Privacy Policy for WaytoGo
Svenska · English
WaytoGo supports study and careers guidance in schools. A counsellor can record, transcribe and summarise guidance conversations with pupils. WaytoGo does not assess, diagnose or grade pupils and is not a medical device. This policy is written for pupils and their guardians. This policy describes how we process personal data when you use the app.
1. Data controller
TalkToAlba AB, org.nr 559488‑8207, Magnus Stenbocksgatan 7, 222 24 Lund, Sverige. Data Protection Officer: dpo@talktoalba.com.
2. What data we process
- Account data: username, email address, password (stored only as a cryptographic hash), role and permissions.
- pupil ID and associated content: a randomly generated pupil ID (no name or national identity number required) and the content a professional links to it.
- Audio recordings: audio from guidance conversations that you start and record yourself.
- Transcriptions and assessments: text created from recorded audio and AI‑generated summaries/assessments that you can edit and save.
- Messages: text in secure communication between pupils and counsellors.
- Technical logs: event logs for security and traceability (user ID, timestamp, action).
The conversations may include personal data about you as a pupil, for example about your studies, your choices and how you feel. What you say in the conversation is only saved if the counsellor records it.
3. Data on the device
- Microphone: used only while you are actively recording. The app does not listen in the background.
- Local files: audio files are stored temporarily on the device during transcription and are then deleted automatically according to your audio‑retention setting. Settings and login tokens are stored locally on the device.
4. Purposes and legal basis
We process data to provide the service: account management, recording, transcription, AI‑supported analysis, communication and security logging. The legal basis is your consent (Art. 6(1)(a)). For a pupil who is under 15, consent from a guardian is required. Logging is carried out to comply with a legal obligation (Art. 6(1)(c)).
Consent from guardians
A pupil who is under 15 needs consent from a guardian to be added to WaytoGo. If the pupil has two guardians, both guardians must consent. If the pupil has one guardian, that guardian’s consent is enough. The counsellor must have the consent before the pupil is added. When the counsellor writes an age under 15 in figures, the app does not save the pupil until the consent is ticked. A guardian can withdraw consent at any time by contacting the counsellor or the data protection officer.
Video
The counsellor may ask to record a short video of you during the conversation. It is your choice. You can decline and still have the conversation, and nothing happens to you for declining. If you say yes, the video is stored securely and is deleted automatically after 24 hours.
Voice and emotions
WaytoGo does not analyse your vocal tone and does not try to work out your emotions. AI is used to write out and summarise what is said. Decisions about you are made by you and your counsellor, never by AI.
5. How data is shared (processors)
We never sell your data. We use the following processors, under data processing agreements:
- Transcription and AI analysis: Microsoft Azure (Sweden Central, EU) and OpenAI for speech‑to‑text and language models. Recorded audio is processed within the EU.
- Email: Loopia (Sweden) for transactional email (account confirmations, login codes, reminders).
- Operations/hosting: our server within the EU.
We do not train AI models on your data, and our AI providers do not either.
6. Storage and retention
- Audio: All audio is deleted after the number of days set for the account. This covers recorded sessions, uploaded audio, recordings of calls in the app and the audio of AI phone calls. The default is 7 days. You can change the time in the settings of the app to a whole number of days from 0 to 30. If you lower the time, the new time applies to new audio. With 0 days, audio is deleted as soon as it has been transcribed. If transcription fails, it is deleted after 24 hours.
- Transcriptions, assessments and accounts are stored for as long as the account is active or as long as required for the purpose and applicable law.
- The database is encrypted at rest (SQLCipher/AES‑256) and all transfer takes place over an encrypted connection (TLS).
7. Security
Access is role‑ and permission‑based, passwords are hashed, optional two‑factor authentication is available for professionals, and a tamper‑evident event log is maintained. Only authorised users can reach pupil ID data.
8. Your rights
You have the right of access, rectification, erasure, restriction, data portability and to object, under the GDPR. Contact dpo@talktoalba.com. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY), www.imy.se.
9. Children
WaytoGo is used with pupils, who are often children or teenagers. Pupils under 15 need consent from a guardian to use WaytoGo, as the section on consent above says. You have the same rights as an adult, and your guardian can use them on your behalf. We try to write so that you can follow it. If something is unclear, ask your counsellor or write to the data protection officer.
10. Changes
We may update this policy. Material changes are communicated in the app or by email. The date at the top shows the latest version.