1. Who is responsible?
Kalirox AS, organisation number 836 971 752, Tårnveien 14, 3047 Drammen, Norway, operates NorskMentor and is the controller for personal data processed for its own service purposes. Privacy contact: Yunus Yigit, via support@norskmentor.no.
Where a school or employer determines the purposes of processing in an institutional learning arrangement, that organisation may be the controller and Kalirox AS its processor under a separate agreement. Contact your organisation about its own retention rules and access decisions; we can help route your request.
2. Data and purposes
Account and access: name, email, a profile picture if you upload one, user identifier, login information, language preferences, learning level, account status and school or teacher connection. If you choose Google or Apple sign-in, we receive the identity information made available by that provider, such as an identifier, name and email; we do not receive your Google or Apple password.
Learning: answers, submitted writing, vocabulary, notes, progress, activity history, scores, AI feedback and conversation transcripts. Speaking features process microphone audio and, where the activity saves a recording, the recording and related feedback. This enables exercises, assessment, history and personalised learning support.
Collaboration and support: messages, assignments, feedback, support correspondence and information you submit to us. Teachers and authorised institutional users can access information relevant to the learning relationship and permissions attached to your account.
Billing: subscription, purchase and payment status, transaction references and billing details where relevant. Website payments are handled through Stripe. Android subscriptions are not purchased inside the app; an existing trial or subscription gives access.
Operation and security: request and login logs, IP addresses, device/browser information, errors and usage information needed to operate the service, investigate problems, enforce access limits and prevent abuse.
3. Legal grounds and choices
We process data necessary to provide your account, learning features, support and purchased services to perform our contract with you (GDPR Article 6(1)(b)). Required accounting and legally required disclosures rely on legal obligations (Article 6(1)(c)). Security, abuse prevention and handling legal claims rely on our legitimate interests (Article 6(1)(f)), subject to your rights and a balancing assessment.
Optional website analytics require consent (Article 6(1)(a)); you can change your cookie preferences. Essential authentication and security storage is needed for the service. See the cookie policy for details. Learning history needed to deliver exercises is separate from optional website analytics.
Microphone access is requested when you use speaking features and can be withdrawn in device settings. Without it you cannot use microphone-based activities. Device permission is separate from the legal ground for processing your data. Data necessary for an account or a paid service must be provided to use that service.
4. Audio and artificial intelligence
Your submitted text, audio, transcripts and relevant learning context may be sent to AI and speech service providers to generate speech, transcriptions, pronunciation feedback, conversation responses and learning assessments. NorskMentor uses Microsoft Azure services, including Azure AI/OpenAI services, for these functions.
Saved speaking exercises, transcripts and assessments can remain in your learning history. Do not assume that everything said in a live conversation disappears when it ends. Avoid entering national identity numbers, real patient information, health records or other unnecessary sensitive information in exercises, notes or AI conversations.
AI feedback is learning guidance and may be inaccurate. It is not an official examination result or a decision on employment, benefits, residence or admission. Ask your teacher or support to review feedback you believe is wrong.
5. Recipients and international processing
Data is made available as needed to hosting, storage, AI/speech, transactional email, payment and technical service providers; authorised staff handling support and operation; and teachers or institutional users with relevant access. Authorities and advisers may receive information when necessary to comply with law or establish, exercise or defend legal claims. We do not sell your personal data.
Cloud providers and their subprocessors may process data or provide support from countries outside the EEA. Such transfers require a valid GDPR transfer basis, for example an applicable adequacy decision or standard contractual clauses with any necessary additional safeguards. Contact us for information about the recipients and safeguards applicable to your data and how to obtain a copy. We do not promise that all processing takes place only in Norway.
6. Retention and security
Account and learning records are kept while needed to provide your account, learning history and any institutional service. Cancelling a subscription does not itself delete your account or learning history. When data is no longer necessary, it must be deleted or anonymised unless a legal reason requires continued retention.
After a deletion request we assess account records, submissions, notes, messages, saved recordings, transcripts and progress for deletion. Records that must be retained for accounting, specific legal claims or necessary fraud/security investigations are limited to that purpose and the applicable legal or necessary period. We explain relevant exceptions when handling your request. Backup copies are subject to their backup lifecycle; deletion is not a promise of immediate erasure of every backup.
We use access controls and encrypted connections for the service. No service can guarantee absolute security. Contact support promptly if you suspect unauthorised access to your account.
7. Request account and data deletion
You can request deletion in the Android or iOS app under Settings → Help & about → Request account deletion.
We complete account deletion without undue delay and no later than one month after receiving your request. We may verify account ownership to prevent unauthorised deletion. Any records that must lawfully be retained and the handling of backup copies are explained in section 6; we inform you about applicable exceptions when handling your request.
You can also request deletion without logging in or reinstalling the app: email support@norskmentor.no with the subject ‘NorskMentor account deletion’, preferably from the address used for your account. Tell us which account to delete. We may request proportionate information to verify ownership, but do not send your password or identity documents unless specifically requested through an appropriate secure process.
You may also request deletion of particular data without closing your account. We will explain any information that must be retained and why. Uninstalling the app does not delete your account. Mention any active subscription so that its cancellation can also be addressed; a deletion request is not conditional on purchasing anything.
This opens your email app. Send the email to submit your request. If no email app opens, write to support@norskmentor.no using your usual email service.
8. Your rights and complaints
Subject to GDPR conditions, you can request access, correction, erasure, restriction and data portability, object to processing based on legitimate interests and withdraw consent without affecting processing already lawfully carried out. Requests are normally free.
We respond without undue delay and normally within one month. If the law permits an extension for a complex request, we explain the reason and extension within that first month. You may complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no), or your local supervisory authority.
9. Audience and policy updates
NorskMentor is designed for adult learners. It is not a service directed at children. Contact us if a child has supplied personal information so that we can assess the situation and take appropriate action.
We update this policy when the service or processing changes. Material changes will be brought to your attention through an appropriate service notice or email. Where new processing requires consent, a policy update alone does not provide that consent.