Last updated: September 9, 2026
1. Introduction
Forklar Meg ("we", "us", "our") is committed to protecting your privacy. This privacy policy explains how we collect, use, store and protect your personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act.
2. Data Controller
The data controller for the personal data processed in Forklar Meg is:
3. What Information Do We Collect?
We collect the following categories of personal data:
3.1 Automatically collected information:
- User ID without a name (created automatically). It is not linked to your name, but it follows you between sessions and ties your analyses together — so it is not anonymous in the legal sense.
- Time of service use
- Technical device information (for troubleshooting only)
3.2 Information you provide:
- Documents you upload for analysis
- Questions you type or speak into the Explainer (free text about a situation)
- Audio you record yourself — when you speak a question into the Explainer, or record audio in Blackbox. The recording is sent for speech-to-text only when you choose that.
- Location — only if you choose to attach a place to a Blackbox entry. Address lookup uses the phone’s location service. The app encrypts the address. Coordinates stay in local storage under the phone’s storage protection, without separate field encryption by the app.
- Email address (only upon registration or support)
3.3 Absence records on the phone:
Existing absence records in Resources and Blackbox stay on the phone. They must not be sent for AI analysis. Historical analyses may contain absence data sent with earlier app versions.
- Local Storage: These data are stored only on your phone (Local Storage)
- The updated payslip flow does not send Blackbox absence records. Do not copy health information into questions, documents or AI summaries.
- You can delete local records in the app. We do not have a server backup that can restore those local records. Account and analysis deletion is handled separately in Settings.
3.5 Sensitive Data (GDPR Art. 9)
ForklarMeg does not currently offer analysis of health documents. Do not upload or send health information about yourself or others, such as diagnoses, medical records, test results or medical attachments to an insurance or immigration matter. This information has special protection under GDPR Article 9.
- What consent covers: Consent to AI analysis covers the material supported by the service. It is not consent to process health information. Simply uploading a file does not provide a special legal basis.
- Withdrawing consent: You can withdraw AI consent in Settings. You can also delete analyses and request deletion of account data there. Withdrawal does not undo processing already carried out. If you sent health information by mistake, use the deletion controls or contact support without sending the information again.
- Extra protection: We try to remove recognisable national ID numbers, account numbers, phone numbers and email addresses before AI analysis. Coverage differs for text and images. Names, addresses and information the filters miss may remain. Redaction is not full anonymisation. Nothing leaves the phone unless you actively choose to send the material to a feature that needs it. Audio sent for transcription cannot be redacted in advance.
Send only the part needed to explain the document. Remove health information completely before uploading, including from images and attachments. If you are unsure whether it has been removed, do not upload the document. You can still ask general questions about rules without personal health information.
3.6 Evidence you log yourself — your responsibility
Blackbox notes, photos and audio are stored locally on your phone. Text fields are encrypted by the app; photos and audio use the phone’s file protection. You may choose to send audio for transcription or selected entries for an AI summary after giving consent. Do not send health information. You must have the right to make the recording and share it for the processing you select. Secretly recording other people’s conversations, abusive sharing and publicly sharing photos of people may be unlawful. Privacy rules may also apply when you process information about others.
4. Legal Basis (GDPR Art. 6)
We process your personal data based on the following legal grounds:
- Contract (Art. 6(1)(b)): Processing necessary to fulfill the agreement to provide the service to you.
- Legitimate interest (Art. 6(1)(f)): To improve the service and ensure secure operation.
- Consent (Art. 6(1)(a)): For processing that requires your explicit consent.
5. How Do We Use the Information?
Your personal data is used to:
- Analyze documents and text you submit
- Store history of your analyses
- Improve service quality (aggregated, non-content statistics only — never training on your documents)
- Provide technical support
- Fulfill legal obligations
6. Sharing of Information
We share your information with:
- OpenAI: OpenAI processes content for AI explanations, questions, searches for legal text, speech-to-text and text-to-speech. Questions or excerpts may be sent to the embeddings search service even when keyword search finds a relevant law. Filtering tries to reduce personal data but does not remove everything. Audio is sent with the recorded content. The updated server does not reuse or store new answers in the former shared answer cache. Older stored answers may still repeat personal information from questions. They have no user ID and are not automatically removed when an account is deleted; the former 14-day limit applied to reuse, not guaranteed physical deletion. Contact support about such older data. OpenAI is a US provider. API content is not used for model training by default; the provider may still retain operational and safety data.
- Google Firebase & Cloud Vision: Google provides sign-in, server infrastructure, storage and text recognition in images. Google Cloud Vision receives the original image to read its text before image redaction takes place. We use European storage regions and a European OCR endpoint. The provider’s operations and related services may also involve processing outside the EEA.
- RevenueCat: Subscription and payment management (USA, Standard Contractual Clauses)
- Sentry: Crash and error reporting (USA, Standard Contractual Clauses)
We never sell your personal data to third parties.
7. Storage and Security
Our database for analyses and history is in Stockholm (europe-north2), and uploaded document files are stored in Belgium (europe-west1). This does not mean that all processing by our service providers takes place in the EEA. The providers are described in section 6. We use the following protection:
- Encryption in transit (TLS/SSL)
- Encryption at rest
- Access control and logging
- Regular security audits
An automatic cleanup runs hourly and attempts to delete original files and document metadata older than 24 hours. Deletion therefore does not necessarily happen at exactly 24 hours, and failures or a backlog can delay it. Analyses remain until you delete them. Older shared Explainer answers are handled separately, as described in section 6. Provider retention follows their terms and the agreements governing their services.
8. Your Rights (GDPR Art. 15-22)
You have the following rights:
- Access: You can request a copy of all information we have about you.
- Rectification: You can request that incorrect information be corrected.
- Erasure: You can request that your information be deleted ("right to be forgotten").
- Restriction: You can request that processing be restricted.
- Data portability: You can request to receive your data in a machine-readable format.
- Objection: You can object to certain types of processing.
- Automated decisions: You have the right not to be subject to decisions based solely on automated processing that have legal effects for you. See section 8.5.
To exercise your rights, use "Delete all my data" in settings, or contact us at support@forklaraimeg.no.
8.5 Automated Processing (GDPR Art. 22)
The Service analyses your document automatically using AI. It does not make decisions about you.
- Article 22 covers decisions based solely on automated processing that produce legal effects or similarly significantly affect you. The Service produces an explanation – it does not grant, refuse, price or decide anything concerning you. You decide yourself what to do with the explanation.
- The explanation is AI-generated and can contain errors. If an analysis contains incorrect information about you, the right to rectification (Art. 16) and erasure (Art. 17) applies – see section 8.
- All AI-generated content in the app is marked as such, in line with the EU AI Act Article 50.
- We do not use your documents for profiling, and we do not build behavioural profiles across users.
9. Retention Period
We store your information for the following periods:
- Uploaded documents: The analysis flow attempts to delete them when processing ends. An hourly job also looks for files older than 24 hours. Failures, queues or many files can delay deletion; this does not guarantee deletion at exactly 24 hours.
- OpenAI: API content is not used for model training by default. Abuse-monitoring logs may normally be kept for up to 30 days, or longer when legally required. Some safety exceptions and API features have different rules. We do not promise zero retention by the provider.
- Analysis results: Until you delete them
- Explainer quota: The number of questions per day is stored per user, and deleted with the account
- Explainer statistics: One anonymous note per answer listing which laws and sections were looked up, and the day it happened. No question text, no user ID, no time of day
- Blackbox incidents: Stored locally until you delete
- Account information is deleted with the account. A temporary technical deletion marker prevents late server operations from recreating data. After cleanup is complete and deletion of the login account is confirmed, the marker receives an expiry time two hours ahead. Automatic cleanup is asynchronous and may happen later.
- Payments: We store pseudonymous purchase bindings, the subscription period and the number of analyses used to verify access and preserve the remaining quota when accounts change. Account user bindings are removed on deletion; purchase evidence and period usage remain temporarily. Verified quota records expire seven days after the later of the quota period and verified access, including any billing grace period. Before that verification, production purchase bindings expire seven days after the later of the store-reported expiry and receipt time. If the store date is missing, receipt time is used. Test purchase bindings are retained for at least 38 days. Longer verified access extends retention. Automatic cleanup is asynchronous and may happen later. These operational records are separate from any accounting records retained for five years under accounting rules.
10. Right to Complain
If you believe we process your personal data in violation of privacy regulations, you have the right to complain to the Data Protection Authority:
11. Changes
We may update this privacy policy from time to time. For material changes, you will be notified in the app.
12. Legal References
This privacy policy is prepared in accordance with:
- EU General Data Protection Regulation (GDPR) - Regulation (EU) 2016/679
- Norwegian Personal Data Act - Act on the processing of personal data (LOV-2018-06-15-38)
About this website
This website measures page views with Vercel Web Analytics. Vercel is an external provider and receives measurement requests. The measurement does not use cookies. It includes the visited page, referring page, country and browser type. Vercel describes counting unique visits with a hash that changes daily, and not storing the IP address in the analytics system. We do not link these website statistics to your use of the app.
Questions? Contact us at support@forklaraimeg.no