Privacy notice for 321school

Scope of this notice

This notice covers the website, personal accounts, teaching features and private customer relationships. School processing of student data is detailed in school privacy documentation and the data processing agreement with annexes.

Who is responsible?

For agreed school use, the school owner is controller of school data and Fjord Service processes it on documented instructions. Fjord Service is controller for its own private customer relationships, billing and enquiries to the business. These purposes must remain separate from school-data processing.

What is data used for?

Data is used to create and manage accounts, provide access to teaching and learning activities, store work and feedback, and manage licences. Private customer relationships also involve payments, billing and enquiries. Technical operations, security and analytics are separate purposes requiring their own scope.

What data is processed?

Data depends on the account type and features used. The main categories are:

• Account/profile: user ID, display name, email or other login identity, role, language, country, municipality/area and any institution, school or room affiliation.
• User content: teaching materials, tasks, student answers, results, teacher/AI feedback and images, recordings or podcast content where used.
• Technical data: login metadata, timestamps, usage events and operational/security logs. Infrastructure providers may also process IP addresses and browser/device information.
• Customer relationships: contacts, enquiries, customer ID, subscription and payment/billing information for paying customers.

Where does data come from?

Data comes from what you enter, write or upload, from teachers or schools, and from login/payment providers. Technical data is also recorded during service use. Current personal registration requires a display name, role, country and municipality/area; registration cannot be completed without these fields. Other data depends on account type and feature.

Student access by code

Students can participate by code/QR without a private email or personal Feide login. Participation is linked to a technical user ID, chosen display name, room membership and submitted work. These may be personal data; anonymous authentication does not mean anonymised work.

• The approval flow for new account links in Spaces is deployed. A personal participant code alone does not grant a new account/device access to existing participant work. A teacher with the required administrative access approves the link using the participant’s temporary confirmation code. Access can be revoked without deleting work. The flow was checked using synthetic accounts and a test room. Code/QR does not require private email, but does not mean student data is anonymised.

Legal bases

The school owner documents the bases for school data. For Fjord Service's own purposes, each processing activity needs an applicable basis: contract where the user is a party, legal duties where applicable, or documented balancing of relevant operational/security interests. Analytics and any consent-based use require separate assessment. The detailed basis inventory for own purposes is not finalised in this review version.

AI, language support and feedback

AI is used for teaching content, translation, vocabulary, reading aloud and feedback suggestions, among other features. Selected features send text, student answers and task context to OpenAI. Text-to-speech sends text and the selected voice; ordinary student recording or playback is not itself AI processing.

• In the school-use model, students receive language support and limited AI help in teacher-led activities. Teachers review and approve content and suggestions used as their feedback.
• 321school uses OpenAI Platform/API. The owner reports a DPA signed on 23 October 2026. Account images show all three sharing options disabled, API call logging Enabled per call and Project Residency Global. OpenAI states API data is not used for training without opt-in. Global is neither an EU restriction nor a single processing country. Response storage, Files, prompt caching and security logs have different rules; no general zero-retention guarantee is given. Explicit store:false in the selected text calls was deployed on 28 October 2026. This does not change the other retention rules.
• OpenAI distinguishes stored responses from security/abuse monitoring logs. Responses normally has a 30-day default retention period or when store:true; in those cases at least 30 days is stated. Security/abuse logs normally remain for up to 30 days, subject to provider exceptions. store:false is not Zero Data Retention. Files, caching and some features have separate rules; there is no single maximum period or zero-retention guarantee. Age-related terms are assessed before use by minors.

Providers, storage and transfers

Vercel Pro: checked production resources show Functions region Frankfurt (fra1) in Germany; its Pro DPA includes SCCs. Resend’s DPA was obtained from the account and reviewed; primary processing is in the US, with SCCs and stated DPF participation. Google documents US processing for Firebase Authentication and DPF for relevant EU/EEA–US transfers, with SCCs where applicable under the agreement. Google customer registration and explicit acceptance are being clarified before new acceptance. Other processing and subprocessors are assessed per service.

Retention and deletion

The draft agreement proposes target periods to be agreed with the school owner: student work and related audio/files during active teaching, deleted within 90 days of the agreed end; operational/error logs 30 days and security logs 90 days. School instructions, earlier deletion and return are agreed in annex D. Specific incident evidence may be retained separately with a documented basis and review date. Enforcement has not been fully verified in operation; procedures, export, copies and provider periods are completed separately.

Your rights

You can request access, correction and deletion, and restriction, portability or objection where the relevant conditions apply. For school use, normally contact the school or school owner. For your private account/customer data, contact post@321skole.no. Identity and any authority are verified as needed.

• Requests must be answered without undue delay, normally within one month. A lawful extension must be explained and notified within the original deadline. Exercising rights is generally free of charge.
• Where processing relies on consent, you can withdraw it. Withdrawal does not change the lawfulness of processing already carried out. You can complain to Datatilsynet, the Norwegian Data Protection Authority.

Children and school use

The school owner assesses accounts and AI use based on students' age, teaching context and legal basis. School use and private accounts require separate assessment. Age conditions and any parental approval for private child accounts require clarification; this notice does not confirm a complete consent workflow.

Browser storage and analytics

Login and features use browser storage for identity, preferences and drafts, among other purposes. This may include cookies, IndexedDB, localStorage and sessionStorage. Clearing browser data does not automatically delete server-side work.

• Google Analytics and application product analytics are disabled in the published service, regardless of role. Necessary operational/security logging and educational statistics are separate purposes and are not disabled by this measure. Aggregate statistics are not necessarily anonymous, especially in small groups.
• Google Analytics and application product analytics are disabled in the published code policy for all roles, deployed on 28 October 2026. This was checked in source and tests and on a selected public page view. Necessary operational/security logging and educational results are described separately. Any later activation of product analytics requires a separate assessment and documented change.

Further use of school data

School data must not be sold or used for third-party advertising or advertising profiles. Analytics, operations and any product improvement require an explicit purpose and basis; this is not general permission to reuse student work.

Changes to privacy information

The version and date show when documentation was revised. Material changes to data use or rights must be communicated to affected users; updating the website text alone is insufficient.