Privacy Policy
This page is only available in English.
The short version
- TIAN is run by one person, John, in Sweden. He is responsible for your data.
- We collect only what we need: your account and course progress if you sign up, and your email address if you want the newsletter.
- We don’t sell your data, we don’t show ads, and we don’t use tracking or advertising cookies.
- Your account and course data are stored in the EU (Frankfurt). Some of the services we use are American; they are bound by EU rules for data transfers.
- You can change your details, download your data or delete your account yourself, in the app under Account. For anything else, email john@tianengineering.com.
1. Who is responsible
TIAN Industrial Automation is a brand run by Mario John Samuel Tangen (“John”), a private individual in Sweden. He is the data controller for:
- tianengineering.com (articles and newsletter), and
- app.tianengineering.com (accounts and courses),
and for the emails TIAN sends.
Contact: john@tianengineering.com. There is no data protection officer; John handles all questions himself.
2. What we collect, why, and our legal basis
Under the GDPR, every use of personal data needs a legal basis. Here is each thing we do, what data it uses, and the basis.
| What we do | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Give you an account and access to courses | Your legal first and last name, email address, password (stored only as a secure hash), chosen language, sign-up date | Contract: we need it to provide the service you signed up for |
| Save your progress and grade quizzes and the final test | Lessons you finish, every answer you give, quiz and test scores, and when | Contract |
| Send account emails (confirm your email, reset your password) | Email address | Contract |
| Keep proof that you accepted the Terms and Conditions and confirmed you are 18 or older | Yes or no, the date and time, and which version of the terms | Legitimate interest: being able to show what was agreed |
| Send the newsletter | Email address, sign-up date and time, and the IP address used to sign up (our newsletter service uses it to stop spam) | Consent: you only get it if you ask for it |
| Keep the sites running and secure | IP address, browser type and the pages requested (server logs) | Legitimate interest: security and fixing errors |
| Stop password guessing and spam sign-ups | A scrambled code (a one-way hash) made from the email address or IP address used to log in, reset a password or sign up, and the time. The address itself is not stored | Legitimate interest: protecting accounts |
| Count visits | Pages viewed and where visitors come from, counted by our host from its server logs, without cookies | Legitimate interest: knowing which articles and pages are useful |
| Answer your emails | Your email address and what you write | Legitimate interest (replying to you), or contract if it’s about your account |
We ask for your legal name (as on your ID) because it will be printed on your certificates when they launch, so it has to be right.
Legitimate interest means we have a good reason that doesn’t override your rights. You can object to it at any time (see section 8).
Do you have to give us data? Your name, email address and a password are needed to have an account. Without them we can’t create one. The newsletter is optional.
3. Grading and automated decisions
Quizzes and the final test are graded automatically against fixed answer keys. The result only decides whether you passed. If you think a result is wrong, email us and John will check it by hand.
We don’t profile you, and no AI is used to judge you.
4. Who receives your data
We use a few services to run TIAN. They process data only on our instructions, under a data processing agreement, except YouTube, which is explained below.
| Service | What they do for us | Data | Where it’s stored | Protection for transfers outside the EU |
|---|---|---|---|---|
| Supabase (Supabase Pte. Ltd.) | Database and login for the app | Account, progress, answers, results, login records | EU (Frankfurt, Germany) | Standard contractual clauses, for any access from outside the EU |
| Netlify (Netlify, Inc., USA) | Hosts both websites and runs the app’s server | IP address, browser and pages requested. Everything the app handles passes through its servers in the USA | USA and worldwide network | EU-US Data Privacy Framework, plus standard contractual clauses |
| Resend (Plus Five Five, Inc., USA) | Sends account emails | Email address and the email’s content | USA (kept 30 days) | EU-US Data Privacy Framework, plus standard contractual clauses |
| Buttondown (Buttondown, LLC, USA) | Sends the newsletter | Email address, sign-up date, IP address and approximate location based on it | USA | Standard contractual clauses |
| Namecheap (Namecheap, Inc., USA) | Hosts our email inbox | Emails you send us | USA | Standard contractual clauses |
| YouTube (Google Ireland Ltd and Google LLC) | Plays videos, only after you press play | IP address, browser, the page you’re on, what you watch, and data YouTube stores on your device | USA and worldwide | EU-US Data Privacy Framework |
YouTube is not our processor. When you press play, Google handles your data under its own Privacy Policy. Until you press play, our pages don’t contact YouTube at all.
Transfers outside the EU. The EU-US Data Privacy Framework is an EU decision that US companies certified under it protect data adequately (Commission Decision (EU) 2023/1795). Where a service isn’t certified, or if the framework ever stops applying, standard contractual clauses approved by the EU Commission protect the transfer. You can ask us for a copy.
We never sell your data or share it for advertising. We only give data to authorities if the law requires it.
5. How long we keep data
| Data | How long |
|---|---|
| Your account, progress, answers, results and terms record | Until you delete your account. Accounts that haven’t been logged into for 3 years are deleted automatically. |
| Newsletter subscription | Until you unsubscribe. Our newsletter service then keeps a note that you unsubscribed, so you aren’t added again by mistake. |
| Server logs | Netlify: up to 7 days. Supabase: up to 1 day. Resend: 30 days. |
| Login and sign-up attempt records | Deleted within 24 hours. |
| Visit statistics | Counted in total; no profile of you is kept. |
| Emails you send us | As long as we need them to handle your question and keep a record of it. |
| Your language choice and unfinished test answers, stored in your own browser | Until you change or clear them. Unfinished test answers are also removed when you submit the test or log out. |
6. Cookies and storage on your device
We only store what is strictly necessary for things you ask for, so we don’t need to ask for consent and you won’t see a cookie banner. We use no analytics, advertising or tracking cookies.
| Name | Where | What it’s for | How long |
|---|---|---|---|
sb-…-auth-token (cookie) | App | Keeps you logged in | Up to 400 days, removed when you log out |
sb-…-code-verifier (cookie) | App | Security check when you sign up, confirm your email or reset your password | Until used |
tian-lang (cookie) | App | Remembers your language | 400 days |
tian-access (cookie) | App | Lets invited visitors in while the app is in preview | 400 days |
tian-lang (local storage) | Website | Remembers your language when you pick one | Until you clear it |
tian-final-draft:… (local storage) | App | Keeps your unfinished final test answers if the page reloads | Until you submit, log out or clear it |
Videos. Videos come from YouTube. They only load when you press play. After that, YouTube may store its own data on your device under Google’s rules.
The Swedish Post and Telecom Authority (PTS) supervises the rules on cookies.
7. Children
TIAN is for people aged 18 and over. Please don’t create an account if you’re younger. If we learn that an account belongs to someone under 18, or a parent or guardian tells us, we delete it.
If you’re under 16 and want the newsletter, ask a parent or guardian first.
8. Your rights
You have the right to:
- see the data we have about you and get a copy (access),
- correct data that is wrong,
- delete your data,
- limit how we use it (restriction),
- object to uses based on legitimate interest,
- take your data with you in a machine-readable format (portability), and
- withdraw consent at any time, for example to the newsletter.
Do it yourself. In the app, go to Account:
- Edit details changes your name or email address.
- Download my data gives you everything we store about your account and progress as a file.
- Delete my account deletes your account, progress and results for good.
- Reset my progress on each course page clears that course.
To leave the newsletter, use the unsubscribe link at the bottom of every newsletter email.
Or email us at john@tianengineering.com for anything else. We answer within one month. If a request is complicated, we can take up to two more months, but we’ll tell you why within the first month. It’s free.
9. Complaints
We’d like to hear from you first, but you always have the right to complain to the Swedish data protection authority:
Integritetsskyddsmyndigheten (IMY) Box 8114, 104 20 Stockholm, Sweden imy@imy.se · www.imy.se
If you live in another EU country, you can also complain to the data protection authority there.
10. Security
- Passwords are stored only as secure hashes. Nobody, not even us, can read them.
- All connections are encrypted (HTTPS).
- Your course data can only be read by your own account.
- Our admin accounts use two-factor login.
If a data breach puts your data at risk, we report it to IMY within 72 hours and tell you directly if the risk to you is high.
11. Changes to this policy
The date at the top shows when this policy last changed. If a change matters for your account, we’ll email you before it takes effect.
12. Language
This policy is written in English. If anything is unclear, email us and we’ll explain.