Privacy Notice

Cramify is operated by Jesper Persson, Sweden, who is the data controller for the personal data processed in the service. This notice explains what we collect, why, and what rights you have.

• Account data — email address, display name and optional profile picture when you sign up.
• Learning content — the prompts, topics, files and pasted text you turn into courses, your learning profile ("how I learn best"), saved courses, learning paths, quiz results and flashcards.
• Usage data — basic technical information such as device type, browser and IP address, used to keep the service secure and running.
• Support messages — if you contact us, we keep the conversation to help you.

Payment details (card numbers etc.) are collected and processed directly by Paddle, our Merchant of Record — we never see or store your card details.

• To create your account and provide the service (contract performance).
• To generate and store your courses, paths and progress (contract performance).
• To keep the service secure and prevent fraud and abuse (legitimate interest).
• To improve Cramify and understand how features are used (legitimate interest).
• To meet legal obligations, e.g. accounting rules for purchases (legal obligation).

• Service providers that host and operate Cramify (cloud hosting, database, AI models that generate your courses, analytics).
• Paddle, our Merchant of Record, for the sale of subscriptions, payment processing, tax compliance and invoicing.
• Professional advisers (e.g. accounting) where needed.
• Authorities, where required by law.

Courses you explicitly publish to the community are visible to other users — nothing else in your account is public.

Some of our service providers process data outside the EU/EEA. When they do, we rely on appropriate safeguards such as EU Standard Contractual Clauses or adequacy decisions.

We keep your data for as long as your account is active. If you delete your account, your profile, courses and learning paths are deleted or anonymised within a reasonable period, except where law requires us to keep records (e.g. purchase history for accounting).

Under GDPR you have the right to access, correct or delete your personal data, restrict or object to processing, receive a copy of your data (portability), and withdraw consent where processing is based on consent. You also have the right to complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY). We respond to requests within one month.

We use appropriate technical and organisational measures to protect your data, including encrypted connections, access controls and row-level isolation of each user's content.

Cramify uses essential cookies and local storage to keep you signed in and remember your settings (such as language). We do not use third-party marketing cookies.

We may update this notice as the service develops. The current version is always available on this page.