Privacy Policy

Overview

SecFlow ("we", "us") provides cybersecurity decision training through the SecFlow web application at secflow.app. This Privacy Policy explains what we collect, how we use it, and the choices you have. It applies together with our Terms of Service. By using SecFlow, you agree to this policy.

Who is responsible for your data

The data controller is Aidev ab, Fallstromsgatan 11, 43139 Molndal, Sweden. For privacy questions and requests, contact info@aidev.se.

Information we collect

• Account data: email address, display name, and authentication identifiers when you create an account or sign in with Google or Apple through Amazon Cognito.
• Learning progress: streaks, preferences, achievements and readiness signals stored in your browser and, when you sign in, in your account on our cloud provider.
• Answer history (signed-in users): for each scenario you answer, the scenario and version, the option you chose, whether it was correct (decided by our server) and the time. We use this to record progress, schedule review and measure whether the product helps people return and improve.
• Usage analytics: aggregated product events (for example onboarding completion, mission start or complete, audio playback, and sign-in completion) when Google Analytics 4 is enabled — see Analytics below.
• Technical data: browser type, device characteristics, approximate region from IP address, and standard server logs used to operate and secure the service.

Local storage and cookies

SecFlow stores preferences, progress, and session state in your browser's local storage so you can use the product without an account. We may use essential cookies or similar technologies required for authentication and security. We do not use advertising cookies.

How we use information

We use your information to:

• Deliver daily missions, briefings, readiness views, and features you request.
• Authenticate you and sync progress across devices when cloud features are enabled.
• Improve reliability, security, and product quality (including analytics).
• Respond to support requests and meet legal obligations.

We do not sell your personal information.

Analytics

When configured, we use Google Analytics 4 with a measurement ID supplied through environment configuration (not hard-coded in the application). Events help us understand how people use scenarios, the demo and audio features. Events do not include your email, account identifier or the answers you choose. Analytics storage is controlled by the in-product analytics cookie preference. We remember that preference for 180 days. You can also limit tracking with browser privacy settings or extensions that block analytics scripts.

Service providers

We use Amazon Web Services for hosting, sign-in (Cognito) and data storage, currently in the United States (us-east-1). Google and Apple process sign-in credentials according to their own policies when you choose those options. Google Analytics receives usage events only if you accept analytics. Audio briefings are narrated with an AI text-to-speech service from our written scripts; no learner data is sent to it.

Retention

We keep account, progress and answer history while your account is active. When you delete your account we remove it as described below. We keep one record after deletion: a one-way fingerprint of your account identifier (not your email) for about 13 months, so that a late subscription event or an old session cannot recreate your data. Service logs and backups may persist for a limited period where needed for security or legal reasons.

Account deletion

Signed-in users can delete their account in the product (Profile → Delete account). This deletes your answer history and subscription records on our servers, your profile, cloud progress and assessment results, your sign-in identity, and SecFlow data stored in that browser. You do not need to contact us to complete it. If a step fails, nothing further is removed and you can retry; if it keeps failing, email info@aidev.se.

Deleting your account does not cancel an App Store or Google Play subscription; manage that in your store settings. If you signed in with Apple, you can additionally remove SecFlow in your Apple ID settings under Sign in with Apple.

Automated coaching and AI providers

Coaching is written in advance and shown after you answer; it is not generated live from your response. We do not send your answers to any generative-AI provider. Google Analytics may receive product-usage events when analytics is enabled, as described above.

Your rights

Depending on your location, you may have rights to access, correct, export, or delete personal data, or to object to certain processing. Contact info@aidev.se to exercise these rights. We will respond within a reasonable time.

Children

SecFlow is intended for working professionals. We do not knowingly collect personal information from children under 16.

Changes

We may update this policy. Material changes will be reflected by the "Last updated" date on this page. Continued use after changes constitutes acceptance of the revised policy.