Privacy Policy

Last updated: 2026-10-03

This policy is available in Icelandic and English. For Polish and Ukrainian users the English version applies.

1. Who is the controller

The controller of the processing is Samstarf ráðgjöf ehf., Reg. no. (kennitala) 460120-0630 (“we”). Controller email: samstarf@samstarf.is. Requests about your rights, account deletion and support: hlustum@hlustum.is.

This policy applies to the website www.hlustum.is and the Hlustum.is mobile app (iOS and Android).

2. What Hlustum.is is

Hlustum.is is a reading-comprehension tool for parents and guardians. You photograph pages the child reads, AI generates five questions from the text, the child answers, and you see a simple result and progress. You can invite others to see the child's progress.

3. What data is processed

Your email address: You provide it when signing in. Sign-in is passwordless: we email you an 8-digit code. The email address identifies your account.
Child's name or nickname and age (optional): You, as parent or guardian, enter this to tell children apart on the account and show progress. We recommend a nickname.
Reading results: Number of questions, how many were answered correctly on the first attempt, results per skill area, timestamp and technical version information (e.g. the AI model name). The reading material itself is not stored.
Access invitations: When you invite others to see a child's progress we store the invitee's email address, the role (guardian or follower), whether they may invite others, the inviter's email address and the invitation status.
Photos of reading material: Photos you take or choose in the app are used only to generate questions (see the AI section). Hlustum does not store them.
Technical data: When requests are processed, hosting providers see technical information such as the IP address and time. The app also sends simple technical diagnostics (status and timings in milliseconds) containing no content, names or photos, used to find errors.
Data on your device: Language choice, the active child and the sign-in session are stored on your device so the app works. The operating system may also keep a photo temporarily in the device cache when the camera or photo library is used; that stays on your device and is not sent to us beyond what is described here.

We do not collect national ID numbers, phone numbers, addresses, location, contacts, audio, dates of birth or advertising identifiers. Hlustum.is has no advertising, no analytics tools and no tracking for advertising purposes. We do not sell data. The app only asks for access to the camera and photo library.

4. Purposes and legal basis

Providing the service (sign-in, questions, results, progress, access): contract, Art. 6(1)(b) of the EU General Data Protection Regulation 2016/679 (GDPR) and Icelandic Act No. 90/2018.
Data about a child: entered by a parent or guardian; processing rests on the guardian's consent and responsibility on the child's behalf, Art. 6(1)(a) and Art. 8 GDPR. By adding a child you confirm you are entitled to do so.
Security, troubleshooting and abuse prevention (technical data): legitimate interests, Art. 6(1)(f) GDPR.
We make no automated decisions with legal effect on a child. A reading result is a simple indication.

5. Photos of reading material and AI

When you generate questions, the photo is downsized on your device (JPEG, at most 1600 pixels on the longest side) and sent to our service at www.hlustum.is, hosted by Vercel, and on to the AI provider Anthropic (Claude). The model reads the text and generates the questions.

Hlustum does not store the photos. They exist only in device and server memory while the questions are generated. Our logs record only the number and size of photos, never the content.
A short summary of how the child has done per question type (e.g. “strong” or “needs practice”) may accompany the photos. It contains no name, age or email address.
The photos are processed by Anthropic under Anthropic's terms for API use. How long Anthropic retains data and for what it is used is governed by those terms and Anthropic's policies; see anthropic.com/legal/privacy.
A photo of reading material may contain personal data, e.g. a name written on a page. We recommend photographing only the text of the book.

6. Processors and recipients

Supabase: Data storage and sign-in (email, children, results, access invitations). The Hlustum database is in the eu-west-1 region (Ireland, within the EU).
Vercel: Hosting of the website and backend service (photos and requests in transit, technical logs).
Anthropic: AI that reads a photo of reading material and generates questions.
Resend: Email delivery: invitations to see a child's progress (recipient's and inviter's email address). Sign-in codes are emailed by the sign-in service (Supabase) through its email delivery service.

Where processors handle data outside the European Economic Area (e.g. in the United States), the transfer relies on the mechanism required by the GDPR, such as EU standard contractual clauses or an adequacy decision, under the respective provider's terms. We do not share data for advertising and do not sell data.

A person you invite gets access to the child's name or nickname, age and results, and sees your email address in the invitation email.

7. Who can see what

Founder (parent): sees and manages everything, and can edit a child and delete it with its results.
Guardian (invited): sees progress, can run readings and manage others' access, but cannot rename or delete the child.
Follower: sees progress and can run readings, but cannot edit or delete the child.
Access is protected by database-level access rules (Row Level Security), so only people who have been given access see a child's data.

8. Retention

Account data, children, results and access are kept while the account exists or until you delete them.
When a child is deleted in the app, all its results and access invitations are deleted too.
When an account is deleted, the profile, quiz-generation counters, invitations you sent or received, your access to other people's children and the sign-in account itself (your email) are deleted. For children you founded: if another guardian has access, the founder role moves to the guardian who has been on the child the longest and the child and its history stay; otherwise the child and everything tied to it (results, access and invitations) is deleted and followers lose access.
Photos of reading material are not retained by us.
Hosting providers and Anthropic keep technical logs and, where applicable, data under their own policies.

9. Your rights

You have the right of access to your data, rectification, erasure, restriction of processing, objection, data portability and to withdraw consent at any time.

To exercise your rights or request deletion of your account and all related data, email hlustum@hlustum.is. We reply within 30 days.
In the app you can edit a child's name and age, delete a child with its results, remove others' access and leave a child you were invited to.
You can delete your account yourself in the app and on the website: Menu → Subscription → “Delete my account”. Deletion is irreversible. See hlustum.is/delete-account/en. You can also request deletion by email (see the first item).
You may lodge a complaint with the Icelandic Data Protection Authority (Persónuvernd): www.personuvernd.is.

10. Children

Hlustum.is is intended for parents and guardians. The person who signs in is an adult; a child has neither an account nor an email address. The child answers questions on the guardian's device, within the guardian's signed-in account. Data about a child (name or nickname, age and results) is entered by the guardian, who is responsible for being entitled to do so. We do not knowingly collect personal data directly from children without a guardian.

If you believe a child has sent us information without a guardian's permission, contact hlustum@hlustum.is and we will delete it.

11. Security

All connections use HTTPS.
Passwordless sign-in with a code sent to your email address.
Database access control (Row Level Security) on all tables about children and results.
Secret keys exist only on the server, not in the app or the website.

No system is perfectly secure. If a security breach affects your rights, we will report it as required by law.

12. Changes to this policy

We may update this policy. Changes are published here with a new date at the top of the page. If changes are material, we will draw attention to them in the service.

13. Contact

Questions, requests for access, rectification or deletion and other privacy matters: hlustum@hlustum.is.