Last updated: October 2026
Data Controller
Vorkurs Atelier is operated as an independent project by Kaspar Bredahl Rasmussen. Contact: kasparbredahl@proton.me
What Data We Process
When you use Vorkurs Atelier, we process the following information about you:
Without signing in
You can use Vorkurs Atelier without signing in.
When you sign in
- Your email address — stored permanently to identify your account and send you login links.
- A display name automatically derived from your email address (e.g. 'kari.nordmann@…' becomes 'Kari Nordmann').
- Timestamps of your first and most recent login.
- A temporary one-time code ('magic link') sent to your email, valid for 15 minutes.
- A session cookie (lc_session) stored in your browser, valid for 7 days, to keep you signed in.
- Your custom tools and your tool library choices, stored with your account so they are the same on all your devices.
When you save a learning design
- The content of your plan (course information, learning outcomes, sessions, activities, tool choices, and notes).
- A unique plan ID and the name you give your plan.
- Timestamps (when the plan was created and last modified).
- The link between the plan and your account (ownership, collaborators, visibility setting).
- A cryptographic hash (bcrypt) of the password if you choose to password-protect a shared plan. The password itself is never stored.
When you invite collaborators
When you invite a colleague, we temporarily store their email address until they sign in. An invitation email is sent from the service to that address. When the invitee signs in, the invitation is converted into a collaboration link and the email is removed from the invitations table.
Sharing, and what to keep out of plans
Plans shared by link can be read by anyone with the link.
What we do NOT collect
We do not store IP addresses, browser, or device information in the application database. We use no third-party tracking tools such as Google Analytics, Matomo, Hotjar, or advertising pixels. The web server that runs the service keeps automatic logs: access logs with IP address, time and the page requested, and error logs, which also record the IP address of the request that caused the error. The logs are used only for troubleshooting and security, and are deleted automatically after at most 15 days.
Purpose of Data Processing
We use your information solely for (1) authenticating you and keeping you signed in, (2) storing, retrieving, editing, and deleting your own plans, (3) enabling you to collaborate with colleagues, and (4) letting you share plans via links. We do not use your data for marketing, profiling, advertising, resale, or any other purpose.
Legal Basis
We process your data on the basis of your consent (GDPR Article 6(1)(a)). You give consent when you sign in, save a plan, or invite a collaborator. You can withdraw your consent at any time by requesting deletion (see Your Rights). The web server logs and the backups are based on legitimate interest (Article 6(1)(f)): keeping the service secure and running, and being able to restore data after a failure.
Data Storage and Security
Your data is stored in a database on a server at Hetzner in Helsinki (Finland, EU). All communication between your browser and the server is encrypted with HTTPS/TLS. Passwords for password-protected plans are stored as bcrypt hashes, never in plain text. Login and session tokens are randomly generated 256-bit values. Login attempts are rate-limited to five per email address per hour.
Third Parties and Data Processors
The server is rented from Hetzner Online GmbH.
To send login links and collaboration invitations, we use MailPace (mailpace.com). The emails are sent from noreply@vorkurs.eu, and replies go to info@learnsmith.eu. MailPace receives the recipient's email address and the content of the email in order to deliver it, and stores this data on servers in France (EU). The emails themselves are sent out through MailPace's mail servers in the United Kingdom, which is covered by the EU's adequacy decision for the UK (valid until December 2031). Everything else the app needs, including JavaScript and CSS libraries, fonts and icons, is served from vorkurs.eu itself, so your browser does not contact any other services.
Data Retention
Your account, your plans and your synced settings (custom tools and tool library choices) are stored until you delete them. Login one-time codes have a maximum lifetime of 15 minutes. The session cookie lasts 7 days or until you log out. Pending collaboration invitations are removed when the invitee signs in. We currently have no automatic deletion of inactive accounts — you can delete your account at any time via the 'Delete my account' option in your user menu.
Your Rights
Under GDPR, you have the right to:
- Access the data we have about you (art. 15): log in and view 'My Saved Plans' under 'Open from the cloud', or contact us.
- Correct inaccurate data (art. 16) — edit plans directly in the app, or contact us for account details.
- Delete your data (art. 17) — delete individual plans via the delete button, or delete your entire account via the 'Delete my account' option in your user menu.
- Data portability (art. 20) — use the export function to download your plans as JSON or PDF.
- Withdraw consent (art. 7(3)) — delete your account or stop using the service.
- Lodge a complaint with a supervisory authority (art. 77) — in Norway: www.datatilsynet.no
Cookies
Vorkurs Atelier uses one technically necessary cookie: lc_session, which keeps you signed in for 7 days. It is flagged HttpOnly and SameSite=Lax, and is set with the Secure flag over HTTPS connections. We use no tracking, analytics, or marketing cookies. We therefore do not ask for cookie consent — the technical cookie is exempt from the consent requirement because it is strictly necessary for you to stay signed in.
Contact
For questions about this privacy policy or to exercise your rights, contact: kasparbredahl@proton.me
