provappen
Log in

Privacy Policy

2026-10-24

This policy explains how Provappen (provappen.se) processes your personal data. This English version is provided for information only; the Swedish version governs. The controller is Sava Labs Ltd, registered in England and Wales (Companies House no. 16124943), Unit 13 Freeland Park, Wareham Road, Lytchett Matravers, Poole BH16 6FA, United Kingdom. You can reach us at [email protected].

1. Data we process

  • Account: your email address and login history (one-time codes, no passwords).
  • Study activity: your answers, results, and progress in the Service.
  • Purchases: which plan you bought, the amount, and the time of purchase. Card details are handled by our payment provider and never reach us.
  • Technical data: data needed for operation and security, such as IP address and browser type in server logs.
  • Analytics and marketing: only with your consent via the cookie banner.
  • Visitor number and sign-up record: when you first open the site, we store a random visitor number in a cookie. It holds no personal details and lasts 24 hours, or one year if you accept analytics. When you create an account, we save that number in your account, together with how you reached us (the campaign or website you came from and the first page you opened). We do this even if you do not accept analytics.
  • Visit log and recordings (only with your consent to analytics): in our own system we keep a log of the pages you open and the buttons you press, with your visitor number, the page address, your language, a few small details about the action, and the time. When you sign in, we link your visitor number to your account. We also record sessions and heat maps (where you move the pointer, click, and scroll), marked with your visitor number and, after you sign in, your account number. A completed purchase is also reported to the analytics service from our side.
  • Ad measurement (only with your consent to marketing): ad click identifiers from the link you came through stay in your browser for up to 90 days. We report sign-ups and purchases from our side to advertising services.

2. Purposes and legal bases (GDPR)

  • Providing the Service and your account: contract (Art. 6(1)(b)).
  • Handling purchases and access: contract (Art. 6(1)(b)) and legal obligation for bookkeeping (Art. 6(1)(c)).
  • Responding to support requests: contract and legitimate interest (Art. 6(1)(b) and (f)).
  • Operations, troubleshooting, and security: legitimate interest (Art. 6(1)(f)).
  • Analytics and marketing, including the visit log and recordings: consent (Art. 6(1)(a)); you can withdraw it at any time in the cookie settings.

3. Recipients and storage

Your data is stored within the EU. We only share data with the categories of providers needed to run the Service: hosting (EU), payment processing, email delivery, and, with your consent, analytics and marketing services. Providers process data under data processing agreements. Where a provider processes data outside the EU/EEA, this happens under a valid transfer mechanism under GDPR, such as the European Commission's standard contractual clauses.

4. Retention

Account data and study activity are kept for as long as your account exists. You can request deletion of your account, at which point the data is deleted or anonymized. Purchase records are kept for as long as bookkeeping law requires. Server logs are deleted on a rolling basis. The log of page views and clicks is deleted after 13 months. The link between your visitor number and your account is deleted when your account is deleted.

5. Your rights

You have the right to access, rectification, erasure, restriction, data portability, and to object to processing based on legitimate interest. Write to [email protected]. You also have the right to complain to a supervisory authority; in Sweden this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, imy.se).

6. Cookies

Necessary cookies are used for login and core functionality. We also set a cookie with a random visitor number (see section 1); without your consent it lasts 24 hours. Analytics and marketing cookies are set only after consent in the cookie banner, where you can also see which services are involved and change your choice.

7. Changes

We may update this policy. Material changes will be announced on the site. The date above shows when the policy was last changed.