Transparency — told the way the law requires
Established 2026-09-01 · lab.ak1nvestor.com · AK1A Research Lab
This page exists because Article 13 of the data protection regulation (GDPR) gives you the right to know exactly what we do with your personal data — not because we chose the most convenient way of telling you. We therefore account for the entire register: what we collect, why, on what legal basis, how long we keep it and which rights you have. Deeper legal details are found in the privacy policy and the terms of use.
1. Who is responsible for your data
The data controller is AK1A Research Lab, contact info@ak1nvestor.com (art. 13.1 a). We currently have no formal data protection officer — it is not mandatory for the size of our operation — and handle privacy matters directly via the contact above. Our most important data processors (suppliers who process data on our behalf, art. 28) are our European database provider and our web hosting provider. They may only process data according to our instructions and have data processing agreements with us.
2. The entire data register — what, why, basis, retention, right
Art. 13.1 requires us to state the purpose and legal basis for every category of personal data when it is collected. This is the register, in its entirety:
Account details (name, email, password hash)
- Why:
- Create and administer your account, authenticate you, deliver what you have purchased and communicate about your education.
- Legal basis:
- Contract — art. 6.1 b (necessary to fulfil our contract with you)
- Retention period:
- For as long as the account is active + 12 months (the right to complain/invoice), then deleted.
- Your right:
- Access, rectification, erasure, data portability, restriction.
Course progress, quiz answers and XP
- Why:
- Show your progression, unlock the next step, calculate certificate grades (A–D) and give you relevant follow-up questions.
- Legal basis:
- Contract — art. 6.1 b (delivery of the education service)
- Retention period:
- For as long as the account is active; deleted together with the account.
- Your right:
- Access, rectification, erasure, data portability.
Behaviour traces (which pages and courses you visit, in which order)
- Why:
- Analyse how our pedagogy is used, improve course order and discover where the student gets stuck. This is the core of 'using information to analyse' — the analysis concerns the platform's pedagogy, not your private life.
- Legal basis:
- Legitimate interest — art. 6.1 f (product development and quality assurance of the education)
- Retention period:
- Rolling 90 days, thereafter only anonymised statistics.
- Your right:
- Objection (art. 21) — we then stop processing your data.
Cognitive profile (answers in the AI Diagnosis: risk appetite, bias tendencies)
- Why:
- Adapt examples and warnings in the education to your profile (e.g. extra attention to confirmation bias).
- Legal basis:
- Consent — art. 6.1 a (you answer voluntarily; you can skip the diagnosis entirely)
- Retention period:
- Until you withdraw consent or delete the profile — the feature is always voluntary.
- Your right:
- Withdraw consent at any time + erasure + objection to profiling.
Questions you ask the AI Mentor
- Why:
- Answer your questions, remember the conversation context during the session and improve the mentor's answer quality in aggregated form.
- Legal basis:
- Legitimate interest — art. 6.1 f (support and feature improvement)
- Retention period:
- The conversation memory is stored locally in your browser (not on our servers) and can be deleted by you with one click in the chat.
- Your right:
- Erasure (you control the memory yourself) + objection.
Chosen news channels and watchlists
- Why:
- Fetch and filter news feeds you have chosen yourself, and prioritise topics in your profile.
- Legal basis:
- Consent — art. 6.1 a (settings you actively chose)
- Retention period:
- Until you change the settings or the account is deleted.
- Your right:
- Withdraw consent, change, erase.
Cookies (cookies and local storage)
- Why:
- Necessary: login and security. Functionality: your choices (theme, channels). Analytics: anonymous usage statistics.
- Legal basis:
- The Swedish Electronic Communications Act (lagen (2022:482) om elektronisk kommunikation) — necessary cookies require no consent; the others require your active choice in the cookie wall.
- Retention period:
- According to the cookie list in the cookie wall (max 12 months).
- Your right:
- Change your choice at any time via 'Cookie settings' in the footer — as easy as making it.
Traffic statistics (anonymous visitor measurement — no cookie, no personal data)
- Why:
- Count visitors, most-read pages and sources so the education can prioritise what is actually used. Page + device class + source + language + a randomised, hashed session code — never IP, never query strings, never content. If you have chosen 'necessary only', only page path + device class are measured.
- Legal basis:
- Legitimate interest — art. 6.1 f (anonymous web statistics without personal data; who you are cannot be deduced)
- Retention period:
- Rolling 35 days, then deleted by the retention organ (hard deletion cap).
- Your right:
- Objection (art. 21) — choose 'necessary only' in the cookie wall and nothing about you is measured beyond the fully anonymous.
Security log (blocked attacks with hashed IP)
- Why:
- The traffic guard stops scanners and floods (e.g. searches for .env or wp-admin) and logs the event to protect the service. The IP address is hashed with salt before storage — the raw address never leaves memory, and the hash cannot be traced back to a person.
- Legal basis:
- Legitimate interest — art. 6.1 f (IT security and prevention of unauthorised access)
- Retention period:
- Rolling 35 days or until the row cap (3,000) is reached — then deletion.
- Your right:
- Objection (art. 21) and the right to information — the log contains no personal data, only technical fingerprints.
3. How we use information to analyse — and where the line goes
We say it plainly: we analyse how the service is used. Your quiz and course data make your education better (the right difficulty, the right next step, the right certificate grade). The behaviour trace shows where our pedagogy falls short — for example if many get stuck on the same chapter. The cognitive profile makes the warnings in the texts relevant to your own tendencies. This is called purpose limitation (art. 5.1 b): data collected for one purpose may not be used for an incompatible one.
4. Your eight rights — and how to use them
- Access (art. 15) get a copy of everything we store about you.
- Rectification (art. 16) correct incorrect data.
- Erasure (art. 17) 'forget me' — delete everything, if no law obliges us to keep it (e.g. accounting records).
- Restriction (art. 18) pause processing while a matter is investigated.
- Portability (art. 20) receive your data in a machine-readable format.
- Objection (art. 21) say no to processing based on legitimate interest — applies to the trace.
- Withdraw consent (art. 7.3) at any time, as easily as you gave it.
- Complaint (art. 77) to the Swedish Authority for Privacy Protection (IMY — Integritetsskyddsmyndigheten), Box 8114, 104 20 Stockholm — you do not need to go through us.
Exercise the rights by emailing info@ak1nvestor.com. We respond without undue delay and at the latest within one month (art. 12.3) — if we extend (e.g. for extensive extracts) we notify you within the month and explain why. It costs nothing (art. 12.5).
5. Cookies under the Electronic Communications Act (lagen (2022:482))
When you first visit us, you meet a cookie wall with three categories: necessary (login and security — requires no choice), functionality (your preferences) and analytics (anonymous statistics). The cookie wall stores your choice for 12 months and you can change it at any time via "Cookie settings" in the footer — the law requires that withdrawing consent be as easy as giving it. See the complete cookie list with names and validity periods in the cookie policy.
6. Right of withdrawal on purchases — 14 days, with one exception you must know about
If you buy Phase 2 or Phase 3, the Swedish Distance Contracts Act (lagen (2005:59) om distansavtal och avtal utanför affärslokaler) applies: a 14-day right of withdrawal from the conclusion of the agreement. But for digital content delivered immediately, the right of withdrawal ends when delivery has begun — provided you have first expressly consented to immediate access and accepted that the right of withdrawal thereby ends (Chapter 2, Section 11, first paragraph, point 11). That is why there is a special checkbox before payment and an order confirmation by email. Phase 1 costs nothing — there is nothing to withdraw there. Read the entire withdrawal section in the terms.
7. Education — not securities advice
AK1A is an education service. We never give personal investment advice or recommendations to buy or sell — such activity requires a licence under the Swedish Securities Market Act (lagen (2007:528) om värdepappersmarknaden), and we do not conduct it. All content, including the AI Mentor's answers, is general teaching not adapted to your financial situation. That protects you (you make your own decisions with full information) and it is exactly what the law requires of us. Read the financial policy.
8. Profiling and automated decisions
The cognitive profile and the XP system are profiling within the meaning of the GDPR (art. 4.4) — but no part of the service makes automated decisions with legal effect or otherwise affecting you similarly (art. 22). Certificate grades are calculated mechanically from your quiz results, but you can always request human review by contacting us.
9. The laws behind this page
- Dataskyddsförordningen (EU) 2016/679 — the data protection regulation (GDPR), in particular articles 5, 6, 7, 12–22 (transparency, information duties, rights).
- Lagen (2022:482) om elektronisk kommunikation — the Swedish Electronic Communications Act: cookies and consent (Ch. 6).
- Lagen (2005:59) om distansavtal och avtal utanför affärslokaler — the Swedish Distance Contracts Act: information before purchase and the 14-day right of withdrawal (Ch. 2, Sections 10–11).
- Lagen (2022:261) om avtal om digitalt innehåll och digitala tjänster — the Swedish Digital Content Act: the consumer's rights on digital delivery.
- Lagen (2007:528) om värdepappersmarknaden — the Swedish Securities Market Act: the boundary between education and licensable advice.
- Lagen (1960:729) om upphovsrätt till litterära och konstnärliga verk — the Swedish Copyright Act: our courses build on our own adaptations with source references (see /upphovsratt).