privacy
How we handle your data
Plain language, no dark patterns. This notice explains what personal data Temja processes, why, and the control you have over it. Temja is a product of Anilata AB, a company registered in Sweden and based in Gothenburg.
Last updated 12 July 2026
The short version
- We keep only the data we need to run the training and produce the evidence you use for compliance.
- Your data lives in the EU. We do not sell it, ever.
- We load no analytics or advertising trackers. Only essential cookies keep you signed in and block bots.
- You can access, correct, export, or delete your account data. Some evidence records are kept to meet a legal obligation.
Who is responsible
For your account, billing, and marketing data, the controller is Anilata AB (Gothenburg, Sweden). Contact us at privacy@temja.eu.
For the training and evidence records inside a customer workspace, the customer organization is the controller and Anilata AB acts as a processor on their documented instructions, under a data processing agreement. If you are a learner, direct data requests to your organization first; we will support them.
What we process, and why
We keep data to distinct purposes, each on a clear legal basis.
Account and organization
Name, work email, role, and organization details. Basis: performance of our contract with you (Art 6(1)(b)).
Training and evidence records
Lessons completed, quiz results, drill outcomes, and signed attestations, written to a tamper-evident, hash-chained audit log. Basis: our contract, and the customer's legitimate interest and legal obligations in demonstrating compliance.
Technical and security data
IP address, device and browser information, and request logs, including bot-protection checks via Google reCAPTCHA Enterprise. Basis: our legitimate interest in keeping the service secure and available (Art 6(1)(f)).
We send transactional email (verification, welcome, notices) through Resend, and operate inbound mailboxes through Migadu. Basis: contract and legitimate interest.
Billing
When you subscribe, payment and invoicing are handled by Lemon Squeezy as merchant of record. We do not store card details. Basis: contract and our legal obligations.
Who else processes your data
We use a small set of vetted subprocessors, each bound by a data processing agreement. The current list, with roles and regions, is on our security page. In short: Google Cloud and Firebase for hosting, authentication, and database; Resend for outbound email; Migadu for inbound email; Lemon Squeezy for billing.
Where your data lives
Application data is hosted in the European Union (Google Cloud, europe-west region). Outbound email routes through the EU. Where a subprocessor operates outside the EU, we rely on an adequacy decision or the EU Standard Contractual Clauses. We do not transfer personal data to the United States for storage.
How long we keep it, and erasure
We keep account data for as long as your organization uses Temja, then delete or anonymize it within a reasonable window after the account closes.
Evidence records are different by design. The audit log is hash-chained and append-only so that a completed training cannot be silently altered. Where we or a customer must retain that evidence to meet a legal obligation or to establish, exercise, or defend a legal claim, we may keep it even after an erasure request, as permitted by Art 17(3) of the GDPR. We will explain what is retained and why when you ask.
Your rights
Under the GDPR you can ask us to:
- access the personal data we hold about you;
- correct data that is wrong or incomplete;
- delete data, subject to the retention limits above;
- restrict or object to certain processing;
- receive your data in a portable format.
Email privacy@temja.eu and we will respond within one month. If you are a learner in a customer workspace, contact your organization first. You also have the right to complain to a supervisory authority. Ours is the Swedish Authority for Privacy Protection (IMY, imy.se), and you may also contact the authority where you live or work.
Changes to this notice
We update this notice when our processing changes and revise the date at the top. Material changes will be communicated to account owners.
Questions? Write to privacy@temja.eu.