Privacy Policy

Ungt Steg provides digital tools, content, and support for young people moving toward work. This privacy policy explains what personal data we process, why we process it, and which rights you have.

Privacy questions can be sent to hei@ungtsteg.no.

We may process contact details such as name and email address, account information, content you add to CVs, cover letters, job matching or other tools, finalized interview-practice transcripts and feedback, technical device and usage information, and messages you send to us.

When you use voice interview practice, OpenAI processes the audio stream to conduct the conversation and create a transcript. Ungt Steg stores the finalized transcript, result, and any optional experience review, but does not store raw audio.

If you use the community, we process your posts, comments, and reactions, your event sign-ups, and any reports you submit. If you use direct messages, we store the messages between you and the person you are writing to.

If you are affiliated with an organisation, we store the time of your latest signed-in use of Ungt Steg. We store only the latest timestamp for this purpose, not a page history.

For Sarepta UngdomsJobb, we may also process contact details from course and interest sign-ups before an account exists, school, course or cohort, consent summaries, and dated attributed notes about contact and follow-up. The employer and partner register may contain contact people, phone, email, address, and linked jobs.

When you register for a Sarepta course, we process your name, email, phone number, selected course, registration or waitlist status, and attendance. You confirm that you are 16–30, but the course form does not store your date of birth. Necessary messages about the selected course are sent regardless of your marketing choice.

If an organisation connects a Google or Microsoft mailbox to Ungt Steg to send email, we store the account's ID at the provider, the verified email address, the sender name the organisation chooses, the connection status, and encrypted connection credentials (OAuth tokens). This information is stored in protected records linked to the organisation, and access to it is limited by the organisation's permissions. We only ask for permission to identify the account, keep the connection working, and send email from it. We do not ask for access to read the inbox, and we do not read or copy email already in the mailbox.

Please avoid entering sensitive information unless it is necessary for the service you ask us to provide.

We use personal data to create and operate accounts, provide our tools, store documents and progress, respond to requests, improve the service, protect it from misuse, and meet legal obligations.

For organisation participants, we use the latest-use timestamp to show the organisation's active-user capacity. A participant is active for 90 days after their latest use. Inactivity does not end the organisation affiliation.

When you use AI-based features, text or audio you submit may be processed to provide the suggestions, summaries, job matching, interview conversation, or feedback you requested.

We may use completed interviews and voluntary experience reviews in aggregated analysis to compare conversation approaches and improve interview practice.

The community and messaging exist so you can share experiences, ask questions, and stay in touch with your adviser. Reported content is reviewed by moderators to keep the community safe.

Information about a connected mailbox is used only to identify and maintain the sender connection and to send email when organisation staff choose to send it. Only the organisation's administrators can connect and manage mailboxes, and staff can only send to participants they are allowed to follow up. Account information obtained through these mailbox connections is not used in our AI features.

Processing is usually necessary to provide a service you use, based on consent, based on our legitimate interest in securing and improving the service, or required to meet legal obligations.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing already completed before consent was withdrawn.

Sarepta's optional course consent covers marketing about new courses, job opportunities and relevant offers by both email and SMS. It is separate from necessary course administration and from the platform-wide marketing choice on an Ungt Steg account. It can be withdrawn through the secure link in a course email.

We do not sell personal data. We currently use these providers (processors): Supabase (database, sign-in, and file storage), Railway (hosting), OpenAI (AI for CVs, cover letters, job matching, and interview practice), Anthropic (an optional profile-summary provider when enabled), Resend (email delivery), GatewayAPI EU (sending and receiving SMS), Sentry (error tracking), and Mixpanel (product analytics, only when you have consented to analytics). GatewayAPI processes phone numbers, SMS content, and delivery metadata when Sarepta's SMS feature is used. Those providers must process data only on our instructions.

If you are connected to an organisation through an access code, the advisers and administrators there see your name, email address, municipality, and how far you have come: whether you have finished onboarding, built a CV, started an application, generated a cover letter, practised an interview, and whether a job outcome has been recorded for you. They also see the time of your latest signed-in use, and they can write notes and labels about your follow-up. If the organisation posts a job, you may appear among its candidates with a short machine-generated explanation of why you fit.

Advisers and administrators in the organisation you are currently connected to, who have access to the participant overview, can also read information from your active CV and your job profile. From the CV, this covers education, including your upper secondary programme, experience, skills, and other professional text. From the job profile, it covers your job interests, when you can work, and how much you want to work. They use this to follow you up and to find possible candidates for job opportunities. This also applies to an active CV you have already saved. This feature does not publish your CV or automatically send it to an employer. Organisation staff without this access, and other organisations, do not get access.

Your cover letters and interview conversations are not available to the organisation, except what you choose to send with an application as described below. Private direct messages are between you and the person you are writing to. SMS sent or received through Sarepta's shared number is, however, visible to authorised Sarepta administrators so the team can follow up the request. At Ungt Steg, a limited number of named administrators can access account content when needed for support, troubleshooting, and security.

Before a Sarepta job application becomes visible to staff, you are told that your name, email, phone and application status will be available to Sarepta. If you decline, your own application row remains without becoming visible to Sarepta. For other jobs, your application and the contact details you provide are shared with the employer or organisation behind the listing.

When staff send email from a connected mailbox, our server sends the recipient's email address, the subject, and the message text to Google or Microsoft, which sends the email from the organisation's mailbox. Replies go to that same mailbox. The organisation chooses its own email provider, and the selected provider processes the outgoing email. The stored connection information is processed on our behalf by the hosting and database providers named above.

We may also share data when needed to comply with law, enforce terms, or protect users, the service, or other legitimate interests.

Some of the providers above are US companies, so personal data may be transferred to and processed in the United States. GatewayAPI is used with its EU setup. Mixpanel is also used with its EU setup, but it is a US company, so this paragraph applies to Mixpanel too. Where a transfer outside the EEA occurs, it relies either on the EU-US Data Privacy Framework, which the European Commission has decided provides an adequate level of protection, or on the EU Standard Contractual Clauses. You can request a copy of the basis we rely on for an individual provider by contacting us.

We do not train our own AI models on your content.

We keep personal data for as long as needed for the purposes described in this policy, for example while you have an account with us or need access to stored documents.

For Sarepta UngdomsJobb, we automatically anonymize participant contacts 24 months after the latest meaningful contact or activity. Personal partner contacts and private clients are anonymized 36 months after the latest meaningful contact or after the latest linked job has ended. CRM notes follow the deadline of the contact they concern.

SMS content in Sarepta's shared message history follows the same deadline as the relevant contact: 24 months for participants and 36 months for personal partner contacts. SMS to named one-off recipients without a stored contact, and unresolved SMS threads, are anonymized no later than 12 months after the latest activity.

Sarepta course registrations are automatically anonymized 24 months after the latest meaningful course or contact activity. Name, email, phone number, secure management link, account and contact links, consent details, and person-linked attendance are removed. Courses, sessions and anonymous aggregates may remain for reporting. There is no manual review before anonymization.

Application data shared with Sarepta is anonymized six months after the job ends. Unresolved identity matches are anonymized after 90 days, and identifying audit and discrepancy data is anonymized after 12 months. Raw local Monday exports are anonymized after 90 days.

When Sarepta data is anonymized in Ungt Steg, names, contact fields, personal relationships, and personal free text are removed. Information about a company, school, or venue as an organisation may remain without personal contact fields. Anonymous statistics may remain when they cannot be linked to an individual.

This Sarepta retention applies to CRM and applicant copies used by Sarepta for follow-up. It does not delete your Ungt Steg account, CV, documents, messages, or other content you own in the service.

When an organisation administrator removes a connected mailbox, we delete the connection, including the encrypted connection credentials for that account. Email already sent remains with the email provider. Access can also be revoked in the account settings at Google or Microsoft.

To prevent the same send from going out twice, we keep a receipt for each send with IDs, a check fingerprint, status, and message counts. The receipt does not contain the message text or the recipients' email addresses.

An organisation administrator may end an affiliation because it is incorrect, consent is withdrawn, the participant is transferred, or for another exceptional reason. This does not delete the account or participant-owned content. Account deletion is a separate process.

You can delete your account yourself from the account page. This removes your profile, documents, applications, interview sessions, and your community content, along with the files we have stored for you and the copy of your profile in the job-matching service.

You can also ask us to delete your account or specific data. Some data may need to be kept longer where law, security, documentation, or dispute handling requires it.

You may request access, correction, deletion, restriction, portability, and objection to processing where the law gives you those rights.

You can contact us at hei@ungtsteg.no. You may also complain to the Norwegian Data Protection Authority if you believe we process personal data unlawfully.

We use technical and organizational measures to protect personal data against unauthorized access, loss, and misuse. No digital service can guarantee complete security.

We may update this privacy policy when the service or legal requirements change. The new version will be published on this page with an updated date.

Necessary cookies are used for login and security, and to remember the choice you make in the consent banner. These are required for the service to work and cannot be switched off.

The latest signed-in use timestamp is necessary operational data for the organisation's active-user capacity. It is recorded independently of analytics consent and contains no page history.

With your consent we additionally use analytics. Our own analytics stores a temporary session id in your browser and records page views, device type, and performance measurements to understand how the service is used and improve it. You can decline analytics in the banner without losing any functionality.

When you are signed in and have consented to analytics, we also send selected events to our analytics tool Mixpanel. These include job-search milestones: that you signed up, finished onboarding, completed or exported a CV, saved jobs, marked applications as sent, and job outcomes.

We also send how you use the tools: when you see, open or dismiss a job recommendation, and which of the fixed reasons you choose when you dismiss it, such as wrong location or wrong schedule. In the CV tool, we send when you ask for help with your summary, experience or skills, when you move on to the next step, and when you download your CV, with the file format (PDF, Word or original file). We also send when you practise for an interview and view the feedback, and when a cover letter is ready to read.

To check that the service works as it should, we send which feature an action concerned, whether it succeeded or failed, and roughly how long it took, grouped into broad time ranges.

With each event we send an internal user ID that does not contain your name or email address, your organisation's ID, the month you started, which operating environment the event comes from, and whether a job outcome was recorded by you or by your organisation.

We do not send CV or application text, interview answers or audio, file names, names, email addresses, or location based on your IP address to Mixpanel. We do not use session recording or replay, and we do not collect clicks automatically.

If an adviser or administrator records a job outcome for you, it is sent to Mixpanel only if you have consented to analytics yourself and the outcome was recorded after you made your current choice. It is sent only the next time you use Ungt Steg while signed in with that consent. Job outcomes recorded before your choice are not sent. The adviser's consent does not cover data about you.

If you are an adviser or administrator and have consented to analytics, we also send events about invitations and follow-up you do yourself, linked to your own internal user ID. We do not send who the invitation or follow-up concerns, the participant's ID, or your notes.

Your choice is stored in the browser you use, so you make it on each device. If you decline analytics, we stop sending events from that browser. You can ask to access or delete data that has already been sent by contacting us.

We also use error tracking (Sentry) to catch technical failures so we can keep the service stable and secure. You can change your consent by clearing cookies in your browser; the banner will then appear again.