Privacy Policy

This Privacy Policy explains how Förarprov Watch (“we”, “us”, “the app”) collects, uses, and protects your personal data when you use our website and mobile applications (the “Service”). We are an independent service and are not affiliated with, endorsed by, or operated by Trafikverket. By using the Service you agree to this Policy.

Data we collect

• Account: an anonymous account is created automatically. You may optionally provide an email address for support and email alerts.
• Trafikverket connection: if you enable searching and reservations, your Swedish personal identity number (personnummer) and your authenticated Trafikverket session. Both are encrypted at rest and used solely to search for and reserve test slots on your behalf.
• Watch criteria: the licence type, test type, locations, date range, and times you ask us to watch.
• Notification details: device push tokens, and — if you provide one — a phone number for SMS alerts (a Pro feature).
• Booking activity: records of reservation attempts and held slots.
• Technical data: standard server logs (IP address, timestamps, device/browser information) used for security and reliability.
• Advertising identifier: for free‑tier users only, a mobile advertising identifier (IDFA/Advertising ID) used to show ads — see “Advertising” below.

How we use your data

• To operate the Service: watch for matching slots and, for Pro users with auto‑reserve enabled, hold a matching slot for you to complete manually.
• To send you notifications by push, email, and (Pro) SMS.
• To provide support and respond to your requests.
• To keep the Service secure and prevent abuse.
• To process subscriptions and comply with our legal obligations.

Legal basis (GDPR)

We process your data on the basis of performance of a contract, consent (for notifications and for storing your personnummer and Trafikverket session, which you may withdraw at any time), and our legitimate interests (to secure and improve the Service).

Sensitive data & credentials

Your personnummer and Trafikverket session are sensitive. The session is a credential — treat it like a password. We store both encrypted (AES‑256‑GCM) and use them only to act on your behalf within Trafikverket’s booking system. You can disconnect at any time, which deletes the stored session.

Your identity & devices

You connect with BankID. In addition to the encrypted personnummer, we store a non‑reversible hash of it. The hash is used only to recognise you as the same person across your own devices and reinstalls — so your watches, Pro subscription, and phone number follow you — and is never used to identify you to third parties or for advertising.

Who we share data with

We do not sell your personal data. We use trusted service providers (processors and partners) that act on our behalf to run the Service, and only as needed — in the following categories:

• Cloud hosting & database providers.
• Notification providers (push, email, and SMS for Pro).
• Payment & subscription providers (the app stores and our subscription manager).
• Advertising — for users of the free tier, Google AdMob serves ads (see “Advertising” below). Pro subscribers see no ads.
• Trafikverket — we send requests to fp.trafikverket.se on your behalf using your session.

We can provide the names of the specific providers in each category on request.

Advertising

The free version of the app shows ads via Google AdMob. Pro subscribers do not see ads. To serve ads, AdMob may process a mobile advertising identifier (Apple IDFA / Google Advertising ID) and related technical data. In the EU/EEA we ask for your consent through Google’s consent message before any personalised ads are shown; if you decline, you still receive non‑personalised ads. On iOS we also ask for App Tracking Transparency permission. You can change your choice at any time under Account → Ad & privacy choices, and you can reset your advertising identifier in your device settings. See Google’s advertising policies for how Google uses this data.

Data retention

We keep your data while your account is active. Your Trafikverket session is removed when you disconnect or when it expires. You can request deletion of your account and associated data at any time, except where we must retain certain records to comply with the law.

International transfers

Some subprocessors may process data outside the EU/EEA. Where that happens, we rely on appropriate safeguards (such as the European Commission’s Standard Contractual Clauses).

Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, and port your data, to object to processing, and to withdraw consent. To exercise any of these, contact us at info@tartly.se. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

Children

The Service is not directed at children under 13, and we do not knowingly collect data from them.

Security

We protect your data with encryption in transit (TLS) and encryption at rest for sensitive secrets. No method is completely secure, but we use industry‑standard measures.

Changes to this Policy

We may update this Policy from time to time and will change the “Last updated” date above.

Contact

Questions about this Policy or your data? Email us at info@tartly.se.