Privacy by default, optional measurement only after permission.
This notice describes the data flows designed into the Super Dyslexia website package. Production operators must confirm that the notice exactly matches the deployed backend, payment provider and hosting configuration before launch.
Data that may be processed
| Data | Purpose | Default approach |
|---|---|---|
| Email address and verification state | Deliver secure account access and font entitlement | Passwordless flow, only after the user requests access |
| License entitlement and transaction reference | Provide professional or educational rights and record purchases | Keep payment card data with the configured payment provider, not in browser code |
| Educator application information | Review an educator license request | Collect only institution, role, email and intended use |
| Marketing choice | Send optional product or project updates | Separate unchecked consent, not required for access |
| Optional audience measurement | Understand site performance and use | Disabled by default and blocked until explicit permission when configured |
| Security and server logs | Protect the service, diagnose errors and prevent abuse | Minimize and retain only as operationally necessary |
Legal bases
Depending on the deployed workflow, processing may rely on performance of a contract for license delivery, consent for optional marketing and optional analytics, legitimate interests for proportionate service security, and legal obligations for accounting or transaction records.
Analytics and browser privacy signals
The distributed package contains no active analytics identifier. If analytics is later enabled, the included consent layer uses a prior permission model and keeps advertising related consent denied. The code also detects Global Privacy Control and Do Not Track signals and keeps optional analytics off unless the visitor deliberately changes the preference.
Recipients and international transfers
The production service is hosted by netcup. Transactional email is delivered by Stalwart (self-hosted mail server). Stripe processes professional license and support payments. Each provider may act as a processor or independent controller according to its service role. The operator must maintain appropriate data processing and transfer safeguards where required.
Retention
Personal information should be retained only for as long as necessary for the stated purpose, to maintain a valid license relationship, resolve disputes, meet legal accounting duties or protect service security. Exact production retention periods must be documented once the final backend and legal entity are known.
Your rights
Depending on applicable law, users may have rights of access, correction, deletion, restriction, portability, objection and withdrawal of consent. Users in the European Economic Area may also complain to a competent supervisory authority. Withdrawal of optional consent should be as easy as granting it and can be managed through the Privacy choices control on this site.
Contact
Privacy requests can be sent to me@karllillrud.com. Postal contact: The Knowledge Formula - FZCO, Registration number DSO-FZCO-36765, Trade License number 38871, Dubai Silicon Oasis, DDP, Building A1, Dubai, United Arab Emirates, United Arab Emirates.
Last reviewed
5 October 2026.