Privacy policy

1. Who is responsible for the data

Svarlane is operated by Pelle Lindal, Kvernsteinkroken 27, 4320 Sandnes, Norway. You may contact the business about privacy and your rights at info@svarlane.no.

Pelle Lindal, who operates Svarlane, is the controller for Svarlane’s own account, contract, billing, security and enquiry purposes. The organisation using Svarlane is normally the controller for messages, customers and employees in its workspace. Svarlane processes this data as a processor in accordance with the organisation’s instructions and the data processing agreement. Where the customer is itself a processor, Svarlane acts as a subprocessor.

2. Data and sources

You may provide us with your name, email, contact details, account settings, organisational affiliation and enquiries. The organisation’s administrator may create memberships, roles and invitations. Stripe provides us with identifiers and status information for subscriptions, invoices and payments. Card details are entered in Stripe’s payment fields.

Use of the service involves processing technical network information, login and security events, permissions and audit data. Message senders and the customer’s systems may provide contact details, email headers, recipients, message content, attachments, case information, internal notes and tasks. Selected integrations may add data from the customer’s external systems.

3. Purposes and legal bases

Account and service data is processed to administer access, workspaces, agreements and customer support. Article 6(1)(b) GDPR applies where the data subject is a party to the contract. For an organisation’s contact persons and users, necessary administration normally relies on point (f), with an interest in delivering and administering the customer’s service.

Security, abuse prevention, troubleshooting and documentation of necessary administrative actions normally rely on point (f). The interests are secure operations, protection of information and handling legal claims. Measures must be limited to what is necessary following a documented legitimate interests assessment.

Billing, bookkeeping and legally required documentation are processed under point (c) where processing is required by law, and otherwise on the relevant contractual basis or legitimate interest. Sales enquiries are followed up under point (b) where you request steps towards a contract, or point (f) for an organisation’s contact persons.

Optional visitor analytics require consent under point (a) and the rules on cookies. Consent may be withdrawn. Necessary service messages concerning security, accounts and payments are kept separate from any marketing. Message processing for the organisation follows its own legal basis and instructions.

4. Information you need to provide

Email, login details and necessary organisation information are required for accounts and access. Company, address and payment information may be necessary for a paid subscription and statutory bookkeeping. Without the necessary information, the relevant feature may be unavailable. Optional fields and analytics choices may be left blank or declined.

5. Who has access

The organisation’s authorised users receive access according to their role and inbox permissions. Svarlane administrators may receive justified, time-limited support access that can include customer communications and specific changes. The actual administrator identity and support session must be traceable in an audit log.

Providers of hosting and operations, email, storage, security, payments and any enabled AI features process relevant data. The subprocessor list describes their functions and status. Providers including payment and email providers may act as independent controllers for limited purposes such as statutory checks, network security, abuse prevention and their own payment purposes. Their role depends on the actual processing and agreement. Data may be disclosed where required by law or to handle legal claims, within necessary and lawful limits.

6. Processing locations and transfers outside the EEA

The service uses providers with international operations. Processing may include remote access, support services, provider copies and onward transfers outside the EEA. The publicly available provider list provides no guarantee of exclusive storage or processing in the EEA. Information about specific recipients, locations and transfer bases for the processing is available by contacting info@svarlane.no.

A transfer outside the EEA requires a valid basis under Chapter V GDPR. This may be a relevant adequacy decision, or appropriate standard contractual clauses supported by a specific assessment and necessary supplementary measures. Any certification or contractual basis must be checked for the correct recipient and scope. Details of the relevant safeguards and a copy may be requested from the privacy contact, subject to necessary redactions.

7. AI and decisions

The workspace has settings for enabling AI suggestions and removing certain personal data. The administrator determines the instruction. Email addresses and certain phone-number-like strings may be removed, while names and identifying free text may still constitute personal data.

OpenAI is a possible API provider in the integration configuration. Actual activation, data categories, processing location, provider retention and contractual basis must be documented before customer data is transferred. Customer content must not be used for general model training under these contractual documents. The features support human judgement. Introducing automated individual decisions with legal or similarly significant effects requires a separate assessment and information.

8. How long data is retained

The application has retention limits of 30 days for visitor data, 14 days for limited API error records and 365 days for the platform administration audit log. The cleanup job runs periodically. These limits apply to the named datasets. Information about Svarlane’s own operational logs and provider copies is available from info@svarlane.no.

Messages, attachments and customer data are retained according to the organisation’s lawful instructions for as long as the data is needed for the service’s purposes and any lawful retention. Trash provides recoverable hiding. Enquiries, ordinary audit data, AI drafts and backups follow the criteria in the retention overview. Permanent deletion is handled following a verified instruction and confirmed separately.

Documentation subject to bookkeeping requirements must be retained under applicable bookkeeping rules, normally for five years after the end of the financial year for primary documentation. A specific legal preservation obligation or the needs of a legal claim may justify necessary further retention with restricted access. Data must be deleted or anonymised when the purpose and lawful retention need cease to apply.

9. Your rights

Subject to the conditions in data protection law, you may request access, rectification, erasure, restriction and data portability. The right to data portability applies to data you have provided where processing is automated and based on consent or contract. It therefore does not automatically apply to security or administration purposes based on legitimate interests. You may object to processing based on legitimate interests, particularly on grounds relating to your situation, and to direct marketing. Consent may be withdrawn without affecting lawful processing before withdrawal.

Requests must normally be answered free of charge within one month. If an extension of up to two additional months is necessary, you must be informed and given reasons within the first month. Identity is verified proportionately. Exceptions and refusals must be explained.

For customer communications, you should contact the organisation acting as controller. Svarlane assists under the data processing agreement. For Svarlane’s own purposes and help finding the right contact, you may write to info@svarlane.no. You may complain to the Norwegian Data Protection Authority, Datatilsynet, or the relevant supervisory authority in the country where you live, work or believe an infringement has occurred.

10. Changes and consent

The policy version must show when the content was last changed. Material changes are communicated clearly to affected individuals. A privacy policy provides information and does not replace a necessary legal basis, data processing agreement or specific consent. New consent-based purposes require valid new consent before processing starts.