Privacy Policy

Controller

Kaada Nordic MarTech, org. no. 936 289 835, Ytre Eiganesveien 13, 4022 Stavanger, Norway, is the data controller for personal data collected through this site. Contact: contact@nordicmartech.com.

What we collect and why

• Application details (name, email, company, website, message) — to respond to your enquiry. Legal basis: legitimate interest / steps before a contract.
• Billing details (name, email, billing address, VAT number, payment status) — to take payment, issue invoices and meet accounting duties. Legal basis: contract and legal obligation.
• Subscription records (plan, status, billing period) — to deliver the service you bought. Legal basis: contract.
• Analytics: anonymous page and button events stored in our own database; a random visitor ID is stored on your device only if you accept analytics.

Payments

Card payments are processed by Stripe. Card numbers never reach our servers. Stripe processes data as an independent controller for fraud prevention and as our processor for payment execution.

Sub-processors

We share personal data only with the following processors, each bound by a data processing agreement:

• Stripe, Inc. (United States) — payment processing and fraud prevention. Card data is processed under Stripe's own PCI-DSS certification; card numbers never reach our servers. Data is transferred on the basis of Standard Contractual Clauses.
• Supabase, Inc. (United States) — hosted PostgreSQL database (application data, subscription records, seat state). Data is stored in the EU region (Frankfurt).
• Cloudflare, Inc. (United States) — CDN, DDoS mitigation, DNS, and TLS termination. Processes IP addresses and HTTP metadata. Data is transferred on the basis of Standard Contractual Clauses.
• Lovable AI gateway (Lovable Labs) and OpenAI — when you request a fit brief, the details you type are sent through Lovable's AI gateway to an OpenAI model to write the brief. Provider-side storage of the request is switched off. Legal basis: steps before a contract.
• Our publishing partner (identity disclosed on request) — receives the article text and your brand details solely to review and submit the article into MSN's content syndication network and partner feeds. The publishing partner does not receive payment card data or national identifiers.

We do not sell personal data and do not run advertising trackers on this site.

Retention

Enquiries are kept up to 24 months. Invoicing records are kept as long as Norwegian accounting law requires (currently five years). Subscription records are kept while the subscription is active plus the statutory period.

Your rights

You may request access, correction, deletion, restriction, portability, or object to processing, and you may withdraw consent where processing relies on it. Email us and we will respond within 30 days. You can also complain to the Norwegian Data Protection Authority (Datatilsynet) or your local supervisory authority.

Transfers and security

Data is stored in the EU/EEA where possible. Where a provider processes data outside the EEA, transfers rely on Standard Contractual Clauses. Access is restricted and encrypted in transit.

Cookies

Necessary storage keeps checkout, sign-in and your consent choice working. Optional analytics runs only if you accept it.