Privacy policy
Beyond SFI stores as little about you as possible. This page says what we store, why, for how long, and how to have it removed.
Data controller: TK Digital Experiences AB, Götaverksgatan 24, 417 55 Göteborg, Sweden.
Your account
When you create an account we store your e-mail address and your password (stored so that nobody, not even us, can read it), or your Google account id if you sign in with Google, and your name if you enter it. Your name is used only on your certificate.
Legal basis: our contract with you (Art. 6(1)(b) GDPR). The data is kept until you delete the account. You need an e-mail address (or a Google account) to have an account; without it we cannot provide the service.
Your learning
When you practise we store your progress in the courses, your results and the answers you give in the exercises. What you write in writing tasks and everything you say in chat exercises is stored encrypted, so nobody on the team can read it. Exercises are graded automatically, but no decision with legal or similarly significant effects for you is taken automatically. The team's administrators can see your name, your e-mail address, whether you have a free or Plus account, how many of the exercises in your courses you have passed and what the AI exercises have cost for your account. They use this only to help you and to run the service. They cannot read your answers.
On every writing and chat exercise you can read your latest answer and delete it. You choose whether only the text goes (your result stays) or the whole attempt. Recordings in speaking exercises stay on your device and are never uploaded. Legal basis: our contract with you (Art. 6(1)(b) GDPR).
AI in the chat exercises and in Plus feedback
In the chat exercises the conversation partner's replies are generated by an AI service from Anthropic, a US company. Only the conversation and the exercise text are sent there, never your name or e-mail. You can ask for feedback on a writing task and on a listen-and-write exercise (once each free of charge to try it, or with Plus) and, with Plus, on a recording. Your text, or a transcript of what you said, is then sent to the same service together with the exercise text. Anthropic does not use what we send to train its models, and we have a data processing agreement with them. The transfer to the USA is protected by the EU's standard contractual clauses. A recording leaves your device only when you press "Send for feedback" yourself. It is then transcribed by an AI service from Google, a US company (data processing agreement with standard contractual clauses), and its first minute is scored for pronunciation by the speech service of Microsoft Azure in a data centre in Sweden (data processing agreement). This happens in memory only. We do not store the audio. The transcript, the pronunciation scores and the feedback are stored encrypted in the same way as your written answers, so you can read them again, and are deleted when you delete your answers or your account. So please do not write or say real personal data in the exercises: make up names, addresses and numbers. To keep costs under control we store, for every call to the AI services, what it cost and link it to your account. What was written or said is not stored there. Legal basis: our contract with you for the Plus feedback (Art. 6(1)(b) GDPR) and our legitimate interest in controlling costs and detecting misuse (Art. 6(1)(f) GDPR). When you delete your account, the costs are unlinked from you.
Videos from YouTube
Some exercises are built around a YouTube video. Nothing is fetched from YouTube until you press play in the exercise, or until you allow external media in the cookie settings (then videos load directly). The player is then loaded from YouTube (Google, a US company) in its privacy-enhanced mode; YouTube receives your IP address and browser details and may set cookies. We send nothing about your account to YouTube. What YouTube does with the data is governed by Google's privacy policy. If you prefer that nothing is loaded from YouTube, skip the video exercises — they are never required to finish a course.
Certificates
When you finish a course we store your certificate: the name you entered, the course, the date and a verification code, and your results: how many chapters and exercises you completed, your score on the exam and your scores per area. The certificate is stored as a PDF at a private address. Anyone with the code can see the name, course and date on the verification page. If you have Plus, your results are also shown on the certificate and on the verification page, and they stay there even if you end Plus later. If you delete your account the certificate remains so that the code can still be checked, but without any link to an account.
Buying Plus
When you buy Plus, payment goes through Link, a service from Stripe (Stripe Technology Europe Ltd, Ireland; its parent company is in the US). Stripe is the seller to you and is itself responsible for the data the purchase needs, such as payment details, receipts, VAT and fraud protection. How Stripe and Link handle that data is set out in their privacy policies. We send your e-mail address, your name and an internal id of your account to Stripe. Card numbers and other payment details never reach us.
We store Stripe's customer id for your account, when you have Plus and where it comes from (a purchase, a promo code or granted by us), whether the subscription renews, whether you have the reduced price (only that you have it, never why) and, if you withdraw from a purchase, when we received your withdrawal. The admins in the team can see this. Legal basis: the contract with you (Art. 6(1)(b) GDPR). The data stays until you delete your account; a running subscription then ends. Receipts and purchase records that Stripe needs as the seller, for example under bookkeeping rules, are kept by Stripe under its own terms.
Feedback
When you send feedback through the button we store your text, your e-mail address and where you were on the site. Text and e-mail are stored encrypted and can be read by the team. A copy is e-mailed to us. Feedback, including the e-mail address, is kept until we have dealt with it; you can ask us to delete it at any time. If you delete your account the feedback stays but is no longer linked to an account. Legal basis: our legitimate interest in improving the service (Art. 6(1)(f) GDPR). You have the right to object to this.
The waiting list
When you join the waiting list we store your e-mail address, the SFI course you selected (if any) and a record of your consent. We also store what you are waiting for (the launch or a coming course). When it opens we send one e-mail about it and note when it went out.
You must confirm your address via the link in the e-mail (double opt-in). You can remove yourself at any time via the link in every e-mail, before and after confirming, and your address is deleted immediately. Legal basis: your consent (Art. 6(1)(a) GDPR).
Where the data lives
All data is stored with our hosting and database providers on servers in the EU. We have data processing agreements with them. Some of these providers are US companies; where data could be reached from outside the EU, the transfer is protected by the EU's standard contractual clauses. No data is sold or shared with ad networks.
We send our e-mails (address confirmation, password reset, waiting-list e-mails, copies of feedback and the confirmation when you withdraw from a purchase of Plus) via a transactional e-mail service that stores data only in the EU. To deliver a message, the service receives your e-mail address and the content of the message and keeps a delivery log (sent, delivered, bounced). We have a data processing agreement with the service. It does not use your address for anything else, and we send no newsletters or marketing beyond what you signed up for. Receipts and e-mails about your Plus subscription are sent by Link (Stripe).
Cookies and your choices
When you are signed in, the site sets one cookie that keeps you signed in. It is necessary for the service and is not used for anything else. Your theme choice and your choice in the cookie settings are stored locally in your browser, and your language is part of the address; these are necessary too. Everything else is switched off until you say yes in the cookie settings, and you can change or withdraw your choice at any time under “Cookie settings” at the bottom of every page. Withdrawing is as easy as agreeing and does not affect what happened before.
Visit statistics
If you allow visit statistics, we use Vercel Web Analytics (Vercel Inc., our hosting provider). It shows us how many people visit, which pages are read, which links on our pages are used and how many people create an account. It sets no cookies and stores nothing on your device. Your IP address is used only for a moment, to place a visit in a country and to tell visits apart for one day; it is not stored. Addresses of pages are cleaned before they are sent, so e-mail addresses, reset links and certificate codes never reach the statistics. Vercel stores the data with its cloud providers and shows it to us for up to 12 months; it may keep it longer, without anything that identifies you. We have a data processing agreement with Vercel. Vercel is based in the USA; where data could be reached from outside the EU, the transfer is protected by the EU's standard contractual clauses. Legal basis: your consent (Art. 6(1)(a) GDPR). If your browser sends a “Do Not Track” signal, no statistics are collected even if you said yes.
Your rights
Under Account you can download everything we store about you as a file (your answers included, readable only by you) and delete the account. Account, courses, attempts, answers and daily words are then deleted immediately.
You also have the right to access, correct or delete your data, to restrict or object to how we use it, to receive it in a machine-readable format, and to withdraw a consent at any time (this does not affect what was done before). We answer within a month. E-mail hej@beyond-sfi.se
If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se. We would be grateful if you contacted us first.
Updated 2026-10-17.