Privacy Policy LearnFlow

1. Who We Are

LearnFlow is a Learning Management System (LMS) operated for organisations in Norway and the European Economic Area. Each organisation (tenant) independently controls access to their platform instance. The data controller for your data is the organisation that invited you to use LearnFlow.

2. What Data We Collect

• Account data: name, email address, hashed password, role
• Activity data: course progress, quiz scores, completion timestamps, certificates issued
• Authentication data: session tokens, 2FA secrets (encrypted), login timestamps
• Consent records: date and time of Terms of Service acceptance
• Uploaded files: profile images, course materials uploaded by administrators

3. Legal Basis (GDPR Article 6)

• Contract performance — to provide the learning platform you signed up for
• Legitimate interests — security logging, fraud prevention, platform stability
• Consent — for any optional processing where you have explicitly agreed
• Legal obligation — where required by Norwegian or EU law

4. How We Use Your Data

• Providing access to courses, tracking your progress, and issuing certificates
• Sending you platform notifications and administrative emails from your organisation
• Securing the platform through login monitoring and session management
• Enabling administrators to manage users within their tenant

5. Data Storage and Security

Data is stored in isolated per-organisation databases within the EEA. We apply the following technical measures:

• Passwords hashed with bcrypt (cost factor 12+)
• Sensitive settings encrypted at rest with AES-256 (Fernet)
• Database files restricted to application-only access (chmod 600)
• HTTPS enforced; session cookies are Secure, HttpOnly, and SameSite=Strict
• Two-factor authentication available for all accounts

6. Your Rights (GDPR)

As a data subject you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion of your account and personal data
• Portability — receive your data in a machine-readable format
• Restriction — limit processing in certain circumstances
• Objection — object to processing based on legitimate interests

To exercise these rights, contact the administrator of your organisation's LearnFlow instance or use the account settings page.

7. Data Retention

Account and activity data is retained for as long as your account is active. When an account is deleted, personal data is anonymised or erased within 30 days. Audit logs may be retained for up to 12 months for security purposes.

8. Cookies

LearnFlow uses a single session cookie (session) strictly necessary for authentication. No tracking, analytics, or advertising cookies are used.

9. Third-Party Services

• AI features (optional): if enabled, course content queries are sent to the Anthropic API (USA). Anthropic's privacy policy applies.
• CDN assets: Bootstrap CSS/JS is loaded from jsDelivr CDN with Subresource Integrity verification.

10. Contact

For privacy questions or to exercise your rights, contact the data protection officer of your organisation. For platform-level enquiries, reach us at privacy@learnflow.no.