Privacy Policy

Nota Melior is the data controller for personal data processed in Nota Melior (the “Service”). Contact us at erik@ulander.se with any questions about this policy or your data.

• Account data: your email address and a password (stored only as a secure hash), or your Google account identity if you sign in with Google.
• Content you add: courses, notes, links, uploaded PDFs, study plans, flashcards, quizzes, tutor conversations, focus-timer sessions and your study progress (XP, levels, streaks and badges).
• Usage and technical data: pages visited, actions taken in the app (for example adding material or using the tutor), device and browser information, approximate location derived from the IP address, and error reports.

• To provide the Service (account, courses, study tools, AI features): performance of a contract.
• To understand how the Service is used and fix errors (analytics, error tracking): our legitimate interest in improving and securing the Service.
• To comply with the law where required.

When you use AI features (study plan, flashcards, quizzes, tutor), the relevant course text, material you added and your messages are sent to an AI provider (Cloudflare Workers AI) to generate a response. We only send what is needed for the request. Please don’t add sensitive personal data (such as health information) to your material.

We use these service providers (processors) to run the Service:

• Supabase — database, authentication and file storage.
• Cloudflare — hosting and delivery of the website, and the AI model provider (Workers AI).
• PostHog (EU cloud) — product analytics, error tracking and, only if you allow it, session replay (you choose when you first sign in and can change it any time in Settings). Signed-in users are identified by account ID and email.
• Google — sign-in, if you choose “Continue with Google”.

We do not sell your personal data.

Some providers may process data outside the EU/EEA (for example in the United States). Where this happens, we rely on safeguards such as the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

We use browser storage that is necessary to keep you signed in. Our analytics tool (PostHog) also uses cookies or local storage to recognise returning visitors and measure usage.

We keep your account and content until you delete it or ask us to delete your account. You can delete your account yourself at any time under Settings, which removes your account, content and uploaded files. Analytics data is kept for as long as it is useful for improving the Service, and no longer than needed.

Under the GDPR you have the right to access, correct or delete your data, to restrict or object to processing, to data portability, and to withdraw consent where processing is based on consent. You can download a copy of your data and delete your account yourself under Settings. For anything else, contact us at erik@ulander.se to use these rights. You also have the right to complain to the Swedish Authority for Privacy Protection (IMY, imy.se).

We may update this policy. The date at the top shows when it was last changed.