Legal

Privacy Policy

Last updated: 7 September 2026

Introduction

This Privacy Policy explains how MuntligB1 collects, uses, and protects your personal data when you use our service to prepare for the Norwegian oral language exam (Norskprøve).

MuntligB1 is operated by BANI YOUNES, a sole proprietorship registered in Norway. We process your data in line with the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act (Personopplysningsloven).

If you have any questions about this policy or how we handle your data, email us at privacy@muntligb1.com.

Who is responsible for your data

The data controller responsible for your personal data is:

Legal entityBANI YOUNES (sole proprietorship)

Organization number934 103 424

CountryNorway

Contactprivacy@muntligb1.com

What data we collect

We collect only the data needed to provide and improve the service:

Account data — Your email address, a hashed (encrypted) password, and your display name.

Usage data — Your progress per topic, streaks, weak topics, assessment results, and practice history.

Audio data — Voice recordings you make during speaking exercises. These are transient — sent to our transcription provider, converted to text, and never stored on our servers.

AI feedback data — Transcripts of your speaking practice, sent to our AI provider for evaluation and feedback.

Analytics data — Page views, clicks, session recordings, and device information, collected through analytics tools.

Cookies — Essential session cookies that keep you signed in, and non-essential analytics cookies (see the Cookies section below).

Practising without an account — When you practise without signing in, we store your answer (text or transcribed speech) without linking it to an account. We use it to give you feedback and to improve our practice exercises. These answers are deleted automatically after 30 days. You don't need to include personal details in your answers.

Signing up for the free sample — If you ask for the free sample of exam questions, we store your email address, the support language you chose, the exact wording of the consent you agreed to — including your confirmation that you are at least 15 years old — when you submitted the form with the consent box ticked, and whether you later unsubscribed. Some older requests still use email confirmation. For those requests, we also store whether you confirmed the address. While you remain subscribed, we also record which messages in the series we tried to send or sent, when that happened, and the delivery reference from our email provider. We use that record to prevent duplicates and enforce the frequency limit, and delete it when you unsubscribe. As technical evidence of the signup and any later unsubscribe, we also store, for up to 30 days, a one-way hash of your IP address — a fingerprint that lets us tell two events apart, not the address itself — and your browser type. A hash is not encryption and cannot be turned back into the original, but it is pseudonymised rather than anonymous, so we still treat it as your personal data. We also keep a keyed code derived from your email address, so that after you unsubscribe we can honour it without keeping the address itself readable. Our own database keeps only a hash of each confirmation and unsubscribe link, so a working link cannot be read out of it. The working link does exist: it is in the email we send you, and it passes through our email provider, Resend, which keeps message content and delivery logs for 30 days while our account is active. A confirmation link stops working seven days after you ask for the sample. An unsubscribe link is meant to keep working, so an old email can always be used to leave. We never sell your email address.

Free-sample download link — For the free-sample download, our database stores only a SHA-256 hash of the download code, never the working code itself. The link stops working 30 days after it is issued or after three attempts to use the code, whichever comes first.

Buying the question pack (PDF) — If you buy the complete question pack as a PDF, we store the delivery email address, which edition you selected, the price and currency, which payment provider you used and its payment reference — never your card, bank or Vipps account details or your PayPal login details, which stay with the provider — the exact wording of the acknowledgement you agreed to at checkout and when you agreed to it, and a fingerprint (hash) of the file we made for you. A separate PDF purchase uses the delivery address you enter and does not require an account. The B1 Pass and PDF bundle does require a signed-in account and uses the verified account email address that we show and ask you to confirm before payment. Your copy is prepared for you personally: the delivery email address and order reference are printed on every page, and the file is stored privately and can only be fetched through the link we email you. As technical evidence of the checkout and of each download we also keep, for up to 30 days, a one-way hash of your IP address and your browser type. The download link carries a code; our own database keeps only a hash of it, and the link stops working after a set number of days and downloads. The email that carries it passes through our email provider, Resend, which keeps message content and delivery logs for 30 days while our account is active.

Operational signup and sale alerts — When a free-sample signup is recorded or a payment for a PDF or B1 Pass and PDF bundle is verified, we queue one internal notification for the operator. A signup alert contains only a masked email address and the selected languages. A sale alert contains the order reference, edition, payment method, amount and fulfilment status. It never contains card details, payment tokens or an IP address. Resend delivers the alert, and a successfully delivered outbox record is deleted after 90 days.

Daily September Plan reminders — If you turn on daily reminders after starting the September Plan, we store your account and plan identifiers, your chosen language, the version of the reminder choice and when you made it, when you later turned reminders off, when each reminder is due, whether it was attempted or sent, the delivery reference from Resend, and only a SHA-256 hash of the code in the unsubscribe link. We read your saved plan completions to state how many whole days you have actually completed. We do not store another copy of your email address in the reminder tables.

When you have an account, we record how you use the app — for example which topics you open, when you start speaking practice, and when you complete an exercise — so we can see where learners get stuck and improve the app. We only store the type of action and when it happened, linked to your account. You can object to this, and if you delete your account, this history is deleted with it.

Why we are allowed to process your data

Under GDPR Article 6, we rely on the following legal bases:

Contract — Processing necessary to deliver the service you sign up for — your account, progress tracking, and exam practice.

Legitimate interest — Improving the product, fixing problems, and keeping the service secure.

Consent — Non-essential analytics, the MuntligB1 email series if you have asked for it, and the separate daily September Plan reminders if you turn them on. An active cookie consent banner lets you accept or decline analytics (see the Cookies section). For the email series, the consent box starts unticked and must be actively selected before the form can be submitted. The sample is then sent immediately, and every email carries an unsubscribe link. Daily plan reminders remain off until you choose to turn them on inside the plan.

How we use your data

To deliver the service: your account, saved progress, and practice history.
To transcribe your speech and give you feedback on your spoken Norwegian.
To respond to support requests and communicate with you about your account.
To understand how the service is used so we can improve it.
To send you the MuntligB1 email series if you asked for it: the free sample of exam questions first, and then normally one or two emails per month — never more than four in a calendar month — with practice tips, news about the complete question pack and the app, and offers. The support language you choose determines which version of the sample we send. The language of the page you use determines whether the sample and later emails are written in English or Norwegian.
To deliver a question pack you bought as a PDF: to prepare your personal copy, email you the download link, answer support questions about the order, and keep the purchase record.
To send Days 2–14 of the September Plan by email if you turn on daily reminders, including the day’s theme and the number of whole plan days you have completed.

Third parties who process your data

We use trusted providers to run the service. Each processes only the data needed for its specific purpose. All of these act as our data processors.

Provider	Purpose	Region	Retention	Notes
Supabase	Database, authentication, file storage	EU (eu-west-3, Ireland)	Until account deletion	GDPR-compliant region
Deepgram	Speech-to-text transcription	EU (api.eu.deepgram.com)	Not retained beyond transcription	GDPR processor, SCCs in place
Anthropic (Claude API)	AI feedback on speaking exercises	US with SCCs	30 days, no training on API data	Per Anthropic Privacy Policy
Netlify	Hosting, serverless functions	US with SCCs	Per Netlify policy	Standard hosting provider
Resend	Sending email — account and purchase messages, internal operational alerts and, if you asked for them, the MuntligB1 email series and daily September Plan reminders	US, with SCCs and the EU–US Data Privacy Framework (sending region EU/Ireland only)	30 days for email and log data while our account is active	Message content, delivery logs, webhook payloads and account records are stored in the United States
Stripe	Payment processing (one-time exam passes, including the B1 Pass and PDF bundle)	US/EU with SCCs	Per Stripe policy / as required by Norwegian accounting law	We never store full card details
Vipps MobilePay	Payment processing (one-time exam passes, and the question-pack PDF if you pay with Vipps)	Norway/EU	Per Vipps MobilePay policy / as required by Norwegian accounting law	We never see your bank or card details; we receive a payment reference and the amount
PayPal	Payment processing (the question-pack PDF, if you pay with PayPal)	EU (PayPal (Europe), Luxembourg), with transfers to the US under PayPal's safeguards (SCCs)	Per PayPal policy / as required by Norwegian accounting law	We never see your PayPal login or card details; we receive a payment reference, the amount and the payment status
Microsoft Azure (Speech)	Text-to-speech (spoken prompts/example answers)	EU (Norway East), with SCCs	Not retained beyond generating the audio	Processes text only
Google Analytics	Usage analytics	US with SCCs	Per Google policy	Requires consent (see Cookies section)
Microsoft Clarity	Session replay analytics	US with SCCs	Per Microsoft policy	Requires consent (see Cookies section)

International data transfers

We host your account data and audio transcription in the EU wherever possible — Supabase (database, authentication, storage) runs in eu-west-3 (Ireland), and Deepgram transcription uses its EU endpoint.

Some providers are based in the United States: Anthropic (AI feedback), Netlify (hosting), Resend (email — see below) and our analytics tools. Transfers to these providers are covered by Standard Contractual Clauses (SCCs) — the safeguard approved by the European Commission for transferring personal data outside the EU/EEA.

Resend deserves a specific note, because its Ireland setting is easy to misread: it controls only the region mail is sent from. Your email address, the content of the messages we send you, their metadata and the delivery logs are stored in the United States. Those transfers are covered by Standard Contractual Clauses and by the EU–US Data Privacy Framework.

How long we keep your data

We keep your data only as long as needed:

Account and usage data — Kept until you delete your account. When you delete your account, your personal data is permanently deleted from our systems. Purchase consent records are anonymised (the link to your identity is removed) rather than deleted, to meet our legal record-keeping obligations. A timestamped deletion record is kept for compliance purposes only.

Audio recordings — Not stored. Sent for transcription and discarded immediately afterward.

AI feedback transcripts — Retained by our AI provider (Anthropic) for up to 30 days, then deleted. Anthropic does not train its models on data sent through its API.

Analytics data — Retained according to each analytics provider's standard policy.

Practising without an account — These answers are deleted automatically after 30 days.

Free sample sign-up — Some older requests still use email confirmation. If you never confirm your address for one of those requests, everything about the request is deleted 30 days after you first submitted it — your address, the request record, the hashed IP address and the browser information. Submitting the form again does not move that deadline. Nothing is kept, because you never consented to anything and there is nothing for us to prove. When you submit the current form with the consent box ticked, we keep your address, the consent record and the record of messages in the series while you remain subscribed. Unsubscribing stops all future emails in the series immediately, deletes that message record, and leaves the sample you were already sent usable. After you unsubscribe we remove your readable email address from the mailing record and keep only a keyed code derived from it, together with the record that consent was given and withdrawn — the minimum needed to honour your opt-out and to show both decisions if we ever have to. Our lawful basis for keeping that small record is our legitimate interest in respecting the opt-out and being able to prove it. We keep it for three years after you unsubscribe and then delete it automatically; three years is MuntligB1's own documented policy, not a period set by Norwegian law. If you want to join again later, that is a fresh signup with a fresh checked-box decision — the old consent is never switched back on. The hashed IP address and browser information we hold as technical evidence — from a request, signup, confirmation or unsubscribe — are deleted no later than 30 days after that event in every case. That 30-day period is our own policy rather than one set by law. Separately, our email provider Resend keeps the content and delivery logs of the messages it sends us for 30 days while our account is active — that is their retention policy, not ours.

Question-pack purchases — The record of a completed purchase — the delivery address, the edition, the amount, the order reference, the acknowledgement you agreed to and the fingerprint of your file — is an accounting record. We keep it for five full years after the end of the accounting year of the purchase or any later refund, reversal or dispute, in line with Norwegian bookkeeping rules. It is not deleted when a download link expires. Your personalised file is kept privately until that same retention deadline, and both the file and the order record are then deleted automatically. An order that was started but never paid is deleted whole 90 days after it was started. The hashed IP address and browser information behind a checkout or a download are deleted no later than 30 days after that event; those 30 days are our own policy, not a period set by law. If your payment is refunded or disputed, the download link stops working; a file you have already downloaded stays on your device.

Daily September Plan reminders — Reminder schedules and delivery records are deleted automatically 30 days after Day 14. Turning reminders off immediately cancels every unsent reminder. Deleting or resetting the plan, or deleting your account, deletes the reminder records linked to it. Resend separately keeps message content and delivery logs for 30 days while our account is active.

Your rights

Under GDPR, you have the following rights over your personal data:

Access — Request a copy of the data we hold about you.

Rectification — Correct data that is inaccurate or incomplete.

Erasure — Request full deletion of your account and data (the 'right to be forgotten').

Restriction — Ask us to limit how we process your data.

Portability — Receive your data in a portable, machine-readable format.

Objection — Object to processing based on legitimate interest.

Withdraw consent — Withdraw consent at any time — for analytics, the MuntligB1 email series, and the separate daily September Plan reminders. Every daily plan reminder has its own off link; it takes effect immediately, and you do not need an account or a password to use it.

Complaint — Lodge a complaint with Datatilsynet, the Norwegian Data Protection Authority (datatilsynet.no).

To exercise any of these rights, email us at privacy@muntligb1.com. You can delete your account yourself at any time — go to your account settings and choose “Delete account”. This permanently erases your account and all associated data and cannot be undone.

Cookies and analytics

We use essential cookies to keep you signed in and to make the service work. These are always active and cannot be turned off.

We also use analytics tools — Google Analytics and Microsoft Clarity — to understand how the service is used and to improve it. These set non-essential cookies and may record session activity.

You control whether analytics tools run. When you first visit the site, you’ll see a consent banner asking you to accept or decline analytics. You can change your choice at any time by clicking “Manage cookies” in the footer. Your preference is stored for 12 months, after which we’ll ask again.

Children

MuntligB1 is not directed at children. We do not knowingly collect data from anyone under 13. If you believe a child has provided us with personal data, email privacy@muntligb1.com and we will delete it.

How we protect your data

Passwords are stored hashed, never in plain text.
All data is transmitted over encrypted connections (HTTPS).
Your account data and transcription are stored in EU-region infrastructure wherever possible.

Changes to this policy

We may update this policy from time to time. If we make a material change, we will notify you by email or with an in-app notice. The “last updated” date below always reflects the current version.

Contact us

For any privacy questions or to exercise your rights, email privacy@muntligb1.com.

You also have the right to contact or lodge a complaint with the Norwegian Data Protection Authority: Datatilsynet, datatilsynet.no.

Terms of Service

Last updated: 6 September 2026

Operator: Bani Younes (enkeltpersonforetak), Org. no. 934 103 424, St. Halvards gate 22, 0192 Oslo, Norway. Email: support@muntligb1.com.

1. Service

MuntligB1 is an online study aid for the oral part of Norskprøve. It is a practice aid only — not affiliated with HK-dir or any official body, and no exam result is guaranteed.

2. Accounts

You're responsible for your login and account activity; personal, non-commercial use only; don't share or resell access.

3. Tiers

Some content is open; some requires a free account; premium content requires an exam pass (a one-time purchase). We won't remove access during a pass's active period.

4. Price & passes

MuntligB1 is sold as one-time exam passes: B1 Pass · 14 days is 249 kr, the 60-day B1 Pass is 499 kr and the 60-day Full Pass is 899 kr, each including Norwegian MVA where applicable. A pass is a single charge — there is no subscription and no automatic renewal. You are charged once, immediately, when you buy, and the selected pass gives 14 or 60 days of access counted from the moment of purchase. The 14-day pass grants B1 app access, including the September plan, but no B2 access or PDF benefit. If the service becomes permanently unavailable during your access period, we will refund a proportional amount for any unused days. Pass payments are processed by Vipps or Stripe; we never store your full card or bank details.

4A. Question-pack PDFs

The complete question pack is available either as a separate one-time PDF purchase at the total price shown before checkout, or as one selected language edition included at no additional charge when you buy the 499 kr B1 Pass and PDF bundle. Neither option is a subscription and neither renews. A separate PDF purchase is paid through Vipps or PayPal. The bundle is bought from a signed-in MuntligB1 account through Vipps or Stripe, and the selected PDF is delivered to the verified account email address shown and confirmed before payment. We never receive your bank, card, Vipps-account or PayPal-login details. After payment, we prepare a personal copy with the delivery email address and order reference printed on every page and send its download link by email. The copy is licensed only for your personal, non-transferable use. When you expressly ask us to deliver it immediately and acknowledge that the right of withdrawal will be lost, the 14-day right of withdrawal falls away when delivery begins. The delivery email confirms your express request for immediate delivery and your acknowledgement that the right of withdrawal is lost when delivery begins. This does not limit your mandatory rights if the PDF is defective or not delivered as agreed.

5. Immediate access & withdrawal

Because this is a digital service used immediately, when you buy a pass you expressly consent to access starting right away and acknowledge that the 14-day right of withdrawal (angrerett) then falls away once access has started. See the Right of Withdrawal page.

6. Access & refunds

An exam pass does not renew and there is nothing to cancel — access ends automatically after the purchased 14-day or 60-day period. No partial refunds except where required by law. Statutory consumer rights unaffected — including your right to complain about a defective digital service (reklamasjon) under the Digital Services Act (digitalytelsesloven).

7. Acceptable use

No breaking security, scraping/copying content, reselling access, or unlawful use. We may suspend accounts that do.

8. Intellectual property

All content belongs to Bani Younes or its licensors; personal non-transferable use only.

9. Liability

Provided "as is"; no guarantee of uninterrupted/error-free service or any exam outcome. Nothing limits mandatory consumer rights under Norwegian law — including your defect and complaint rights (reklamasjon) under the Digital Services Act (digitalytelsesloven). Otherwise liability is capped at what you paid in the prior 12 months.

10. Defects & complaints (reklamasjon)

MuntligB1 is a digital service covered by the Norwegian Digital Services Act (digitalytelsesloven). If the service is defective — for example, it does not work as described — you may complain (reklamere) and may be entitled to a remedy such as having the defect corrected or a price reduction. Unlike physical goods, there is no fixed two- or five-year complaint deadline; you must complain within a reasonable time after you discover the defect. These rights apply in addition to these terms and are not limited by them.

11. Changes

We may update these terms; material changes notified by email/in-app.

12. Law & complaints

These terms are governed by Norwegian law, including the Contracts Act (avtaleloven), the Marketing Control Act (markedsføringsloven), the E-commerce Act (ehandelsloven), the Right of Withdrawal Act (angrerettloven) and the Digital Services Act (digitalytelsesloven) where applicable. Contact support@muntligb1.com first. Unresolved complaints may be brought to Forbrukertilsynet or Forbrukerrådet, and a formal complaint may be lodged with Forbrukerklageutvalget. You may bring proceedings where you live in the EEA.

Right of Withdrawal (Angrerett)

Last updated: 14 June 2026

Seller: Bani Younes (enkeltpersonforetak), Org. no. 934 103 424, St. Halvards gate 22, 0192 Oslo, Norway. Email: support@muntligb1.com.

Your 14-day right

As a consumer buying a service online, Norwegian law (angrerettloven) normally gives you 14 days to withdraw, counting from when the agreement was made, without giving a reason.

Why it doesn't apply once access starts

MuntligB1 is a digital service used immediately. The law lets the 14-day right fall away if you have expressly consented to access starting right away and acknowledged you then lose the right of withdrawal. You give that consent when you buy a pass, so the right no longer applies once access has started.

You're protected anyway

A pass is a single one-time charge — it does not renew, and there are no further charges. Access ends automatically after the purchased 14-day or 60-day period.

How to withdraw

Email support@muntligb1.com with a clear statement. Any clear message is enough; we confirm receipt by email. You may also use the standardized withdrawal form (angreskjema) available at regjeringen.no.

Standardized withdrawal form: standard withdrawal form (angreskjema)

Refunds

Any refund due under law is processed without undue delay and within 14 days, to your original payment method.

Questions

support@muntligb1.com. You may also contact Forbrukertilsynet or Forbrukerrådet, or lodge a formal complaint with Forbrukerklageutvalget. As a digital service, MuntligB1 is also covered by digitalytelsesloven (see the Terms of Service for the full list of applicable laws).