Privacy Policy — WorksheetMint
Draft — updated October 29, 2026. Balancing assessments IA-01–IA-03 are approved; the legal basis for other processing, provider agreements, international transfers and some retention periods are not finally established.
Controller and contact
The controller is Martin Bekkelund, sole trader. The business covers Skapablad.se and WorksheetMint, two websites operated within the same sole proprietorship by Martin Bekkelund. Contact us at the email address below about privacy.
No accounts and local processing
You do not need an account. Worksheets, answer keys, PDF and Word files are created and pupil answers are checked mainly locally in your browser in the features we have reviewed. Only the administrator signs in, for content management.
Name worksheets are never saved automatically. Vocabulary and pupil results are not saved persistently automatically. Sheets you actively save may remain on the same device until you delete them – keep this in mind on shared computers. Error reports use a plain email link with no automatic content.
Share links
New share, answer-key and pupil links carry content in the # part of the address (fragment), which the browser does not send to the server. Older links with content after ? still work and are moved to the # part when opened, but the first HTTP request may already have exposed the content in operational logs and cannot be undone. Anyone who receives a link can read its content. Do not share pupils’ names or personal details in links.
Ads, visitor analytics and operational logs
Google AdSense is turned off. Lovable Visitor Analytics is turned off.
Lovable runs the hosting and keeps technical operational logs. According to Lovable, the logs contain IP address, the requested address including the query part (?), method, status code, timing information and approximate location. Operational logs are not the same as visitor analytics. Lovable has not stated exact maximum retention periods for operational logs and backups.
Recipients and agreements
Lovable provides publishing, hosting and the database for content management. Lovable has stated that its data processing agreement (Business DPA) applies only from an actual upgrade, planned for November 10, 2026. The agreement is therefore not yet in force. Cloudflare is used for bot protection. Contact requests are handled in Google Gmail. The providers’ exact roles and where data is processed geographically are not finally confirmed.
Purposes and legal bases
Technical data and operational logs are needed to deliver the website and protect it from abuse. Email is used to answer questions and correct content. The administrator’s sign-in is used for secure content management. The legal basis for website operation and security (IA-01), ordinary contact requests (IA-02) and administration and access control (IA-03) is legitimate interest under GDPR Article 6(1)(f), within each documented scope. The controller reviewed and approved these balancing assessments on 29 October 2026. The legal basis for any other processing has not yet been determined.
Retention and deletion
On October 26, 2026 the controller adopted manual retention rules. Ordinary email is deleted 12 months after the matter is closed, unless law requires longer retention. Approved archive images are reviewed for need at least annually. Historical records from removed features – earlier error reports, any cloud-saved packs and unreviewed or rejected archive images – remain until manually deleted under the same rules (reports 90 days after closure, open reports reviewed after 180 days, unreviewed/rejected images after 30 days, packs on request or termination); no new such records can be created. The rules are carried out manually and recorded in a deletion log. No automated deletion is implemented, and deletion at providers, in logs and backups is not confirmed. Actively saved sheets and settings do not expire (word lists passed between tools disappear when the tab closes); delete them in the service or clear browser site data.
Your rights
You can ask what data we hold about you, have it corrected or deleted, restrict processing or object to it. Email the address below; do not include pupil details. You delete content stored locally in your browser yourself, in the service or by clearing site data. If you are dissatisfied you can complain to the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority.