Who is responsible
Norwygo AS is responsible for the processing described here. Contact privacy@norwygo.no for privacy questions or requests.
Accepting the Terms confirms that you have read this policy, including the information about analytics data. It does not provide consent to optional tracking; where consent is required, it must be obtained separately before collection.
Early access and contact requests
When you join the early access list, we store your email, language, whether you need help or want to consult, the time and source of the request, and any experience description you choose to provide. We use these to administer your request and contact you about the early access you requested. Joining does not create an account or a paid booking.
Contact inquiries contain your name, email, selected topic, subject, message and submission record. We use them to answer and follow up on your inquiry. Please do not send passwords, identity numbers, medical records or documents about other people through these forms.
Your request may generate a confirmation email and an internal notification. Delivery records include recipients, message content, timestamps, status and provider identifiers. Access is restricted to people and service providers who need it to handle the request or operate the service.
Purposes and legal bases
Early access communications you request are based on consent (GDPR Article 6(1)(a)); you can withdraw it. For an inquiry about a possible service agreement, necessary handling may be based on steps at your request before a contract (Article 6(1)(b)). Other support, abuse prevention and necessary operational records may rely on legitimate interests (Article 6(1)(f)): answering inquiries and maintaining a secure, reliable service. This does not authorize unrelated marketing or optional tracking. Records required by applicable law rely on Article 6(1)(c).
Website analytics and technical information
Norwygo uses PostHog for website analytics. Events can describe pages visited, language, referral information, interactions with guides and early access forms, submission outcomes, browser/device identifiers and approximate location derived from IP. Device IDs do not necessarily represent individual people. Our custom form analytics do not intentionally include email addresses or the free-text description.
Technical providers also handle information needed to deliver and protect the website, such as IP addresses and request/error logs. Optional tracking requires a valid consent mechanism where applicable. Browser settings alone do not replace that requirement. You can contact us about analytics data and object to processing based on legitimate interests. This notice is information, not consent to tracking.
Service providers and international transfers
The service uses Supabase for application data, Vercel for hosting, Postmark for email and PostHog for analytics. Error monitoring may involve Sentry where enabled. These services may process information outside the EEA. The applicable provider agreement, processing locations and transfer safeguards determine how a particular transfer is protected. Where required, transfers need an adequacy decision or appropriate safeguards such as Standard Contractual Clauses; a provider name alone is not a guarantee. Contact privacy@norwygo.no for information about safeguards applicable to your data and how to obtain a copy.
Retention and removal
Early access data is needed while we administer the requested launch communications; withdrawal or the end of that purpose triggers a retention review and removal unless another documented basis requires limited retention. Contact records are retained according to the time needed to resolve and follow up on the inquiry, handle a dispute or meet a legal obligation. Security and delivery logs should be limited to their operational purpose. Backup copies follow their rotation cycle and must not be reused to restart a withdrawn subscription.
To leave the list, reply to a Norwygo email or write to privacy@norwygo.no. Leaving does not require an account. Withdrawal does not affect the lawfulness of processing before withdrawal. A minimal suppression record may be needed to respect your request and prevent further unwanted messages.
Your rights
Depending on the legal basis and circumstances, you may request access, correction, erasure, restriction, portability and object to processing. You may withdraw consent and complain to Datatilsynet. We normally respond to rights requests within one month; where a lawful extension applies, we explain it. We may need proportionate information to verify your identity. Erasure is not absolute where a lawful retention obligation applies.
Children, security and updates
The service is not designed for children under 16. Please contact us if a child has provided personal data. This age limit is a product rule, not a statement that everyone aged 16 can enter every paid contract. We use access controls and other safeguards, but cannot promise absolute security. Material changes to processing require updated information and, where necessary, a new legal basis or consent; simply publishing a policy does not create consent.