Privacy policy

lets-onboard is provided by Core4it ApS (“we”, “us”), a Danish private limited company, Nordre Frihavnsgade 84, 5. th., 2100 København Ø, Denmark, CVR number 46251377, VAT number DK46251377.

Questions about this policy and requests about your data: [email protected]. We have not appointed a data protection officer; GDPR article 37 does not require one of a company of our size and activity.

Companies (our customers) use lets-onboard to build onboarding journeys and e-learning courses from their own material and to train their people. Each customer decides what its admins upload, whom it invites and what it assigns.

For everything inside a customer's account — the people it invites, the material it uploads, what is built from it and the learning records — the customer is the controller and we are its processor (GDPR article 28). We process that data only on the customer's instructions, under the data processing agreement that is part of our terms of service. If your employer invited you, your employer decides why your data is processed; ask your employer first, and we will help your employer answer.

For a few things we decide ourselves, so we are the controller: the contact details of the people our customers appoint to deal with us, invoicing and bookkeeping, the security measures that protect the service, and this website's public pages, the contact form on them, and the email you send us. Section 4 says which is which.

As the customer's processor, inside the customer's account:

• Account details: your name, your email address, your role (admin or learner), your company, an optional start date, who invited you, and when you were invited, joined and last signed in.
• Material admins upload: documents (PDF, Word, text and Markdown, up to 20 MiB each), screenshots and pictures (photos of the workplace, its people or its products), and a cover picture for a course, with their file names; the text lets-onboard reads out of each document; what it reads in each screenshot (the elements on it) and in each picture (a description of what it shows); the admin's interview answers; the project's name, the role it is for and its description; and the journeys and courses built from all of it. Images — a course's cover picture too — and pictures inside Word documents, are stored without the details embedded in them (such as the camera, the location or the author). Word documents are stored without their document properties (the author, the company, editing times and the like), comments, the list of people who edited them, their tracked changes (insertions are kept as ordinary text, deletions removed, and the names and times of both dropped) and the files embedded in them; a Word document with something we can't clean isn't accepted. PDFs are stored exactly as uploaded, including any details embedded in them, such as the author. If the material contains personal data about anyone, it is the customer that chose to upload it.
• Learning records: each learner's progress through a journey or course (which steps are done and when, tries and hints used), each final assessment attempt (the answers given, the score, whether it passed, and when), and the certificates issued (the learner's name as it was then, the course, the company, the score and the date). The company's admins see these records for their people, including each attempt's answers and score.
• Sign-in and security data: one-time sign-in, invitation and email-change links, and the session that keeps you signed in. We store only a SHA-256 hash of each, with when it was made, used and expires; the link itself exists only in the email sent to you and never reaches our server in a way we log. While you confirm a new email address, the new address is stored until you confirm it.
• Email: to send you an invitation, a sign-in link, a confirmation of a new address, a notice that your address was changed or a notice of assigned learning, our mail service receives your email address, the name of the letter to send and what fills its blanks: your company's name, the title of what was assigned, and the link.

As the controller, for our own purposes:

• Customer contacts: the names and email addresses of a customer's admins and of the people who deal with us about the agreement, with what they wrote to us. Our operator tools show us each customer's admins, when they joined and last signed in, and the customer's use of AI features — never the customer's content, learners or learning records.
• The contact form: if you write to us through the form on the landing page, the name, company and email address you give, your phone number if you give it, and your message. They reach us as one email through our email provider (section 6) and are kept in our mailbox; nothing is stored in the service, and no cookie is set.
• Billing records: invoices and the accounting records the law requires.
• Rate-limiting counters: to stop abuse, we count requests per sender — sign-in requests, links, and messages through the contact form — for about an hour. The counter is keyed by a keyed hash (HMAC-SHA256) of the client address, the email address or the account, so the database never holds the address itself.
• Usage of AI features: for each AI step, the operation, its cost, the amounts of text sent and received, the project it was for, its status and when it ran. It holds no content and no person's identity.
• Service logs: one line per request with the method, the path, the status, the duration and the internal identifiers of the account and the company that made it, so we can find and fix faults and spot abuse. Logs never hold names, email addresses, client addresses, link tokens or uploaded content; a redaction layer masks them if they ever appear.
• Visitors to the public pages and the demos: no cookie set, no analytics and nothing stored on our side (the demos run in your browser tab), unless you send us a message through the contact form (above). If you chose light or dark mode while signed in, your browser sends that choice along, and it only sets how the pages look. Requests pass through our network provider, which sees your IP address (section 6), and are logged as above.

We don't sell personal data, don't use it for advertising, and don't profile anyone. No decision about you is made automatically with legal or similarly significant effects (GDPR article 22): an assessment is scored against the answers your company's admins approved, and what your company does with the result is your company's decision.

To read uploaded material and draft content, lets-onboard sends the relevant text and images to Anthropic, PBC, which runs the AI models on our behalf (section 6). This happens only when one of a company's admins starts an analysis (the links between screens are then inferred automatically), the interview, a build (which also proofreads what it builds and reviews its questions), a redraw or the re-matching of a replaced screen, asks for the language or the questions of a journey or course to be checked, asks the assistant a question or asks it for a change, and only within the company's monthly AI allowance. What is sent: the text read out of documents and their names, the screenshots and the pictures a company uploads, the interview conversation, the drafts being built, the assistant conversation (the admin's questions and the answers), the journey or course as built (its outline and the parts being rewritten), the notes and the company profile, the project's name, role and description, and the company's name. Nothing about learners — no names, addresses, progress, answers or certificates — is ever sent for AI processing, and the AI never evaluates a person.

What comes back is saved with the project. Each result is also kept for reuse within the same company, so the same request about the same material isn't sent again. It is never used for another company. It is deleted as soon as any project it was made for or used in is deleted, even if other projects used it, and in any case after 90 days without use.

Under its data processing addendum and commercial terms, our AI provider does not use what we send to train its models, and deletes inputs and outputs within 30 days, except where the law requires longer retention or its safety systems flag a request (then up to two years). We have no zero-data-retention arrangement with it.

The interview and the assistant are conversations with an AI, the journeys and courses are AI drafts, and the changes the assistant proposes are AI drafts the admin reviews before they apply: the admins who build them are told so in the product, review and edit them before assigning them, and your company remains responsible for the training it gives you (EU AI Act, Regulation (EU) 2024/1689, article 50).

Everything is stored on one server at our hosting provider in the EU. Three other providers take part. Each is bound by a data processing agreement under GDPR article 28, and the customer can object to a new one as the data processing agreement describes.

We disclose personal data to no one else, unless the law obliges us to (for instance a court order), in which case we tell the customer where we may.

• Account details and learning records are kept while the customer's account is active, or until an admin deletes the person. When an admin deletes a learner, their progress, attempts, certificates, sessions and links are deleted with them. Removing an assignment does not delete what the learner already earned. When an admin deletes a project, its uploaded files, what was read in them, the interview answers, the AI results kept for reuse and everything built from them are deleted too. The record of AI usage keeps only the project's internal reference and the figures of each step. The company's own settings — what its certificates say, including who signs them, and its look — are kept while the customer's account is active.
• Links and sessions: a sign-in link works once and for 15 minutes, an invitation for 30 days, an email-change confirmation for 24 hours. A session ends when you sign out, after 7 days without use, and after 30 days at most. The hashed record of a used or expired link is deleted within 24 hours of that, and ended sessions within an hour.
• Rate-limiting counters are deleted after 60 minutes.
• A message sent through the contact form is kept in our mailbox for 12 months after our last reply, unless it leads to an agreement, when it is kept with the customer's contacts.
• AI results kept for reuse go with the project they came from, and after 90 days without use.
• Service logs are kept for 30 days.
• Backups: the whole database is copied once a day and the last 14 copies are kept, so something deleted in the service remains in backups for up to 14 days and then disappears. Backups are restored only to recover the service, never to bring back what a customer deleted.
• When a customer's agreement ends, its data stays available for 30 days so the customer can retrieve what it needs, and is then deleted; the backups follow within 14 days after that. Customer contacts are kept for as long as the agreement and the 30 days; billing records for five years after the end of the financial year they belong to (bogføringsloven § 12).

In the service: each company's data is kept apart by the database itself, not only by the application — every query is scoped to one company, and another company's data reads as “not found” whatever the code does. Access is by invitation only, sign-in uses single-use links rather than passwords, links and sessions are stored only as hashes, and the session cookie is readable by nothing but our server. Connections are encrypted end to end (your browser to our network provider, and its tunnel to our server). Every page tells the browser to load nothing from anywhere else. Uploaded images and Word documents are stripped of hidden metadata before they are stored. Each process on the server runs with its own database login that can reach only the tables it needs; only the AI process holds the AI key and it can reach nothing but the AI provider; the mail process can reach nothing but the mail provider.

Within our company: the server, the database and the backups can be reached only by the people at Core4it ApS who operate the service, with their own keys, and only to run it. Our operator tools show us each customer's admins and its use of AI features, never its content, learners or learning records, and have no way to sign in as a customer. If a customer has lost all its admins, we can invite a new one for it — only on the customer's written request. Our staff are bound to confidentiality.

If a breach of security leads to the loss, alteration or disclosure of personal data, we tell the affected customer without undue delay and within 48 hours of becoming aware of it, with what the customer needs to meet its own duties, and we notify Datatilsynet ourselves where we are the controller (GDPR articles 33 and 34).

Under GDPR articles 15 to 22 you may ask for access to the personal data held about you, have it corrected or deleted, have its processing restricted, receive it in a portable form, and object to processing based on legitimate interests. You can change your name and email address yourself on your account page. Your company's admins can correct or delete your account and learning records.

For data inside your company's account, your company is the controller: ask your company, and we help it answer within the time the law allows. For data we control, write to [email protected]; we answer within a month (GDPR article 12).

You can complain to the Danish Data Protection Agency: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, [email protected], +45 33 19 32 00, datatilsynet.dk (GDPR article 77). If you live in another EU/EEA country you may complain to the authority there instead.

lets-onboard uses one strictly necessary cookie to keep you signed in, one that remembers the light or dark mode you choose, and no analytics, advertising or third-party cookies. The cookie page explains them, and what the app keeps in your browser.

When this policy changes, the date at the top changes with it. We tell our customers' admins by email at least 30 days before a change that reduces their or their people's rights or adds a purpose or a subprocessor; smaller corrections take effect when published. This policy is governed by Danish law and published in English and in Danish; for customers in Denmark the Danish version governs.