Privacy Policy

Last updated: September 2026

Drilld is operated by GEK AB ("Drilld", "we", "us"), a company registered in Sweden. This policy explains how we collect, use, and protect your personal data when you use Drilld.

We are the data controller for personal data processed on the platform. For privacy questions, contact us at hello@drilld.co.

1. Data we collect

Account data

When you create an account, we collect:

Profile data

If you complete your profile, we may also collect:

Booking and payment data

When you book or sell sessions, we collect:

Usage data

We automatically collect:

Content you create

Posts, comments, reviews, and other content you share on the platform.

2. How we use your data

We process your data to:

When a person at Drilld reads booking thread messages

Booking thread messages are private between the student and the instructor, and nobody at Drilld reads them as part of running the platform. If one of you reports a message in the thread, a member of our team may read that message together with up to three messages sent before it and up to three sent after it, so that the report can be judged in context. That is the normal review window. We keep an internal record of these reviews. We do not open the rest of the conversation unless one of the cases under "Legal disclosure" in section 3 applies.

Legal basis for processing

We process your data based on:

3. Who we share data with

We share data only when necessary:

We do not sell your personal data to third parties.

Legal disclosure

We may disclose data when required by law, court order, or to protect the rights, property, or safety of Drilld, our users, or others.

4. How long we keep data

We keep your data only as long as necessary:

5. Your rights

Under GDPR and similar laws, you have the right to:

To exercise these rights, contact us at hello@drilld.co. We respond within 30 days.

Complaints

If you believe we have mishandled your data, you have the right to file a complaint with the Swedish Data Protection Authority (Integritetsskyddsmyndigheten, IMY) at imy.se.

6. Cookies

We use cookies and similar technologies to:

You can manage cookie preferences through the cookie banner shown when you first visit the platform, or via your browser settings.

Cookie categories

7. Data security

We use industry-standard security measures:

No system is fully secure. If we become aware of a data breach affecting your data, we will notify you and relevant authorities as required by law.

8. International transfers

Drilld is based in Sweden (EU/EEA). Some service providers (Stripe, Cloudflare, Supabase, Vercel) may process data outside the EU/EEA. We ensure adequate safeguards are in place, including:

9. Children and guardian-managed accounts

You must be at least 13 to create your own Drilld account. If you are between 13 and 18, you must have permission from a parent or legal guardian. We do not knowingly let users under 13 create their own account. If we learn that we have collected account data from a child under 13 who signed up themselves, we will delete it promptly.

Accounts a guardian manages

A parent or legal guardian can create and manage an account for a child under 18. The guardian sets the account up and controls it. The child cannot log in to it.

For that account we collect the child's name, date of birth, and biological sex so the child can be registered for sessions and events with the correct age group and safety rules. The guardian can also add a photo and the sports the child trains. We process this data to provide the service the guardian asked us to provide.

A guardian-managed account is private by default. It is never visible to logged-out visitors and it is never indexed by search engines. The guardian decides whether other logged-in users can see it.

The guardian can use the rights in section 5 for a managed account. After a takeover, the child can use those rights for their own account. The guardian's remaining access is only the limited visibility described below, until the child turns 18.

Taking over the account from the age of 13

From the age of 13 a child can take over their own account. The guardian starts the takeover. The child then sets their own email address and password.

We email the guardian when the child completes the takeover. The guardian can object for a short period after that, or until the child's 18th birthday if that comes first. We tell the guardian the exact deadline in that email.

If a guardian objects, we freeze the account while a person at Drilld reviews the case. The review either lifts the freeze and lets the child keep the account, or reverses the takeover so the account is managed by the guardian again.

What a guardian can see afterwards

After the takeover the guardian no longer controls the account, but keeps limited visibility while the child is still under 18. The guardian can see:

The guardian cannot see posts, comments, messages, followers, or any amounts paid. This visibility ends on the child's 18th birthday.

Turning 18

We email the guardian about six months before, and again about one month before, the child's 18th birthday.

On the 18th birthday the guardian link ends automatically.

If the child has taken over the account, the guardian's visibility stops and the account continues as an ordinary adult account.

If the child never took over the account, it stops being a managed account. The guardian's access ends, and nobody can log in to it.

Accounts that were never taken over

If an account was never taken over, we anonymize it two years after it stops being managed, or earlier if we receive a deletion request (see section 5). We email the person who was the guardian at least 30 days before we anonymize it.

When we anonymize an account we permanently remove the name, date of birth, biological sex, photo, bio, email address, phone number, and location. We keep the booking history, payment references, and the record that a guardian gave consent, as accounting and accountability records (see section 4).

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification. The "Last updated" date at the top reflects the most recent version.

11. Contact

For privacy questions, data subject requests, or complaints, contact us at: