Privacy Policy

Last updated: April 17, 2026

This Privacy Policy explains how Disrupting IT AS (“NorData”, “we”, “us”) collects, uses, and protects personal data when you use the NorData service available at nordata.io. We aim to comply with the EU General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act.

1. Data controller

The data controller is Disrupting IT AS, Engene 16, 3015 Drammen, Norway. For privacy questions, contact us at info@disruptingit.no.

2. What we collect

• Account data: email address and authentication identifiers provided through Firebase Authentication.
• Billing data: customer ID, invoice history, and payment method metadata stored and processed by Stripe. We do not store full card numbers on our servers.
• API usage data: request counts, timestamps, and endpoint identifiers used to meter usage and bill correctly. We do not store the content of your individual queries unless required for abuse investigation or legal compliance.
• API tokens: stored encrypted at rest. The full token is shown to you once at creation and never again.
• Technical logs: IP address, user agent, and error logs kept for a limited time to ensure service security and reliability.

3. Why we use your data (legal basis)

• Contract (GDPR art. 6(1)(b)): to provide the service, manage your account, and bill for usage.
• Legitimate interest (art. 6(1)(f)): to secure the platform, prevent fraud and abuse, and improve reliability.
• Legal obligation (art. 6(1)(c)): to retain accounting records as required by Norwegian law.
• Consent (art. 6(1)(a)): for optional newsletter sign-up. You may withdraw consent at any time.

4. Sub-processors and data sharing

We use trusted third parties to operate the service. They only process data on our behalf under appropriate agreements:

• Google Firebase — authentication and account verification.
• Stripe — payment processing, billing, and tax calculation.
• Cloud hosting — application hosting and managed PostgreSQL database within the EU/EEA where possible.

We do not sell your personal data and do not share it with advertisers.

5. The data the API returns

The NorData API exposes information sourced from public Norwegian registries (such as the Brønnøysund Register Centre, Kartverket, and similar public sources). When you query the API, the response may contain personal data about third parties (for example, sole proprietors or board members listed in public registries). You are an independent data controller for any personal data you retrieve and must have your own legal basis to process it.

6. Retention

Account and billing data are retained while your account is active and for as long as required by accounting and tax law (typically up to 5 years after the relationship ends). Usage logs are kept for as long as needed to operate the service and are then deleted or aggregated.

7. Your rights

Under GDPR you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your account and associated data;
• restrict or object to certain processing;
• receive your data in a portable format;
• lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) or your local supervisory authority.

You can delete your account from the Account page or by writing to info@disruptingit.no.

8. Cookies and local storage

We use a small number of strictly necessary cookies and local storage entries to keep you signed in and to remember your theme preference. We do not use advertising or cross-site tracking cookies.

9. Security

We use TLS in transit, encrypt API tokens at rest with AES-256-GCM, and apply standard hardening measures. No system is perfectly secure — please report suspected vulnerabilities to info@disruptingit.no.

10. International transfers

Some sub-processors (e.g. Stripe, Google) may process data outside the EEA. Where this happens, we rely on the European Commission’s Standard Contractual Clauses or equivalent safeguards.

11. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent change. Material changes will be communicated by email or in-app notice.