1. Data Controller

The data controller responsible for your personal data is:
Nettpilot
Norway
Email: privacy@nettpilot.no

2. What Data We Collect

We collect the following types of personal data:

2.1 Account Information

• Email address: Used for account creation and login
• Name: Display name for your account
• Password: Encrypted and stored securely (bcrypt hashing)
• Profile picture: Optional, if you sign up via Google OAuth
• Language preference: Your chosen interface language (Norwegian or English)

2.2 Usage Data

• Audit history: URLs you've analyzed and their results
• Chat messages: Conversations with the AI consultant about your audits
• Credit balance: Number of available audit credits
• Timestamps: When you created your account, performed audits, sent messages

2.3 Technical Data

• Authentication tokens: JWT tokens stored in cookies (7-day expiration)
• IP address: For security and rate limiting purposes
• Browser information: User agent strings for compatibility

2.4 Third-Party Data

• Google OAuth: If you sign up with Google, we receive your email, name, and profile picture
• Website content: When you audit a URL, we temporarily fetch and analyze the public content

3. How We Use Your Data

We use your personal data for the following purposes:

• Provide the Service: Process audits, generate AI recommendations, manage your account
• Authentication: Verify your identity and maintain secure sessions
• Personalization: Display content in your preferred language
• Rate limiting: Prevent abuse and ensure fair usage
• Security: Detect and prevent fraudulent activity
• Service improvement: Analyze usage patterns to improve the Service (aggregated data only)

4. Legal Basis for Processing (GDPR Article 6)

We process your data based on:

• Contract performance: To provide the Service you signed up for
• Consent: When you create an account and agree to these terms
• Legitimate interests: For security, fraud prevention, and service improvement

5. Data Sharing and Third Parties

We share your data with the following third parties:

5.1 AI Service Provider

• Third-party LLMs: Website content and audit context is sent to our language-model providers for analysis
• Google's privacy policy: policies.google.com/privacy

5.2 Infrastructure Providers

• Emergent Platform: Hosting and infrastructure services
• MongoDB: Database storage for user accounts and audit data

5.3 Authentication Providers

• Google OAuth: If you choose to sign up with Google

We do NOT sell, rent, or trade your personal data to third parties for marketing purposes.

6. Data Retention

We retain your data as follows:

• Account data: Until you delete your account
• Audit results: Stored indefinitely unless you request deletion
• Chat messages: Stored indefinitely unless you request deletion
• Authentication tokens: Automatically expire after 7 days
• Rate limiting data: Automatically deleted after 1 hour

Future implementation: We may implement automatic deletion of audits older than 90 days to reduce data storage.

7. Your Rights Under GDPR

You have the following rights regarding your personal data:

7.1 Right to Access (Article 15)

You can request a copy of all personal data we hold about you.

7.2 Right to Rectification (Article 16)

You can update your account information (name, email, language) at any time in your profile settings.

7.3 Right to Erasure / "Right to be Forgotten" (Article 17)

You can request complete deletion of your account and all associated data. Contact us atprivacy@nettpilot.nowith the subject "Data Deletion Request".

7.4 Right to Restriction of Processing (Article 18)

You can request that we limit how we process your data.

7.5 Right to Data Portability (Article 20)

You can request your data in a machine-readable format (JSON/CSV) to transfer to another service.

7.6 Right to Object (Article 21)

You can object to processing of your data for certain purposes.

7.7 Right to Withdraw Consent

You can withdraw your consent at any time by deleting your account.

How to exercise your rights: Send an email toprivacy@nettpilot.nowith your request. We will respond within 30 days as required by GDPR.

8. Cookies and Tracking

We use the following cookies:

8.1 Essential Cookies

• session_token: JWT authentication token (7-day expiration)
• Purpose: Keep you logged in securely
• Legal basis: Necessary for service functionality

8.2 No Third-Party Tracking

We do NOT use Google Analytics, Facebook Pixel, or any third-party tracking cookies. Your browsing activity is private.

9. Data Security

We implement the following security measures:

• Password encryption: Bcrypt hashing with salt
• HTTPS/TLS: All data transmitted over encrypted connections
• JWT tokens: Cryptographically signed authentication
• Rate limiting: Protection against brute force attacks
• Access controls: Users can only access their own data

10. International Data Transfers

Your data may be processed in servers located outside the European Economic Area (EEA), including Google's AI services. When data is transferred internationally, we ensure adequate safeguards are in place as required by GDPR Article 46.

11. Children's Privacy

Our Service is not intended for users under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

12. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will notify you within 72 hours as required by GDPR Article 33.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Continued use of the Service after changes constitutes acceptance of the updated policy. We will notify you of significant changes via email.

14. Contact and Complaints

For privacy-related questions or to exercise your GDPR rights, contact:
Email: privacy@nettpilot.no

If you are not satisfied with our response, you have the right to lodge a complaint with your national data protection authority.