Privacy policy
This policy covers the website www.norskai.com and every tool on it: writing help, grammar help, speaking practice, job interview training, the CV builder, the exam simulation and the practice exercises.
It describes which data we process, why, who receives it, how long it is kept and what rights you have. It replaces in full the previous version, which applied to norskai.vercel.app.
1. Data controller
The controller for the processing described here is:
- Karolina Kulinska (private individual)
- Email: examhelperai@gmail.com
- Website: www.norskai.com
NorskAI is a hobby project run by a private individual, not through a registered company. It is not a commercial online shop. Should that change, this section will be updated with the company name, organisation number and business address.
For any privacy question, or to exercise the rights in section 10, contact us at examhelperai@gmail.com. We normally reply within a few days, and at the latest within one month.
2. The short version
You do not need an account to use NorskAI. We do not ask for your name, national identity number, address or phone number, and we do not sell data to anyone.
We do process personal data all the same. The text you type is sent to an AI provider so that you can get feedback, the service runs on a hosting provider that logs technical data, and if you ask us for an access code we receive your email address. The sections below explain each of those cases.
3. What we process
| Category | What it is in practice | Where it comes from |
|---|---|---|
| Content you type in | Texts and answers, CV text you paste or fill in, answers in the exam simulation and tests, complaint letters, image descriptions, and your messages in conversation with the AI teacher or in job interview training. | You enter it yourself. |
| Email address | The address you write from when you contact us about full access. | You provide it yourself. |
| Technical data | IP address, browser type, operating system, timestamp and which page was requested. When you redeem an access code we do not store the IP address itself, but a one-way hashed version of it. | Sent automatically by your browser. |
| Usage data | Which pages you visit, for how long, approximate geographic area and what kind of device you use. Collected only if you have consented to statistics. | Google Analytics, after consent. |
| Local storage on your device | Drafts, progress in courses and exercises, language choice, your consent decision and a marker that you have full access. Stays in your browser. | See cookies and local storage for each individual value. |
We do not use automated decision-making with legal effect for you, and we do not profile you for marketing. The level assessments and feedback from the tools are teaching aids with no legal standing — they are not an official assessment of your Norwegian.
4. Purposes and legal bases
We do not process data without a purpose and a legal basis. The table gives both, per category:
| Data | Purpose | Legal basis |
|---|---|---|
| Content you type in | Giving you the feedback, correction, assessment or conversation you asked for. | GDPR art. 6(1)(b) — necessary to deliver the service you requested. |
| Email address when you ask for an access code | Sending you the access code and replying to you. | GDPR art. 6(1)(b). |
| Hashed IP address | Two things: limiting the number of code redemption attempts, so nobody can guess their way into full access, and counting how many AI calls come from the same network, so a script cannot run up our bill. | GDPR art. 6(1)(f) — legitimate interest in securing the service and keeping running costs down. |
| Technical logs | Operations, troubleshooting and detecting abuse. | GDPR art. 6(1)(f) — legitimate interest in a service that works. |
| Usage data (statistics) | Seeing which pages actually get used, so we can improve them. | GDPR art. 6(1)(a) and the Norwegian Electronic Communications Act § 3-15 — consent. Not loaded before you say yes. |
| Necessary local storage | Remembering language choice, consent, full access and your own work between visits. | Necessary to deliver the service, cf. the Electronic Communications Act § 3-15 second paragraph. |
5. Artificial intelligence and OpenAI
The feedback in NorskAI is produced by OpenAI language models. That means the content you type in is sent to OpenAI to be processed there. This applies to every AI tool: writing help, grammar help, the text generator, speaking practice, job interview training, CV suggestions, complaint letter assessment, image description and the exam simulation.
Concretely, we send your text, the task it belongs to, the level you chose and — in job interview training — the CV text and the role you entered. In the conversation tools the most recent messages are also sent, so that the reply follows on from what you said earlier.
OpenAI acts as our processor: they handle the content on our instructions and in order to answer the request, not for their own purposes. Content sent through the OpenAI API is not used to train their models. OpenAI may keep requests for a short period to detect abuse, and deletes them afterwards.
We do not store your texts in any database ourselves. They are processed while the request runs and are gone once the answer is delivered. The exception is the conversation tools, where the most recent messages are held in the server's working memory for up to two hours so the conversation can continue — after which they are gone too.
In grammar help your question is additionally sent to Pinecone, which we use to find the grammar rule that fits. The question is only used to search; it is not added to the search index.
6. Full access and voluntary support
Full access is handled manually and is free of charge. You send us an email asking for an access code, and we send it back to you. Everyone who asks receives one, and it gives full access for 30 days. The code is personal and works on up to three devices, so that a single code cannot be shared with everyone. You do not have to pay or contribute anything to get it.
NorskAI is a hobby project with a fundraiser, not a sale of digital services. We take no profit. Running costs — especially OpenAI and hosting — are high, which is why there is a voluntary fundraiser on Spleis. Contributing is an independent choice: there is no fixed price, no subscription and no obligation to pay. Access is not sold, and a contribution buys no advantage — no longer code, no extra devices, no higher usage limits, no faster replies. Someone who contributes and someone who does not get exactly the same access.
We never receive card numbers, account numbers or other payment details. Spleis handles the contributions and is an independent controller for what happens on their platform — their own privacy policy is on spleis.no. Since nothing is sold, no receipt is issued and no purchase agreement is concluded. We do not link contributions to access codes, and the access cookie stores nothing about contributions.
The only thing we process in order to give you access is the email address you write from. The email correspondence is kept for up to twelve months after our last contact, and then deleted.
The access itself is remembered in a cookie that contains no name, no email address and no contribution details — only a signed expiry time and a short reference to the code, so that a code which is misused can be revoked.
7. Who receives data
We use external providers to run the service. They act as our processors, except for Spleis and Google Analytics, where the table states the roles. We do not sell data and do not share it with anyone beyond those listed here.
| Recipient | What they receive | Role and location |
|---|---|---|
| OpenAI | The content you type into the AI tools. | Processor. OpenAI Ireland Ltd. for users in the EEA, with processing also in the USA. |
| Vercel | Technical data and logs from all traffic, since the site runs there. | Processor. Vercel Inc., USA, with servers in Europe. |
| Upstash | Your access code, stored as a one-way hashed value and never in plain text. Alongside it we store the note we wrote ourselves when the code was created — it may contain your name or your email address — the expiry time, and a random device number for each browser the code has been used in, up to three. Also the counter for free AI tasks, stored as a number against the device number from na_device, and hashed IP addresses used to limit code redemption attempts and the number of AI calls per network. | Processor. Upstash Inc., USA. |
| Pinecone | Your question in grammar help, used for searching. | Processor. Pinecone Systems Inc., USA. |
| Google Analytics | Usage data, with an anonymised IP address. Only if you consented. | Google Ireland Ltd. We and Google are each controllers for our respective parts. |
| Google (Gmail) | The email correspondence about access to the content. | Processor for the email service. Google Ireland Ltd. |
| YouTube | Video playback you start yourself. The video is fetched from youtube-nocookie.com only when you click, never automatically. | Google Ireland Ltd., separate controller for its own part. |
| Spleis / SpareBank 1 | Any voluntary contribution. We receive no payment data from them, and the access cookie stores no contribution details. | Independent controller for their own platform. |
We may additionally have to disclose data where we are legally required to, for example following an order from a public authority.
8. Transfers outside the EEA
Several of the providers in section 7 are American, so data may be processed in the USA. That applies to OpenAI, Vercel, Upstash, Pinecone and Google.
Such transfers rest on one of two bases: the provider is certified under the EU-US Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection under GDPR art. 45, or the transfer relies on the EU Standard Contractual Clauses under GDPR art. 46(2)(c).
You have the right to know which basis applies to a given provider, and to receive a copy of the relevant safeguards. Send a request to examhelperai@gmail.com and we will send it to you.
9. How long we keep data
We do not keep data longer than the purpose requires. These are the concrete periods:
| Data | Retention |
|---|---|
| Texts, CV content, answers and image descriptions | Not stored by us. Processed while the request runs and gone once the answer is delivered. |
| Conversations with the AI teacher and in job interview training | Up to 2 hours in the server's working memory, then deleted automatically. |
| Requests at OpenAI | Kept briefly by OpenAI to detect abuse, then deleted. Not used for model training. |
| Test sessions in the Norskprøve practice tests | 3 hours, then deleted automatically. Your answers are not stored — only the task set you were given. |
| Hashed IP address for limiting code redemption attempts | Up to 15 minutes. |
| Hashed IP address for the usage ceiling on the AI tools | 4 days from the first call, then deleted automatically. |
| The counter for free AI tasks, kept against the device number from na_device | 4 days from the first task, then deleted automatically. We store only a number — how many tasks have been used — never which tools you used or what you wrote. |
| The access code at our end: hashed code, note, expiry time and device numbers | Until the code expires (up to 30 days), then deleted automatically. If we withdraw a code, we keep a marker of that for up to 30 days, so it cannot be taken into use again. |
| Full-access cookie | Until access expires (up to 30 days), or until you delete it in your browser. |
| Email about access to the content | Up to 12 months after our last contact. |
| Technical logs at the hosting provider | Up to 30 days. |
| Statistics in Google Analytics | Up to 14 months. |
| Local storage in your browser | Varies per value. See cookies and local storage. You can delete all of it yourself from your browser settings. |
10. Your rights
You have the following rights under the GDPR:
- Access (art. 15) — to know what we process about you, and receive a copy.
- Rectification (art. 16) — to have inaccurate data corrected.
- Erasure (art. 17) — to have data deleted where we no longer have a basis to process it.
- Restriction (art. 18) — to require that processing is paused while an objection is assessed.
- Objection (art. 21) — to object to processing we base on legitimate interest.
- Data portability (art. 20) — to receive the data you gave us in a machine-readable format, or have it transferred elsewhere.
- Withdrawal of consent (art. 7(3)) — at any time, without affecting the lawfulness of processing before that.
- Lodging a complaint with the supervisory authority (art. 77).
Here is how to exercise them in practice:
| What you want to do | How to do it |
|---|---|
| Delete texts, CV or conversations | They are already gone. We do not store them, and conversations are deleted after two hours at the latest. Drafts held in your browser are removed by clearing the site's storage, or by using the delete button in the tool. |
| Access or delete email correspondence | Send a request to examhelperai@gmail.com from the address concerned. We reply within one month. |
| Withdraw consent to statistics | Use “Cookie settings” at the bottom of any page, or the cookies page. We delete the statistics cookies from your browser at the same time. |
| Request deletion at one of the providers | Contact us at examhelperai@gmail.com. We pass the request on to the processor concerned and confirm once it is done. |
If you believe we process data in breach of the rules, you can complain to the Norwegian Data Protection Authority. Guidance and a complaint form are at datatilsynet.no. Postal address: Datatilsynet, Postboks 458 Sentrum, 0105 Oslo. We would appreciate hearing from you first, so we get the chance to put things right.
11. What you must provide, and what is optional
Almost everything is optional. The consequence of not providing something is never more than that the feature in question cannot be used:
| Data | Required? | If you do not provide it |
|---|---|---|
| Text in a writing tool | Required for that feature. | We have nothing to give feedback on. The rest of the site works as normal. |
| CV content | Optional. | The CV builder and the CV-tailored interview training cannot be used. You can still practise interviews without a CV. |
| Email address | Required only to be sent an access code. | We cannot send you an access code. Every tool can still be tried out without it. |
| Consent to statistics | Entirely optional. | Nothing. The whole site works the same; we simply do not see usage statistics. |
12. Sensitive data — read this before pasting a CV
The writing fields, CV fields and conversation fields are free text. We do not ask for special categories of personal data under GDPR art. 9 — data on health, religion, ethnicity, political opinion, trade union membership or sex life — and we do not need any of it to give you feedback.
We cannot technically prevent such data from being typed in. So we ask you: do not enter national identity numbers, D numbers, health information, account numbers or information about other people. Feel free to anonymise your CV — replace names, employers and dates with something invented. The tool gives just as good feedback on the language either way.
If you do enter such data anyway, you do so on your own initiative, and it is handled like the rest of the text: sent to the AI provider to produce the answer, and not stored by us.
13. Information security
All traffic is encrypted over HTTPS. Access codes are never stored in plain text but as a salted one-way hash, and access itself is verified on the server. The number of attempts is limited, and the IP address used for that limit is hashed so it cannot be read back.
No service can guarantee that nothing will ever go wrong. So we do not promise that data is “completely safe”; instead we keep the amount of data down, store as little as possible and fix problems we become aware of. If we discover a personal data breach that poses a risk to you, we report it to the Norwegian Data Protection Authority within 72 hours and notify you where the risk is high.
14. Changes to this policy
We update this policy when the service changes. The date at the top shows when it was last changed.
For significant changes — new types of data, new recipients, new purposes — we do not simply publish the new text. We give active notice on the site, and by email to those whose address we have. You should not have to check this page yourself to find out that something important has changed.
15. Contact
Questions, access requests, deletion requests and objections go to examhelperai@gmail.com.
See also cookies and local storage for a complete overview of what is stored in your browser.