Last updated: April 2026
Data Controller
Vorkurs Atelier is operated as an independent project by Kaspar Bredahl Rasmussen. Contact: kasparbredahl@proton.me
What Data We Process
When you use Vorkurs Atelier, we process the following information about you:
When you sign in
- Your email address — stored permanently to identify your account and send you login links.
- A display name automatically derived from your email address (e.g. 'kari.nordmann@…' becomes 'Kari Nordmann').
- Timestamps of your first and most recent login.
- A temporary one-time code ('magic link') sent to your email, valid for 15 minutes.
- A session cookie (lc_session) stored in your browser, valid for 7 days, to keep you signed in.
When you save a learning design
- The content of your plan (course information, learning outcomes, sessions, activities, tool choices, and notes).
- A unique plan ID and the name you give your plan.
- Timestamps (when the plan was created and last modified).
- The link between the plan and your account (ownership, collaborators, visibility setting).
- A cryptographic hash (bcrypt) of the password if you choose to password-protect a shared plan. The password itself is never stored.
When you invite collaborators
When you invite a colleague, we temporarily store their email address until they sign in. An invitation email is sent from the service to that address. When the invitee signs in, the invitation is converted into a collaboration link and the email is removed from the invitations table.
What we do NOT collect
We do not store IP addresses, browser, or device information in the application database. We use no third-party tracking tools such as Google Analytics, Matomo, Hotjar, or advertising pixels. The web server that runs the service (one.com) maintains automatic access logs that typically include IP address and timestamp — these belong to the provider and are used only for troubleshooting and security.
Purpose of Data Processing
We use your information solely for (1) authenticating you and keeping you signed in, (2) storing, retrieving, editing, and deleting your own plans, (3) enabling you to collaborate with colleagues, and (4) letting you share plans via links. We do not use your data for marketing, profiling, advertising, resale, or any other purpose.
Legal Basis
We process your data on the basis of your consent (GDPR Article 6(1)(a)). You give consent when you sign in, save a plan, or invite a collaborator. You can withdraw your consent at any time by requesting deletion (see Your Rights).
Data Storage and Security
Your data is stored in a MySQL database hosted by one.com (Denmark, EU). All communication between your browser and the server is encrypted with HTTPS/TLS. Passwords for password-protected plans are stored as bcrypt hashes, never in plain text. Login and session tokens are randomly generated 256-bit values. Login attempts are rate-limited to five per email address per hour. The service is planned to move to Hetzner (Finland, EU) during 2026 alongside a new domain vorkurs.eu — all data will remain within the EU/EEA.
Third Parties and Data Processors
To send login links and collaboration invitations, we use one.com's SMTP service (sender: noreply@abc-ld.no). To display the user interface, your browser loads some JavaScript and CSS libraries (Bootstrap, Font Awesome, Chart.js and others) from public content delivery networks: cdn.jsdelivr.net (operated by Fastly) and cdnjs.cloudflare.com (operated by Cloudflare). These requests mean your IP address is visible to those services. We do not use them for tracking or analytics, and we set no cookies via them.
Data Retention
Your account and plans are stored until you delete them. Login one-time codes have a maximum lifetime of 15 minutes. The session cookie lasts 7 days or until you log out. Pending collaboration invitations are removed when the invitee signs in. We currently have no automatic deletion of inactive accounts — you can delete your account at any time via the 'Delete my account' option in your user menu.
Your Rights
Under GDPR, you have the right to:
- Access the data we have about you (art. 15) — log in and view 'My Courses', or contact us.
- Correct inaccurate data (art. 16) — edit plans directly in the app, or contact us for account details.
- Delete your data (art. 17) — delete individual plans via the delete button, or delete your entire account via the 'Delete my account' option in your user menu.
- Data portability (art. 20) — use the export function to download your plans as JSON or PDF.
- Withdraw consent (art. 7(3)) — delete your account or stop using the service.
- Lodge a complaint with a supervisory authority (art. 77) — in Norway: www.datatilsynet.no
Cookies
Vorkurs Atelier uses one technically necessary cookie: lc_session, which keeps you signed in for 7 days. It is flagged HttpOnly and SameSite=Lax, and is set with the Secure flag over HTTPS connections. We use no tracking, analytics, or marketing cookies. We therefore do not ask for cookie consent — the technical cookie is exempt from the consent requirement because it is strictly necessary for you to stay signed in.
Contact
For questions about this privacy policy or to exercise your rights, contact: kasparbredahl@proton.me