Privacy Policy
Last updated: 2026-10-18
This policy describes how Alfa Kennsla ehf., reg. no. 481225-1320 (“Alfa”, “we”, “us”), collects and processes personal data for individual subscribers of the Alfa mobile app.
For individual subscribers, Alfa is the Controller of your personal data under the EU General Data Protection Regulation (GDPR) and Icelandic Act No. 90/2018 on Data Protection and the Processing of Personal Data.
1. Data we collect
Account and identity
- Name and email address (from Google Sign-In, Sign in with Apple, or email registration)
- Account ID (UUID)
- Authentication tokens: a refresh token encrypted in your device’s secure storage, and a short-lived access token kept in memory only
Subscription and billing
- Subscription customer identifier (linked to your account ID)
- Subscription product, status, period, and auto-renewal flag, received from Apple App Store or Google Play
- Alfa does not see or store payment card details. Payment is processed by Apple or Google.
Educational data
- Placement test results: grade, your self-assessment of concepts, and your answers in the placement test
- Your learning path: active and completed paths, daily progress, and which exercises and finals you complete
- Your answers to exercises and finals (correct or incorrect) and the time spent on each exercise
- Your mastery per concept, computed from the number of correct and incorrect answers
- In-app activity: daily usage, streak, and last practice date
Problems you star are stored only on your device and are not sent to us.
Technical data
- Device type, OS version, app version
- IP address (transient, used for security and connection)
- Error and crash reports
- Push notification device token (if you enable notifications)
Product analytics
- In-app events such as screen views, feature usage, and subscription flow (via an EU-hosted analytics service)
Weekly parent summary (optional)
- A parent or guardian email address that you enter yourself in the app settings (empty by default)
Subscribers may opt in to have a weekly summary of the student’s progress (number of exercises, time, mastery per concept, and streak) sent to this address. The summary is delivered via our transactional email provider (EU-hosted). You can turn this off at any time in the app settings, and the recipient can unsubscribe via a link in every email.
2. Purpose and legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the service (account, learning path, exercises, and progress) | Contract performance, Art. 6(1)(b) |
| Subscription billing and receipt of payment | Contract performance and accounting law, Art. 6(1)(b), (c) |
| Authentication and security | Legitimate interests, Art. 6(1)(f) |
| Product analytics and improvement | Legitimate interests, Art. 6(1)(f) (opt-out available) |
| Error and crash reporting | Legitimate interests, Art. 6(1)(f) |
| Transactional email (receipts, password reset) | Contract performance, Art. 6(1)(b) |
| Weekly parent summary (if enabled) | Consent, Art. 6(1)(a) (withdrawable) |
3. Sub-processors
The following categories of sub-processors are engaged to deliver the service:
| Category | Location |
|---|---|
| Cloud database, file storage, and authentication | EU |
| Backend API hosting | EU |
| Logging, observability, product analytics, and error tracking | EU |
| Subscription billing and payment processing (Apple App Store, Google Play) | Global |
| Identity providers (Sign in with Google, Sign in with Apple) | United States (EU–U.S. Data Privacy Framework) |
| Transactional email | EU |
| Push notifications | United States (EU–U.S. Data Privacy Framework) |
A complete list of named sub-processors is available from Alfa on request. We do not sell your personal data to third parties.
4. Grading and computation
- Exercises and teaching content are authored in advance.
- Answer checking is rule-based: your answer is compared against a predefined correct answer.
- Your mastery and progress are computed from the number of correct and incorrect answers.
- The learning content is intended as a study aid and may contain errors. It is not a substitute for a teacher.
5. International transfers
Some sub-processors are based in the United States, including those used for sign-in and push notifications. Transfers to these providers are made under the EU–U.S. Data Privacy Framework, recognised by an adequacy decision of the European Commission.
6. Retention
| Data | Retention |
|---|---|
| Account | While your account is active. Deleted 30 days after you initiate account deletion (grace period); permanently deleted afterwards. |
| Educational data (placement, learning path, exercises, mastery, and activity) | While your account is active; deleted with the account |
| Subscription and accounting records | Up to 7 years after the transaction, as required by Icelandic accounting law (Act No. 145/1994) |
| Authentication tokens | Until you log out, revoke, or rotate |
| Error and audit logs | Up to 12 months |
| Push notification tokens | Until you disable notifications or uninstall the app |
When you delete your account, financial and accounting records are anonymised but retained for the statutory accounting period. Other personal data is permanently deleted within 30 days after the grace period ends.
7. Your rights
Under GDPR, you have the right to:
- Access your personal data
- Rectify inaccurate data
- Erasure (“right to be forgotten”)
- Restrict processing
- Data portability
- Object to processing
- Withdraw consent where processing is based on consent
To exercise any of these rights, contact us at alfa@alfakennsla.is.
You may also lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd): personuvernd.is.
8. Marketing, tracking, and opt-out
- Product analytics: We measure in-app behaviour to understand usage and improve features. You can opt out in the app settings.
- Ad networks: We share no information about you or your child with ad networks such as Meta or Google. We measure ad results only from aggregate numbers from the App Store and Google Play.
- Error tracking: We send error events that include your account ID and email. This is operationally necessary and not used for marketing.
- We do not sell your personal data.
9. Security
- All communications encrypted with HTTPS/TLS
- Sensitive credentials encrypted at rest (AES-256-GCM)
- Row-Level Security on the database as defence in depth
- Role-based access control for staff accessing production systems
- Regular security monitoring, audit logging, and backups
10. Changes to this policy
Alfa may update this policy. Material changes will be communicated at least 30 days in advance through the app or by email. The latest version is always available on this page.
11. Contact
Alfa Kennsla ehf.
Reg. no. 481225-1320
Email: alfa@alfakennsla.is
Icelandic Data Protection Authority: personuvernd.is