, quiz and flashcard results, glossary progress, and (if you use it) AI-tutor conversation history your account generates while using the Service — this is what lets the Service track your progress and adapt your plan.
• Technical data. Standard request/log data (IP address, browser) kept briefly for security and abuse prevention.
• "For Organizations" waitlist. If you join the waitlist on our organizations page, we collect your email, an optional company name, and the date you agreed to be contacted — used only to notify you when that offering launches, never for any other marketing purpose.

We do not currently offer CV/résumé upload. If that changes, this policy will be updated first, and any CV data would follow the retention rule described below.

Why we process it, and on what legal basis

• Creating your account and delivering your plan (account data, job details) — performance of a contract with you.
• Generating your plan content and AI tutor responses (job details, tutor conversation) — performance of a contract with you.
• Sending you marketing email (email address) — your consent, withdrawable at any time.
• Sending you plan/session reminder email (email address, plan progress) — performance of a contract with you.
• Keeping the Service secure and working (technical/log data) — our legitimate interest in running a secure, reliable service.
• Product analytics, once enabled (anonymised/aggregated usage) — our legitimate interest in understanding and improving the Service.

We never sell your personal data, and we never process the personal data of your colleagues or anyone else you mention — company pages describe companies, not people.

AI processing and disclosure

Parts of the Service (plan generation, the AI tutor, generated lesson content) are powered by a third-party AI model (Anthropic's Claude). Where you interact directly with an AI feature — like the tutor — this is disclosed to you at the point of use, and AI-generated content is labelled as such, in line with the EU AI Act's transparency requirements (Article 50). The job details and messages you provide to these features are sent to Anthropic solely to generate your response; Anthropic processes this data under its own data processing terms and does not use it to train its models by default for API customers.

Who we share data with

We use a small number of processors to run the Service, each only for the purpose described:

• Supabase (database, authentication, file storage) — hosted in the EU.
• Vercel (application hosting).
• Resend (sending transactional and marketing email).
• Anthropic (AI plan generation and tutor responses).
• Google (if you choose to sign in with Google — Google processes your sign-in data under its own privacy policy as part of that exchange).

Where a processor is based outside the EU/EEA, transfers rely on that provider's Standard Contractual Clauses or equivalent (e.g. the EU–US Data Privacy Framework where applicable). We keep a processor and transfer record in our internal compliance register, kept up to date as new providers are added (for example, a payments provider and a text-to-speech vendor are expected once those features go live).

How long we keep data

• Account and job details: kept while your account is active.
• Email delivery logs: kept for 12 months.
• Deleted accounts: fully purged (database and any stored files) within 30 days of deletion.
• If CV upload is introduced in future, uploaded CVs will auto-delete 90 days after the role's start date, or sooner on request.

Your rights

Under GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Erase your data ("right to be forgotten").
• Restrict or object to certain processing.
• Port your data to another service in a machine-readable format.
• Withdraw consent at any time, for anything based on consent (e.g. marketing email — one click unsubscribes you), without affecting the lawfulness of processing before withdrawal.

Self-serve account deletion and data export are being built into the product directly (Phase 13 of our build roadmap). Until that ships, email info@svalalabs.com and we'll handle the request by hand, without unreasonable delay. You can also lodge a complaint with the Swedish data protection authority, Integritetsskyddsmyndigheten (IMY), at imy.se, or with the data protection authority in your own EU/EEA country.

Cookies

The Service uses only strictly necessary cookies (keeping you signed in, carrying an in-progress signup through the login flow, crediting a referral). See our Cookie Notice for the full list. We don't run non-essential tracking cookies or ad pixels today; if that ever changes (for example, if we embed third-party video), we'll introduce a consent banner before it does.

Security

We apply access controls (row-level security on our database, service keys restricted to the server), encrypt data in transit, and restrict who can access production data. No system is perfectly secure, but we design for data minimisation and least-privilege access throughout.

Age

The Service is directed at adults entering the workforce. You must be at least 16 years old to use it.

Changes to this policy

We'll update the date at the top of this page when this policy changes, and for material changes we'll make a reasonable effort to notify you directly (e.g. by email).

Contact

Questions about this policy or your data: info@svalalabs.com.