Norsk-Enkelt is owned and operated by Heorhii Terziohlo, a private individual and the data controller. For support, access, rectification and erasure requests, contact support@norsk-enkelt.com.
Last updated: 26.09.2026
Version: 26.09.2026
This Privacy Policy describes what personal data Norsk-Enkelt processes, for what purposes it is used, to whom it may be disclosed, how long it is retained, and what rights the user has.
The Policy applies to the Norsk-Enkelt platform available at norsk-enkelt.org, including the user account, learning materials, AI features, payments, messages, and related services.
Data processing is carried out in accordance with the GDPR, Norwegian personal data legislation, and other applicable rules.
1. Data Controller
The controller of personal data is the administration of the Norsk-Enkelt project.
You can contact the controller regarding personal data matters through the contact page:
https://norsk-enkelt.org/contacts
The current contact email is published on the contact page.
After the organization or sole proprietorship is registered, the controller information will be supplemented with the actual legal name and registration details.
2. Age of Users
Independent registration and use of an account are permitted only for persons who have reached the age of 18.
During registration, the user provides their date of birth and confirms that they are of legal age. This information is used to verify compliance with the age restriction and to protect the platform from unlawful registration.
Norsk-Enkelt is not intended for independent use by children. If the controller becomes aware that a minor has registered an account in violation of the rules, the account may be restricted and the related data may be deleted in accordance with applicable law.
3. What Data Is Processed
3.1. Account Data
name;
email;
phone number, if the user provided it voluntarily;
profile image;
preferred language;
date of birth;
date of age confirmation;
password in hashed form;
role and access rights;
date of email confirmation;
dates of acceptance of the Terms and the Privacy Policy;
settings for receiving informational and marketing messages.
Norsk-Enkelt does not store the password in plain text.
3.2. Security Data
information about two-step login verification;
encrypted authenticator app secret;
encrypted backup codes;
one-time confirmation codes in protected form;
login dates and last activity;
information about login attempts and exceeded request limits.
3.3. Learning Data
selected courses and lessons;
learning progress;
completed exercises;
answers and grading results;
saved words;
assigned individual lessons;
AI test results;
assessments, recommendations, and corrections;
information about completion of assignments and courses.
3.4. AI Data
requests to the AI assistant;
AI responses;
part of the AI dialogue history;
related learning context;
learning level;
answers to written assignments;
AI review results;
technical information about the AI model used;
number of processed tokens and estimated request cost;
AI request execution status and technical errors.
3.5. Communications
messages in discussions and learning chats;
requests sent through the contact form;
correspondence with support;
reviews and comments;
newsletter subscription settings;
information about sent system notifications.
3.6. Payments and Subscriptions
selected plan;
subscription status;
subscription period;
whether automatic renewal is enabled;
one-time purchases;
payment amount and currency;
transaction status;
payment date;
technical Stripe identifiers;
links to receipts or invoices, if provided by Stripe;
information about refunds or payment disputes.
Norsk-Enkelt does not receive or store the full bank card number, CVC code, or other full card details.
3.7. Technical Data
IP address;
browser and device type;
user-agent;
interface language;
session data;
cookies;
date and time of actions;
viewed pages;
error logs;
data necessary to protect against abuse.
3.8. Uploaded Materials
Administrators, teachers, and other authorized users may upload images, documents, and learning materials. Such files may contain personal data if the user independently included it in the file.
4. Data Sources
Norsk-Enkelt receives most data directly from the user during registration, profile completion, exercise completion, AI use, message sending, and payment.
Some technical and payment data is received automatically from the browser, server, Stripe, email service, AI provider, and other suppliers that ensure the operation of the platform.
5. Purposes and Legal Bases for Processing
5.1. Registration and Account Operation
Account data is processed to create the account, enable login, confirm email, save settings, and provide platform functions.
Legal basis: performance of a contract with the user.
5.2. Provision of Learning Features
Learning progress, answers, results, and saved words are processed to provide courses, lessons, exercises, knowledge assessment, and display learning history.
Legal basis: performance of a contract with the user.
5.3. AI Features
Requests, responses, and learning context are processed to provide the AI assistant, AI tests, written work review, task creation, and translation of learning materials.
The legal basis is usually the performance of the function requested by the user. For optional analytics, model training, or other independent purposes, a separate legal basis is determined and, where required, separate consent is requested.
5.4. Payments and Subscriptions
Payment data is processed to complete a purchase, activate access, renew a subscription, send confirmation, issue refunds, and handle payment disputes.
Legal bases: performance of a contract and compliance with legal obligations.
5.5. Security
IP addresses, activity logs, login data, and request limits are used to protect accounts, prevent fraud, detect attacks, and investigate violations.
Legal basis: the legitimate interest of the controller and users in ensuring platform security.
5.6. Support and Requests
Contact messages and correspondence are used to answer questions, resolve technical issues, handle complaints, and fulfill user requests.
Legal bases: performance of a contract, taking steps at the user’s request, and legitimate interest in supporting the service.
5.7. Legal and Accounting Obligations
Some payment, contractual, and registration data may be retained for accounting, tax obligations, transaction confirmation, dispute resolution, and compliance with requests from public authorities.
Legal basis: compliance with a legal obligation and defense of legal claims.
5.8. Marketing Messages
Marketing and informational mailings are sent only where there is an applicable legal basis.
The user may opt out of marketing messages through the link in the email or in account settings. Opting out of marketing does not affect mandatory system messages about the account, security, payment, or access.
6. Use of Artificial Intelligence
Norsk-Enkelt uses an external AI provider to generate responses, review written work, conduct AI tests, translate, and create learning materials.
As of the policy update date, the platform technically supports connection of a configurable AI provider. Current information about the provider in use can be requested through the contact page.
To fulfill a specific request, the following may be transferred to the AI provider:
the text of the user’s request;
the response or written work;
learning level;
the content of the relevant lesson or exercise;
a limited part of the dialogue history;
technical instructions for generating the response.
Norsk-Enkelt does not use AI dialogues for independent training of its own AI model.
The terms of data use by the external AI provider depend on the contract, settings, and policy of the relevant supplier. The controller must choose settings that limit the use of user data to the purposes necessary to provide the function.
The user must not send through AI:
passport data;
full bank details;
medical information;
children’s data;
passwords and access codes;
confidential documents;
other sensitive information.
AI dialogues and results may be accessible to authorized administrators or teachers only to the extent necessary for support, security, quality control, and the learning process.
7. Automated Decisions
AI may automatically review exercises, analyze written responses, determine an approximate level, and generate learning recommendations.
Such results are intended for learning assistance and are not an official exam grade.
AI does not, without the involvement of an authorized person, make decisions on charging funds, refunding a payment, blocking an account, or other actions producing legal or similarly significant effects.
If the platform introduces such automated processing, the user will be informed in advance about its logic, significance, possible consequences, and available means of contesting it.
8. Stripe and Payments
Payments may be processed through Stripe. During payment, the user may be redirected to a Stripe page or use a secure Stripe payment form.
Stripe independently processes payment details in accordance with its own privacy policy.
Norsk-Enkelt receives only the data necessary to confirm the transaction and manage access, including payment status, amount, currency, date, technical identifiers, refund information, and links to receipts or invoices.
9. Cookies and Local Storage
The platform may use cookies and browser local storage.
9.1. Required Cookies
They are used for:
logging into the account;
form protection;
session retention;
saving the selected language;
security;
operation of the core platform functions.
Without required cookies, some site functions may not work.
9.2. Analytics and Optional Cookies
Analytics, advertising, and other optional cookies are used only where there is an appropriate legal basis and, where required, after obtaining consent.
The user may change their choice through cookie settings. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
10. To Whom Data Is Disclosed
Data may be disclosed only to the extent necessary for a specific purpose to the following categories of recipients:
hosting and server infrastructure provider;
email service;
Stripe and related payment organizations;
AI provider;
providers of logging, backup, analytics, and protection services;
teachers and authorized administrators;
professional advisers, if necessary for legal or accounting assistance;
public authorities, if disclosure is required by law.
Suppliers processing data on behalf of Norsk-Enkelt must use it only under documented instructions and ensure appropriate protection.
Norsk-Enkelt does not sell users’ personal data.
11. Transfer of Data Outside the EEA
Some suppliers, including Stripe, the AI provider, email and technical services, may process data outside the European Economic Area.
Such transfer is carried out only where there is a GDPR-approved mechanism, for example:
an adequacy decision;
standard contractual clauses;
another applicable lawful basis.
Information about the specific transfer mechanism can be requested through the contact page.
12. Retention Periods
12.1. Account
Account data is retained while the account exists and the data is necessary to provide the service.
12.2. Date of Birth
Date of birth and age confirmation are retained together with the account to confirm compliance with the age restriction and resolve possible disputes.
12.3. Learning Progress
Progress, completed exercises, test results, and saved words are retained while the account exists or until the user requests deletion of the relevant data, if deletion is technically and legally possible.
12.4. AI Dialogues
AI dialogues and results are retained to display history and continue learning. The user may delete available history or request deletion through the personal data request page.
12.5. Discussions and Messages
Messages may be retained while the relevant discussion exists. Upon account deletion, messages may be deleted, anonymized, or retained if necessary for the integrity of the discussion, security, or protection of the rights of other users.
12.6. Payments
Payment and accounting records are retained for the period established by applicable accounting, tax, and consumer protection laws.
12.7. Contact Requests
Requests are retained until review is completed and for an additional period necessary for repeat requests, dispute resolution, and defense of legal claims.
12.8. Technical Logs
IP addresses, error logs, and security data are retained for the minimum period necessary for diagnostics, abuse prevention, and incident investigation.
12.9. Backups
Deleted data may be temporarily retained in backups until the established backup rotation cycle is completed. Such data is not used for normal platform operation and is deleted during scheduled backup replacement.
12.10. Exceptions
After account deletion, certain data may be retained if necessary for:
compliance with a legal obligation;
accounting and tax records;
fraud prevention;
handling a payment dispute;
defense of legal claims;
ensuring security.
13. Security
The platform applies organizational and technical protection measures, including:
password hashing;
encryption of two-step verification secrets;
role and access rights separation;
email confirmation;
CSRF protection;
request rate limiting;
access control to the administrative panel;
file upload restrictions;
Stripe webhook verification;
logging of errors and security events;
backup and software updates.
No internet service can guarantee absolute security. The user must also use a strong password, not share access codes, and enable two-step verification.
14. User Rights
Depending on the circumstances, the user may have the right to:
receive information about data processing;
access their data;
receive a copy of the data;
correct inaccurate information;
complete incomplete information;
request deletion of data;
restrict processing;
object to processing based on legitimate interest;
receive data in a portable format;
withdraw consent;
contest an applicable automated decision;
lodge a complaint with a supervisory authority.
Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
Some rights may be limited if the data must be retained to comply with a legal obligation, for accounting, security, or defense of legal claims.
15. How to Submit a Request
A request may be sent:
through the personal data request page in the account;
through the contact page;
to the contact email published on the website.
To protect data, the controller may ask the user to confirm their identity.
A response is provided within the time limits established by applicable law. If the request is complex or includes a large volume of data, the period may be extended with prior notice to the user.
16. Account Deletion
The user may request deletion of the account and related personal data.
Before deletion, the controller may:
verify the identity of the applicant;
complete active payment transactions;
retain information that must be kept by law;
anonymize data necessary for statistics or the integrity of discussions.
Account deletion may result in irreversible loss of learning progress, AI history, exercise results, and access to materials.
17. Marketing Messages
The user may separately consent to receive news, offers, and other marketing messages.
You can opt out of such messages:
through the link in the email;
in profile settings;
through the contact page.
After opting out, the platform will continue sending mandatory messages related to security, email confirmation, payments, subscription, and material changes to the service.
18. Complaints
For questions regarding the processing of personal data, the user may contact the Norsk-Enkelt administration through the contact page.
If the user believes that their rights have been violated, they may lodge a complaint with Datatilsynet or another competent supervisory authority.
Datatilsynet:
https://www.datatilsynet.no/
19. Changes to the Privacy Policy
The Policy may be updated when platform features, suppliers, legislation, or data processing procedures change.
The new version is published with an updated date. In the event of material changes, the user may be shown a separate notice or asked to confirm that they have reviewed the new version.
If consent is required for a new processing purpose, it is requested separately. Continued use of the platform in itself is not considered consent in cases where the law requires active voluntary action.
20. Contacts
Platform: Norsk-Enkelt
Domain: https://norsk-enkelt.org/
Contact page: https://norsk-enkelt.org/contacts
This Privacy Policy enters into force on 26.09.2026 and remains valid until a new version is published.
Mobile app: data on your device
This supplement dated 21 October 2026 applies to the Norsk-Enkelt Android and iOS app alongside the website privacy policy.
- Your sign-in token is kept in secure device storage. The app does not save your password in its settings or cache. Passwords and verification codes are sent to the server over HTTPS for authentication.
- Loaded profile details, subscription information, learning and test history, courses, lessons, exercises and search results may be cached on your device for up to 7 days. Cached responses are separated by account and language and may be evicted sooner. Cached responses, saved words and your daily goal are encrypted using AES-256-GCM. The key is stored separately in secure storage on this device and removed on sign-out. Public images use a separate cache; profile photos are kept in app memory only. Protect your device with a screen lock.
- Saved words, language, theme and daily goal are stored locally. Saved words and the daily goal do not sync between devices. Images are cached separately by the app.
- Clear cache removes cached responses and images but keeps saved words, settings and your session. Signing out removes the saved token, cache, saved words and daily goal; language and theme remain. The app reports errors if it cannot remove some data.
- Clearing the cache, signing out or uninstalling the app does not delete your account, server history or subscription, or cancel auto-renewal. Request account and associated data deletion using the personal data request form or submit a request from Personal data and account deletion in the app, or email support@norsk-enkelt.com. Identity verification may be required. Records may be retained where there is a legal basis, for example to meet legal obligations or handle disputes.
- Authentication, downloading materials, saving progress and checking answers require internet access. The server receives requests, your authorization token, selected language, submitted data and technical connection information. Website cookie rules also apply when you open the website from the app.
- An audio button is shown for words and examples with a saved recording. Tapping it loads the recording from the server or its file storage. Audio is not downloaded in advance for offline use. Playback does not require microphone access.