Privacy Policy
Last updated: October 2026
TentaGen cares about your privacy. This policy describes how we collect, use, and protect your data in accordance with the EU General Data Protection Regulation (GDPR).
1. Personal Data We Process
We process: email address and name via Clerk authentication, subjects and questions you generate, uploaded documents and URLs for question generation, and the steering documents you add to the box Course plan and frameworks; saved steering documents stay in your account (name, text and dates). We also process what you send with the feedback button or the comment button: the message and an email address if you give one. A comment also holds the question it concerns, with its options, key, grading guidance, title and level, and the set's subject and topic. Feedback and comments are also sent to us by email, with your name or email address as the sender. When you sign in for the first time, we receive an email with your name and email address. We do not intend to collect sensitive personal data as defined in GDPR Article 9. We urge users not to upload material containing real patient data or other sensitive personal information. If such material is nevertheless uploaded, it is only processed to create and check questions and is kept as sections 2 and 11 describe.
2. AI Processing
The questions are written by a language model from OpenAI. It receives the subject and topic, the material you upload or paste (text and images) and, when you use Generate more or Revise question, the set's questions and what you type in the box. Anthropic's Claude may check questions that have numerical answers or are labelled at a higher taxonomy level (the questions only, not the material), and flag answer keys that may be wrong and levels that seem overstated. Claude also reads and describes images you upload as material. When you use Fact-check, Claude receives the question with its subject and topic. If you check a question while your material is on the page and the questions were made with Hybrid or Prioritize Uploaded Context, Claude also receives all the material if it is short, otherwise parts of it. With Prioritize Uploaded Context the question is then tested against the material alone; otherwise Claude may search the web. The audio of videos is transcribed by AssemblyAI. The providers do not train their models on what they receive from TentaGen. They keep it for a time under their terms, OpenAI for up to 30 days. The transcript of a video is deleted at AssemblyAI as soon as the text has been fetched, and otherwise after seven days.
3. Authentication
We use Clerk for authentication. Clerk handles login, session management, and stores your credentials. See Clerk's privacy policy for details: clerk.com/legal/privacy.
4. Storage of Personal Data
Your saved questions and steering documents are stored in a Convex database (USA). Each user only has access to their own questions and documents. Data is stored securely with encryption in transit (TLS).
5. Cookies, analytics and error reporting
We use essential cookies for sign-in (Clerk). They cannot be disabled, because you cannot sign in without them. Product analytics (Vercel Analytics and PostHog, EU-hosted) starts only once you have accepted in the cookie banner. PostHog does place a cookie in your browser when the page loads, but collects nothing until you accept, and nothing at all if you decline. Error reporting (Sentry, EU-hosted) does not depend on the cookie banner: it runs for every visitor on the basis of legitimate interest (GDPR Article 6.1f), because during the pilot we need to see which errors occur. When an error happens, a technical description, the page it concerned, the browser type and, if you are signed in, your user id are sent, together with a recording of the last moments before the error in which all text and all fields are masked. The recording is only buffered locally in your browser and sent only when an error occurs; otherwise no recording leaves your browser. Sentry sets no cookies but uses the browser's session storage for that buffer, which is cleared when the tab is closed. We also log action data (for example generation attempts, saved questions and exports) in our own database to improve the product. That logging does not include question or document content, only the action type and details such as counts and chosen settings, and the subject you type. During the pilot, PostHog collects interaction data (page views and clicks) from those who accepted, so we can understand how the tool is used and where it causes friction. PostHog also receives events such as a generation having started, with the settings you chose but never text you wrote. When you click, where on the page the click lands is recorded, but never the text there. PostHog links the data to your account with your name and email address. These choices are reviewed before a wider rollout.
6. Your Rights (GDPR)
Under the GDPR, you have the right to: request access to your personal data (Article 15), request correction of inaccurate data (Article 16), request deletion of your account and data (Article 17), request restriction of processing (Article 18), data portability — export your questions (Article 20), and object to data processing (Article 21). Contact us to exercise these rights. We respond to requests within 30 days.
7. Legal Basis for Processing
We process your personal data based on: contract (GDPR Article 6.1b) — to provide the TentaGen service to you as a registered user; legitimate interest (Article 6.1f) — for error reporting and for improving the service through action logging without content; consent (Article 6.1a) — for optional analytics cookies, which you may decline.
8. Data Processors
We share data with the following third-party providers who process data on our behalf: OpenAI (the language model that writes the questions, USA), Anthropic (Claude: question checks, image reading and fact-check, USA), Clerk (authentication, USA), Convex (database, USA), Vercel (hosting and analytics, USA), Sentry (error tracking incl. user id and error-bound session replay with all text fields masked, data in EU), PostHog (product analytics incl. interaction tracking, data in EU), Upstash (limiting each account's number of requests, data in EU), Resend (email notifications, USA), AssemblyAI (video transcription, USA). Data processing is carried out in accordance with each provider's data processing terms.
9. International Data Transfers
Some of our service providers are based in the USA. Transfer of personal data to the USA is carried out in accordance with EU Standard Contractual Clauses (SCC) and/or the EU-US Data Privacy Framework, ensuring an adequate level of protection under GDPR Chapter V. Sentry and Upstash store data within the EU.
10. Contact
For privacy questions, contact us at support@tentagen.se.
11. Retention and Deletion
Your saved questions are stored until you delete them. Saved steering documents are stored until you remove them or delete your account. Feedback and comments are kept until your account is deleted. Uploaded files are deleted from our storage once their text has been read. Images that belong to questions are stored on our servers. Our providers keep what they receive as section 2 describes. You can request deletion of your account and your data by contacting us at support@tentagen.se. When your account is deleted, we remove what is saved under the account in our database. Images in questions stay in our storage, because exported exams link to them. Feedback, comments and the message about your first sign-in also reach us by email. The email service Resend keeps them for 30 days. We delete our own copies and the analytics data in PostHog when you ask us to. Unsaved question sets shown on screen are also kept temporarily as a draft on the server, so you can restore them from another computer or after clearing your browser. A draft is deleted when the questions are saved to the library, when you start over, and at the latest 14 days after the last change.
12. Data Controller
The data controller is GeniusMotion Koncern AB (org.nr 559236-1389). Contact person for data protection matters: Parviz Mammadzada, support@tentagen.se. Our processing of personal data is not of a nature or scale that requires a Data Protection Officer (DPO) under GDPR Article 37. For data protection inquiries, contact us at support@tentagen.se. We do not use automated profiling or automated individual decision-making under GDPR Article 22. For complaints, you have the right to contact the Swedish Authority for Privacy Protection (IMY), imy.se.