Privacy
Privacy notice
This notice explains what personal data ZAVQERA collects, why, on what legal basis, who else handles it, how long it is kept, and what you can require of us. It is given under Articles 13 and 14 of the General Data Protection Regulation as it applies in Norway through the Personal Data Act (personopplysningsloven).
This document is not yet in force. The service is not open to users, and the operator’s own details below are still unfilled — anything shown in square brackets is a placeholder, not a value. It will be completed, and dated, before anyone is invited to create an account.
1. Who is responsible
The controller for the processing described here is:
- [CONTROLLER NAME — replace before launch]
- [POSTAL ADDRESS, NORWAY — replace before launch]
- [ORGANISATION NUMBER, if registered — otherwise remove this line]
- Privacy contact: [privacy@zavqera.com — replace before launch]
We have not appointed a Data Protection Officer. We are not required to: we do not carry out large-scale monitoring and we do not process special categories of data as a core activity. Privacy questions go to the address above and are answered by the controller.
2. What we collect, why, and on what basis
Each purpose has its own legal basis. We do not rely on a single blanket justification.
| Purpose | Data | Legal basis | Kept for |
|---|---|---|---|
| Creating and running your account, and signing you in | Email address, password hash | Article 6(1)(b) — necessary to perform the contract you enter by creating an account | Until you close the account, then deleted within 30 days |
| Storing and showing you your Missions | Mission name, intent, success criteria, steps, follow-up dates, verification notes and outcomes | Article 6(1)(b) — this is the service itself | Until you delete the Mission or close the account |
| Storing and showing you your opportunities in Opportunity Intelligence | Opportunity name, who it is for, thesis, source link, your five ratings, and the evidence notes you attach (source link, title, your observation, source type, dates and your reliability rating) | Article 6(1)(b) — this is the service itself | Until you remove the opportunity or close the account |
| Sending a password reset link when you ask for one | Email address | Article 6(1)(b) — part of operating your account | Reset links expire; no separate record is kept |
| Keeping the service available and investigating faults | Server and request logs held by our hosting and database providers, which can include IP addresses | Article 6(1)(f) — our legitimate interest in a service that works and is not abused | Held by those providers for a limited period under their own retention rules |
| Telling you when a plan you asked about becomes available | The email address you gave on the pricing page, which plan you asked about, and the exact sentence you agreed to | Article 6(1)(a) — your consent, given by submitting that form. You may withdraw it at any time by writing to us, and we delete the address | Until we have sent that one message, or you ask us to delete it, or 24 months pass without the plan opening |
| Counting how many times each page was opened | The page path, the date, and the website that linked here. No identifier of any kind, and nothing is stored on your device | Article 6(1)(f) — our legitimate interest in knowing whether the service is used. Because no one is identified, this does not single you out | Daily totals only, kept for 24 months |
| Seeing how the public pages are found and used, with Umami | Address of the public page, domain of the referring website, screen size, browser language, page title; IP address and browser details in transit. Nothing from the signed-in workspace | Article 6(1)(f) — our legitimate interest in knowing whether the public pages are found and used | Until we delete the statistics from Umami or close that account |
Is providing it optional? An email address and a password are required to have an account; without them we cannot create one. Everything you write into a Mission is entirely your choice, and a Mission can hold as little as you like.
What we do not do. We do not sell personal data. We do not share it for anyone else’s own purposes. We do not profile you, build an advertising audience, or combine your data with data bought from elsewhere. We do not use your Missions or your opportunities to train machine-learning models.
3. Who else handles it
These are our processors. They act only on our documented instructions, under a data processing agreement, and may not use your data for themselves.
| Processor | What it does | Where | Transfers |
|---|---|---|---|
| Supabase | Database and authentication: your email address, your password hash, everything you write into a Mission, and the opportunities and evidence notes you record. | eu-west-1 (Ireland) — inside the EEA | No transfer outside the EEA for stored data. |
| Netlify | Hosting and delivery of the application. Processes request data such as IP addresses in transit in order to serve pages. | United States, with a global delivery network | Covered by the EU Standard Contractual Clauses in Netlify's data processing agreement. |
| Umami | Visitor statistics for the public pages (Umami Cloud). Receives the address of the public page you opened, the domain of the website that linked you here, your screen size, your browser language and the page title, and, as with any request your browser makes, your IP address and browser details in transit. | Umami Software, Inc. is established in the United States | A transfer outside the EEA, under Umami's data processing agreement. |
We may also disclose data where the law requires it, or to establish or defend a legal claim. If that ever happens we will tell you unless we are forbidden to.
4. Opportunity Intelligence
The opportunities you score and the evidence notes you attach are stored in your account, in the same database as your Missions and under the same row-level restriction: only your own signed-in session can read them. They are available on any device where you sign in, and they are deleted when you remove them or close your account. What you write there is your choice; do not enter confidential or sensitive personal information.
Earlier versions kept this data only in your browser, under the key zavqera.opportunity-intelligence.v1, and it never reached us. The first time you open Opportunity Intelligence after this change, whatever that browser still holds is copied to the account you are signed in to, so that nothing you recorded is lost. We do not alter or erase the copy in your browser; clearing your browser data removes it. You can still export a backup file if you want a copy you control.
5. Cookies and your device
Norwegian law (ekomloven § 2-7b, implementing the ePrivacy Directive) requires consent before storing or reading information on your device, unless it is strictly necessary for a service you asked for. We store the following, and each is strictly necessary or set by your own choice:
- Session cookies set by our authentication provider, which keep you signed in. Without them the service cannot tell one signed-in person from another.
zavqera-language— the language you selected. One year.zavqera-theme— the light or dark setting you selected. One year.zavqera.opportunity-intelligence.v1.uploaded— written once, in a browser that held opportunities from before they moved to your account, to record that they have been copied so they are not copied again. It holds a date and nothing else.
There are no advertising cookies and no advertising trackers. One analytics script is loaded from another company, Umami (cloud.umami.is); section 6 describes it. Your browser requests that script only when you open a public page, and it is never sent anything from the signed-in workspace. It sets no cookie and writes nothing to your device. It reads one entry from your browser's storage, umami.disabled: if that entry is set, the script sends nothing. Our own page counting touches nothing on your device.
6. How we count visits
We record, on our own servers, how many times each page was opened on each day and which website linked here. That is the whole record. We do not store an IP address against it, we do not set a cookie or identifier, we do not fingerprint your browser, and nothing is written to your device. The result is a daily total per page — it cannot be traced to you, and we could not single you out from it if we tried.
We do this to know whether anyone is using the service and which parts are reached, on the basis of our legitimate interest under Article 6(1)(f). Because no one is identified, this processing does not affect your rights and freedoms; you may still object using the contact address above.
On the public pages we also use Umami, a visitor-statistics service run by Umami Software, Inc. When you open one of those pages, your browser loads a script from cloud.umami.is and sends Umami the address of the page (without anything after a ? or #), the domain of the website that linked you here, your screen size, your browser language and the page title. As with any request your browser makes, Umami's servers also receive your IP address and browser details in order to answer it. We do not send Umami your email address, an account identifier, or anything you write in the service. If your browser sends a Do Not Track signal, the script sends nothing. We use Umami for the same purpose and on the same basis as our own counter, and you may object in the same way.
7. Artificial intelligence and automated decisions
The plan suggestions and the review of what you have written are produced by rules in our own source code, running on our own servers. Nothing you type is sent to an AI provider to generate them.
A separate server-side AI analyst exists in the codebase for the Opportunity Brief. It is switched off and restricted to approved testers. If it is ever enabled for your account, the text you submit would be sent to the AI provider named at that time, and this notice will be updated and you will be told before that happens.
No automated decision-making. Nothing here produces a decision with legal or similarly significant effects for you within the meaning of Article 22. Suggestions are proposals you are free to ignore, and no outcome is applied to you automatically.
8. How long we keep it
The retention period for each purpose is in the table in section 2. In addition: closing your account deletes your account record, your Missions and your opportunities within 30 days. Copies may persist in our database provider’s backups for a limited further period before being overwritten, and we cannot selectively erase a backup. Server logs held by our providers follow their own retention rules.
9. Security
Data is encrypted in transit. Passwords are stored only as a cryptographic hash and are never visible to us. Access to the database is restricted at the row level so that one account cannot read another’s data, and those rules deny by default rather than allow by default.
If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify Datatilsynet within 72 hours of becoming aware of it, and tell you directly where the risk is high.
10. Your rights
You may ask us to:
- Give you a copy of the personal data we hold about you (Article 15).
- Correct anything inaccurate or incomplete (Article 16).
- Erase it (Article 17).
- Restrict how we use it while a dispute is resolved (Article 18).
- Send it on to you or another provider in a machine-readable form (Article 20).
- Object to any use we base on legitimate interest, including the page counting in section 6 (Article 21).
Write to [privacy@zavqera.com — replace before launch]. We answer within one month, and will say so if a request is complex enough to need the two-month extension the regulation allows. Exercising these rights is free; we will only charge, or refuse, where a request is manifestly unfounded or excessive, and we will explain why.
You may also complain to the supervisory authority. For a controller established in Norway that is Datatilsynet, Postboks 458 Sentrum, 0105 Oslo, Norway — postkasse@datatilsynet.no — https://www.datatilsynet.no/. You may instead complain to the authority in the EEA country where you live.
11. Children
This service is intended for adults and is not directed at children. You must be 18 or over to create an account, as the terms of service require. We do not knowingly collect data from children; if you believe a child has created an account, write to [privacy@zavqera.com — replace before launch] and we will delete it.
12. Language
The application is available in six languages. This notice and the terms of service are published in English only, and the English text governs. A mistranslated clause about data or liability would bind a reader to something nobody intended, which we consider worse than asking you to read two pages in a second language. If anything here is unclear, write to [privacy@zavqera.com — replace before launch] and we will explain it in your language.
13. Changes
When this notice changes materially we update the date at the top and, where the change affects how your data is used, tell you inside the application before it takes effect. Continuing to use the service after that means the current version applies.