Privacy Policy — NORDWEBS

Data controller: NORDWEBS, Oslo, Norway
[Organization number — to be added once registered]
Contact: Nordwebs.no@gmail.com

1. What we collect, and why

Purpose	Data	Legal basis (GDPR Art. 6)
Responding to enquiries via the contact form	First name, last name, email, company name, service of interest, message	Legitimate interest / steps prior to entering a contract
Chatting with the AI assistant on the site	Whatever you type into the chat widget (kept only in your browser tab during the session, and forwarded to our AI provider to generate a reply — see section 3)	Legitimate interest
Preparing quotes and delivering projects for clients	Name, company, contact details, project/billing information	Performance of a contract
Bookkeeping and invoicing	Name, company, invoice details	Legal obligation (Norwegian Bookkeeping Act)
Website statistics and marketing (if enabled in future)	Cookie-based usage data — see our Cookie Policy	Consent

2. Where the data comes from

Directly from you: when you fill out the contact form, message our chat widget, email us, or become a client. We don't buy or scrape personal data from third parties.

3. Who we share it with

We use a small number of service providers ("processors") to run the site and our business:

Netlify, Inc. — hosts the website, processes contact-form submissions, and runs the serverless function behind the AI chat widget.
Anthropic — the AI provider behind our chat widget. When you send a message in the chat, it's forwarded (via our Netlify function) to Anthropic's API to generate a reply. We don't store chat conversations in a database ourselves — they only exist in your browser tab for the length of that visit.

Both providers are based outside the EU/EEA (United States). Where personal data is transferred there, we rely on the safeguards our providers make available (such as standard contractual clauses), as applicable. We don't sell personal data to anyone, ever.

4. How long we keep it

Contact-form enquiries that don't turn into a client relationship: deleted after 12 months.
Client records: kept for the duration of the engagement, plus whatever the Norwegian Bookkeeping Act requires for invoices (5 years).
Chat widget messages: not stored by us beyond your browser session.
Cookie/consent data: see our Cookie Policy for retention per cookie.

5. Your rights

Under GDPR, you can ask us to:

show you what data we hold about you
correct inaccurate data
delete your data ("right to be forgotten")
restrict or object to processing
give you your data in a portable format

You can also withdraw consent at any time (this doesn't affect processing carried out before the withdrawal), and you have the right to complain to the Norwegian Data Protection Authority (Datatilsynet) if you think we're handling your data incorrectly.

To use any of these rights, email Nordwebs.no@gmail.com. We aim to respond within 30 days.

6. Security

We rely on reputable providers (Netlify, Anthropic) who maintain their own technical and organizational security measures, and we limit access to personal data to what's needed to run the business.

7. Changes to this policy

We may update this policy from time to time — for example when we add new tools or services. The latest version is always available on this page.

Questions about this policy, or about a service you've asked us about? Email Nordwebs.no@gmail.com, or use the contact form.