Tillbaka till startsidan

Behandlingsregister och gallring

Senast uppdaterad: juni 2026

Rättslig grund enligt GDPR artikel 6 och standardperioder för gallring.

Personuppgiftsansvarig

Coursfy är ansvarig för konsumentkonton. Akademiägare är ansvariga för medlemsdata; Coursfy är personuppgiftsbiträde enligt DPA.

Dina rättigheter

Tillgång, rättelse, radering, begränsning, portabilitet och invändning — via Inställningar → Integritet eller privacy@coursfy.com.

Register över rättslig grund

Aktivitet	Uppgiftskategorier	Rättslig grund	Gallring
Account registration & authentication	Name, email, password hash, IP, user agent	Contract (Art. 6(1)(b)) — necessary to provide the service	Until account deletion + 30 days operational backup
Academy membership & course enrolment	Profile, progress, payment references	Contract (Art. 6(1)(b))	Duration of membership + statutory accounting periods
Payment processing	Billing metadata via Stripe; no full PAN on Coursfy	Contract + legal obligation (tax/accounting)	Per Stripe and local accounting law (typically 7 years for invoices)
Marketing newsletter	Email, consent timestamp	Consent (Art. 6(1)(a)) — withdraw anytime	Until unsubscribe or 24 months inactivity
Analytics / error monitoring (Sentry)	Pseudonymous events, scrubbed stack traces	Consent (Art. 6(1)(a))	90 days default Sentry retention
AI assistant (academy/course)	Questions, answers, optional conversation IDs	Consent for personalization; contract for core Q&A when enabled by academy	Per academy settings; default 12 months conversation logs
Security & audit logs	User ID, action type, timestamp, IP (hashed where possible)	Legitimate interest (Art. 6(1)(f)) — security of processing	12 months rolling (see retention policy)

Gallringsschema

Kategori	Period	Åtgärd
Active user account	While account is active	Full profile and content access
Deleted user account	30 days after erasure request	Hard delete or anonymize PII; backups expire per cycle
Consent preferences	3 years after last update	Proof of consent for regulatory requests
Security / access audit logs	12 months	Append-only store; then aggregate or delete
Payment & invoice records	7 years (or local statutory minimum)	Anonymize where possible after legal hold ends
Marketing contacts	Until unsubscribe + 30 days	Remove from mailing lists
AI conversation logs	12 months default	Academy owners may request shorter window
Server/application logs	90 days	PII redacted at ingestion

Tillbaka till startsidan

Behandlingsregister och gallring

Senast uppdaterad: juni 2026

Rättslig grund enligt GDPR artikel 6 och standardperioder för gallring.

Personuppgiftsansvarig

Coursfy är ansvarig för konsumentkonton. Akademiägare är ansvariga för medlemsdata; Coursfy är personuppgiftsbiträde enligt DPA.

Dina rättigheter

Tillgång, rättelse, radering, begränsning, portabilitet och invändning — via Inställningar → Integritet eller privacy@coursfy.com.

Register över rättslig grund

Aktivitet	Uppgiftskategorier	Rättslig grund	Gallring
Account registration & authentication	Name, email, password hash, IP, user agent	Contract (Art. 6(1)(b)) — necessary to provide the service	Until account deletion + 30 days operational backup
Academy membership & course enrolment	Profile, progress, payment references	Contract (Art. 6(1)(b))	Duration of membership + statutory accounting periods
Payment processing	Billing metadata via Stripe; no full PAN on Coursfy	Contract + legal obligation (tax/accounting)	Per Stripe and local accounting law (typically 7 years for invoices)
Marketing newsletter	Email, consent timestamp	Consent (Art. 6(1)(a)) — withdraw anytime	Until unsubscribe or 24 months inactivity
Analytics / error monitoring (Sentry)	Pseudonymous events, scrubbed stack traces	Consent (Art. 6(1)(a))	90 days default Sentry retention
AI assistant (academy/course)	Questions, answers, optional conversation IDs	Consent for personalization; contract for core Q&A when enabled by academy	Per academy settings; default 12 months conversation logs
Security & audit logs	User ID, action type, timestamp, IP (hashed where possible)	Legitimate interest (Art. 6(1)(f)) — security of processing	12 months rolling (see retention policy)

Gallringsschema

Kategori	Period	Åtgärd
Active user account	While account is active	Full profile and content access
Deleted user account	30 days after erasure request	Hard delete or anonymize PII; backups expire per cycle
Consent preferences	3 years after last update	Proof of consent for regulatory requests
Security / access audit logs	12 months	Append-only store; then aggregate or delete
Payment & invoice records	7 years (or local statutory minimum)	Anonymize where possible after legal hold ends
Marketing contacts	Until unsubscribe + 30 days	Remove from mailing lists
AI conversation logs	12 months default	Academy owners may request shorter window
Server/application logs	90 days	PII redacted at ingestion