Privacy Policy

1. Who we are

Viafocus AB, org.nr 559547-4882, registered office in Gothenburg, Sweden.

Data protection: dataskydd@viafocus.net · Support: support@viafocus.net

This policy covers viafocus.net, Focuspilot, Studio and our AI features.

2. Our two roles

The school is the controller for data about pupils, teachers and other staff in Focuspilot and Studio. That is the municipality or the independent school's company. We are the processor and process the data only on the school's instructions in the data processing agreement (PUB-avtal).

We are the controller ourselves for the website, contact and demo forms, customer accounts, billing, support, sales, our security logs, lessons that teachers choose to share publicly, and parent accounts. See section 6.

Teachers who sign up on their own. We are responsible for the data about your own account. If you add pupils, your school is responsible for their data, and you confirm that the school has authorised you to do so.

3. Pupil data — the school decides

• The school decides why and how the data is processed, has its own legal basis and informs pupils and parents.

• We never use the data for our own purposes.

• We never ask pupils or parents for consent to Focuspilot or Studio.

• Our PUB-avtal follows the structure of the SKR, Adda and Inera template. We also accept the school's own template where reasonable.

• Pupils, parents and staff use their rights through the school. If you contact us, we pass your request to the school within five working days and help it respond.

A detailed technical description of the processing and our security measures is provided to customers in the PUB-avtal and its appendices.

4. What data the services process

It depends on which features the school uses, and comes from the school's directory (Google or Microsoft), from files the school imports, from what teachers and pupils enter, and from the school's computers.

On Windows, Focuspilot can also see which other programs and windows are open.

The Focuspilot extension in Chrome. It uses the pupil's school email address to link the computer to the right class. It shares which pages are open and the pupil's activity, and, only while a teacher has the pupil in view, images of the pupil's screen. The images are not stored.

The pupil always sees when a teacher is looking at the screen.

The school can switch off screenshots, the list of open tabs and programs, and which page or program the pupil has open, for the whole school.

School hours. The school switches on sleep outside school hours once its school hours are set. The computers then disconnect and send nothing.

Never. Focuspilot never records what the pupil types or which keys the pupil presses, never records sound, and does not read passwords, camera, microphone or the contents of files. We never save which websites or programs the pupil has used.

The teacher assesses. No AI sets scores or grades, and no AI judges whether a pupil is cheating.

5. AI

All AI runs within the EU (Microsoft Azure). That covers both AI that processes pupil data and what teachers themselves write to the AI to create material. A school can use its own AI key with a provider it has its own agreement with; the questions then go there. AI helps teachers create lessons and get an overview of the class, but never makes decisions about pupils. We do not assess emotions, attention or behaviour and never use facial recognition. We do not train any AI models on customer data, and under its terms our AI provider may not do so either. The AI features in the services are labelled as AI, and teachers should not enter personal data about pupils in the AI chat.

6. Data we are responsible for

The data usually comes from you; school contact details may come from public sources, such as the school's website, or from a colleague. Giving us data is voluntary, but without it we cannot answer you or manage an agreement. We make no automated decisions with legal or similarly significant effects.

7. Parents

The school decides whether a parent gets an account; only its administrators can link it to a child. The account shows which children are linked to it, not the child's screen or activity. Parents pay nothing.

8. Our commitments

• We never sell personal data.

• No advertising, and no analytics on pupil pages.

• No profiling of pupils for anything other than what the school has asked for.

• We never rely on pupil consent.

• No face recognition.

• We notify the school of a personal data breach within 24 hours of confirming it.

• We delete the school's data within 30 days after the agreement ends, and the school can first get it in a machine-readable format.

Chrome extension. The use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Google user data. Sign in with Google gives us your name, email address and profile picture. When a school's Google Workspace administrator connects Viafocus under Admin → School data, we read, and never change: users' names, email addresses, organisational unit, a link to their profile picture and whether an account is suspended; and group names and members. If the administrator turns on Google Classroom, we also read course names and the teachers and pupils in each course. We use this only to create and update the school's accounts and classes in Viafocus. When a teacher chooses Save to Drive, Viafocus creates that file in the teacher's own Drive and can access only files it created. The data is stored in our database in the EU (Neon, Frankfurt), access keys are stored encrypted, and we share it only with the sub-processors in section 9 that run the service; section 9 also covers transfers outside the EEA. We never sell it, use it for advertising or use it to train AI models. When the administrator disconnects, we delete the stored access immediately; accounts and classes are deleted as described in section 10. The administrator can also revoke access at any time in the Google Admin console. Viafocus's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

9. Sub-processors and transfers

We use providers for hosting, storage, email, card payments, analytics and AI. They may process the data only to provide the service for us. Full list: /en/subprocessors. More about each item of data: /en/pub-avtal/bilaga-1.

Not our sub-processors: Microsoft Entra and Google Workspace, which the school has its own agreement with for sign-in and its directory, and Pexels, Unsplash and YouTube. Images and videos from them are fetched directly from their servers, which then see the user's IP address. Our image and video search sends them search terms only.

Transfers outside the EEA. Railway, Neon, Cloudflare, Vercel, Microsoft and Stripe are US companies, and Langfuse is owned by the US company ClickHouse. With Neon, Microsoft Azure and Langfuse the data is held in the EU. Stripe, Cloudflare and Vercel are certified under the EU–US Data Privacy Framework. For US companies we use the EU–US Data Privacy Framework (DPF) if the company is certified, and otherwise the European Commission's Standard Contractual Clauses (SCCs). Railway's servers are in the Netherlands, but Railway is a US company, so we treat it as a transfer and use SCCs. You can get a copy of the safeguards from us. We run sign-in ourselves, in our database in the EU. We disclose data to authorities only when the law requires it.

10. Retention

Defaults for Focuspilot and Studio; the school can instruct otherwise.

For data we are responsible for, see section 6.

11. Security

All traffic is encrypted, and our databases and file storage are encrypted. Each school's data is kept separate from other schools' data, and our staff access it only when needed for support or maintenance. Found a security issue? Email security@viafocus.net.

12. Your rights

Data in Focuspilot or Studio through your school: contact the school (section 3).

Data we are responsible for: you have the right to know what data we hold and get a copy, have errors corrected, have data deleted, restrict processing, receive data you gave us in a machine-readable format, and withdraw consent. Email dataskydd@viafocus.net. It is free, and we reply within one month.

Your right to object

You can object at any time to processing based on legitimate interest. If you object to us contacting you about our services, we always stop.

Complaints

You can complain to the Swedish Authority for Privacy Protection (IMY), www.imy.se.

13. Children and pupils

The school adds pupils. They do not create accounts, enter agreements with us or receive marketing. Schools can hand out our short pupil notice.

14. Cookies

We use necessary cookies and, only if you have accepted them, analytics cookies on the public website. Rejecting is as easy as accepting. Inside the service, we may temporarily record signed-in school administrators' setup pages for support; page text, including names, may be visible, while form inputs are masked, regardless of the website cookie choice. Recordings are stored in the EU; sessions of pupils and teachers are never recorded. We do not use marketing cookies.

15. Changes

The current version is always on this page, dated at the top.

16. Contact

Viafocus AB · org.nr 559547-4882 · registered office Gothenburg · dataskydd@viafocus.net · Supervisory authority: IMY, www.imy.se