Effective date: May 4, 2026
The data controller responsible for your personal data is:
As a Norwegian sole proprietorship operating within the European Economic Area, we are subject to the General Data Protection Regulation (GDPR, EU 2016/679) as implemented in Norwegian law through the EEA Agreement and the Norwegian Personal Data Act (personopplysningsloven).
We collect only what is necessary to provide the Service. The table below summarises every category of personal data we process, along with the legal basis under GDPR Article 6.
| Category | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Account | Email address | Authentication (magic link sign-in), transactional emails (sign-in link, risk alerts) | Art. 6(1)(b) — contract performance | Until account deletion, max 3 years of inactivity |
| Subscription | Email, payment method token (held by Stripe — we never see card numbers) | Processing subscription payments, managing billing | Art. 6(1)(b) — contract performance | 7 years (Norwegian bookkeeping law / regnskapsloven) |
| Usage / lookups | User ID + company ID searched, timestamp | Enforcing free-tier search limits, powering saved search history | Art. 6(1)(b) — contract performance | 12 months rolling |
| Analytics | Page URL, referrer, country (no cookies, no fingerprinting) | Understanding which pages are used — Simple Analytics, privacy-first | Art. 6(1)(f) — legitimate interest (aggregate, non-personal) | Not personal data — retained indefinitely in aggregate |
| Contact | Name, email, message content | Responding to support or enquiry emails | Art. 6(1)(f) — legitimate interest | 2 years from last contact |
We do not collect sensitive categories of personal data (Article 9 GDPR). We do not collect data about children under 18.
We use a minimal number of cookies, all strictly necessary:
Our analytics provider is Simple Analytics (simpleanalytics.com), which does not set cookies, does not track individuals across sites, and respects Do Not Track (DNT) signals. We have configured Simple Analytics to collect Do Not Track signals (data-collect-dnt="true"), meaning your browser's DNT preference is honoured.
We do not sell personal data. We share data only with the processors listed below, each bound by a Data Processing Agreement (DPA):
We may disclose personal data if required by Norwegian law, court order, or other governmental authority, or to protect the rights, property, or safety of KnowVendor or others.
Our primary data processors (Supabase, Vercel) operate within the EU/EEA. Where data is transferred outside the EEA — for example to Stripe's US infrastructure or Resend — such transfers rely on the European Commission's Standard Contractual Clauses (SCCs) or the processor's participation in an approved adequacy framework.
Users located in the United States should be aware that their data is stored on servers in the European Union and subject to EU/EEA data protection law.
Under GDPR you have the following rights regarding your personal data. To exercise any of them, contact us at hello@knowvendor.com. We will respond within 30 days.
You also have the right to lodge a complaint with the Norwegian supervisory authority:
We implement appropriate technical and organisational measures to protect your personal data, including:
In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and Datatilsynet as required by GDPR Articles 33-34.
We retain personal data only as long as necessary for the purpose for which it was collected, or as required by law. See the table in Section 2 for specific retention periods. When you delete your account, your email address and lookup history are deleted within 30 days. Billing records are retained for 7 years to comply with Norwegian bookkeeping law (regnskapsloven).
The Service is not directed at persons under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at hello@knowvendor.com and we will delete it promptly.
If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) as amended by the CPRA:
We do not sell or share personal information as defined under the CCPA/CPRA. To exercise your rights, contact us at hello@knowvendor.com.
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email and update the effective date at the top of this page. Continued use of the Service after the effective date constitutes acceptance of the updated policy.