Privacy notice

This notice explains how Covision Technology AS processes personal data when you use Advitics or visit advitics.no. It is our information to you under Articles 13 and 14 of the General Data Protection Regulation (GDPR).

The authoritative version of this notice is the Norwegian one at advitics.no/personvern. This English translation is provided for convenience. In case of conflict, the Norwegian text prevails.

In brief

• Who we are. Advitics is provided by Covision Technology AS, company no. 991 248 560, Hamar, Norway.
• What we are. A B2B platform for businesses that want to find more customers and sell more to the ones they have. The service is not aimed at consumers.
• Two roles. We are the controller for data about you who sign in and use the platform, and for the directory of businesses. We are a processor for the personal data contained in the customer's own business data.
• Where the data lives. The platform and the database run on Covision's own equipment in Norway, and the backups are held on equipment at Covision's disposal in Norway.
• We never sell data, and we do not train AI models on the content of your conversations or integrations.
• Sign-in. You sign in with Google or Microsoft. We receive your name and email address, and from Google also your profile picture, but never your password.
• Google data. If you connect a Gmail account, we read and send mail solely to deliver the features you yourself have switched on, and we mark mail as read, archive it or move it to the trash only when a user asks us to. Advitics never moves mail from a shared mailbox to the trash. See §6.
• The mapping of businesses. We collect information about Norwegian businesses from the Brønnøysund Register Centre (Brønnøysundregistrene) and from their websites, so that our customers can find new business customers. This may concern you if you run a sole proprietorship, or if you are mentioned on a company's website. See §3.5.
• The order confirmation. If you accept an order confirmation on behalf of a customer, we store your name, email address and role, the time and a receipt, to document the agreement. See §3.10.
• Your rights. Access, rectification, erasure, restriction and data portability. Write to personvern@advitics.no and we will respond within one month.
• You can object to processing based on our legitimate interest, and to data about you being used for marketing. For marketing, you do not need to give reasons for your objection. See The right to object.

1. Controller

Covision Technology AS Company no. 991 248 560 Hamar, Norway

"Advitics" is the trading and product name of the service Covision provides. A separate Advitics AS has not been incorporated. Should it be, controllership will be formally transferred and this notice updated with at least 30 days' advance notice to active customers.

Privacy enquiries: personvern@advitics.no

General contact: info@advitics.com

Data protection officer

We are not required to appoint a data protection officer under GDPR Article 37: our core activity is neither regular and systematic monitoring on a large scale nor large-scale processing of special categories of personal data. We reassess the need on any material change in the nature or scope of the processing, and we will appoint an officer if the conditions in Article 37 arise.

2. When we are controller, and when we are processor

Where we are the processor, the customer is the controller and determines the purpose. The data processing agreement (DPA) is part of the order confirmation the customer accepts, and the customer can obtain the current version at any time by writing to personvern@advitics.no.

3. What data we process

3.1 Account data

Name, email address, role in the organisation, which customer you belong to, and sign-in events (time, IP address, which authentication method was used, registered passkeys).

Legal basis: GDPR Art. 6(1)(b) where you are yourself a party to the contract with us. Where the contract is with your employer, the basis is Art. 6(1)(f) — our legitimate interest in administering and securing the customer relationship.

The data is needed to create and use an account. You are under no obligation to provide it, but without it you cannot sign in to Advitics.

3.2 Data we receive at sign-in

You sign in with your Google account or your Microsoft account. We never receive your password, whichever you choose.

From Google (OpenID Connect) we receive:

• your name
• your email address and whether it is verified
• your profile picture (URL)
• the Google account's internal user ID
• which Google Workspace domain the account belongs to, where it is a Workspace account

From Microsoft Entra ID we receive:

• your email address, and Microsoft's confirmation that it is verified
• your first and last name, where the account has them registered
• a durable user ID (oid) and an ID for the organisation the account belongs to (tid)

Microsoft does not give us a profile picture. We store the combination of the two IDs as your identity, instead of your email address, so that your account follows you if the email address changes. Sign-in is refused if Microsoft does not confirm that the address is verified.

This data is used to create and recognise your user account, and to associate you with the right customer. If you sign in without an account and without an invitation, we create no account, but may store a request for access. This is described in §3.9.

Legal basis: as in §3.1.

3.3 The email account you may connect

If you choose to connect a Gmail or Google Workspace account to Advitics, we ask for access to send mail on your behalf and to read and change the status of mail in your mailbox. We ask for the same access for personal and shared mailboxes, and we use it to show and manage the mailbox in Advitics, link mail to the CRM and detect failed delivery.

The first time, we retrieve mail from the last 90 days, excluding spam, trash and chat. After that, we retrieve new mail as it arrives, including mail Gmail sorts as spam. It is not shown in the inbox in Advitics. We then process:

• mail you send through Advitics — for mail from customer conversations we store only metadata, while the content of campaign mail is stored as part of the campaign
• metadata for messages in the mailbox — sender, recipients, subject and time — including for messages that do not belong to a customer conversation
• Gmail labels and whether the mail has been read, for example inbox, sent and unread
• the content of a message when it is retrieved, for example for display or when you reply
• messages that may be notifications of failed delivery, which are retrieved automatically in order to detect them
• technical metadata such as message IDs and thread identifiers

The status is changed only when a user asks for it in Advitics: Advitics then marks mail as read or unread, archives it or moves it back to the inbox in Gmail. In a personal mailbox only you, as the owner, can ask for it, and you can also move mail to the trash. Gmail itself deletes mail that has been in the trash for 30 days. In a shared mailbox those who can send from the address can ask for it, and the change applies to everyone who uses the mailbox, in Gmail too. Advitics never moves mail from a shared mailbox to the trash.

Only the owner sees the mail from a personal mailbox. The administrator role does not give access. Everyone in the workspace who has access to email sees the mail from a shared mailbox. Those with permission to send email can send from the address in the CRM. "Restricted sending" under "Members / access" limits which of them can send.

Connecting is voluntary, done per mailbox, and can be disconnected at any time in Advitics or in your Google account's security settings. What is deleted on disconnection, and when, is set out in §5. See §6 for what we do not do with this data.

Our role: Advitics processes this data as a processor on the customer's documented instructions. The customer is the controller and is responsible for establishing and documenting the legal basis.

3.4 Business data from integrations

If the customer connects its accounting system (Tripletex or Fiken), we retrieve data from it: orders, invoices, products and contact details for the customer's own customers. From Fiken, and from Tripletex when the import of the general ledger is switched on, we also retrieve the chart of accounts and accounting entries on a selection of the income and expense accounts, with the text recorded on the entry. Entries on the payroll accounts are not retrieved.

Advitics is a processor here. The customer decides which systems are connected, and why.

Our role: Advitics processes this data as a processor on the customer's documented instructions. The customer is the controller and is responsible for establishing and documenting the legal basis.

3.5 The mapping of businesses

Advitics has a directory of Norwegian businesses. It helps our customers find companies that resemble their best customers, and get in touch with them. The web crawler Advitics-Atlas retrieves the content from the websites, and Google's language model Gemini helps us find the right website for a business and assess what the business does.

The information comes from two publicly available sources:

• the Brønnøysund Register Centre: the Central Coordinating Register for Legal Entities (Enhetsregisteret) and the Register of Company Accounts (Regnskapsregisteret)
• the businesses' own websites, which the crawler visits

We store:

• about the business: name, organisation number, organisational form, address, industry, number of employees, financial figures such as turnover, and telephone number and email address as they appear in Enhetsregisteret
• from the website: the address of the website, which technology it uses, role addresses such as post@ and info@, and the text on the front page and the about-us page, up to 2,000 characters per page. Before the text is stored, we remove email addresses and telephone numbers from it, but names remain
• from the pages the crawler retrieves: structured data the website itself has published for search engines (JSON-LD). Entries marked as persons are removed before storage, but telephone numbers and email addresses in the structured data may remain
• for each of our customers: how well the business fits the customer, and whether the website shows that the business may be a relevant buyer, with a verbatim quotation from the website as justification

The text on contact pages is no longer stored. Text that was stored from contact pages earlier, and that may contain email addresses and telephone numbers, has not yet been deleted.

For a sole proprietorship, the information about the business is personal data about the owner. The business name often contains the owner's name, the address is often the home address, and the telephone number may be a private mobile number. If you are employed by a company, your name and position may appear in the text from your employer's about-us page. We use the information in a business context, not about you as a private individual.

A sole proprietorship is ranked only for Covision's own workspaces, not for other customers. The ranking is based only on the industry code, number of employees, turnover and county from the registers. The website and the assessment of whether the business may be a relevant buyer are not used when we rank a sole proprietorship. A bankruptcy registered with the Brønnøysund Register Centre means the business is not ranked as a relevant customer.

Our customers see the businesses, the ranking and the quotation in Advitics. To find the right website and to assess the website, we send the business's name, organisation number, postal town and industry, together with excerpts of the text on the website, to Gemini at Google. Google may process them outside the EEA, see §8 and §9.

Legal basis: GDPR Art. 6(1)(f). The legitimate interest is our interest in offering the directory, and our customers' interest in finding and contacting new business customers. The balancing of interests is documented internally and reviewed at least once a year.

Retention: We have not yet set a deletion deadline for the directory. The text from a website is replaced when the crawler visits it again. The information from the registers remains, also when the business has been deleted from the register. Rankings and assessments made for a customer are deleted when the customer's workspace is wound up. If you object to an organisation number being used for marketing, we store the organisation number, the time and how the objection reached us, for as long as the directory may contain information about the business. We do this so that the objection continues to apply.

Objection and opt-out. You can object at any time to data about you being used in the directory, and you do not need to give reasons for your objection. If you are mentioned on a company's website, you can object yourself, without going through the company. See The right to object.

If you run a sole proprietorship, you can object with the organisation number, at advitics.no/bots/opt-out (in Norwegian) or by writing to personvern@advitics.no. We then stop ranking and delivering the business and showing it in the search in Advitics, and we delete its rankings. Email sent through Advitics to the business is stopped, and if we call from our own customer register, we mark the business and you as do-not-contact there. The objection applies to the organisation number. It does not cover you in other roles, for example as general manager of another company, or a new organisation number. If one of our customers has already added the business to its own customer register in Advitics, your objection to us does not remove it; you must also object to the customer.

If you operate a website, you can opt the website out at advitics.no/bots (in Norwegian) or block Advitics-Atlas in robots.txt. We honour robots.txt without exception. When a website opts out, we stop retrieving from it and stop using the text we have stored from it. The text is not deleted automatically, but we delete it when you ask us to.

3.6 Conversations with the AI agents

When the chat function is on, we store your questions, the answers, which agent and model responded, timestamps, and any actions the agent performed in the customer's own database. The message you send is stored even when the language model does not respond; a technical response is then stored instead. A conversation is deleted automatically 30 days after the last message.

Sigrid can propose remembering a short piece of information about the business. It is stored only when a user with permission to approve clicks Approve. The memory is shared with everyone in the workspace and included in later conversations, including when someone else writes. Everyone can view it under Settings → Sigrid remembers; users with permission to approve can edit and delete the lines. We store at most 15 lines of at most 200 characters. Memory is not deleted after 30 days with the conversation: it remains until you delete the lines or the workspace is wound up. An operator can also delete selected lines on the customer's written instructions.

Our role: Advitics processes the conversations as a processor on the customer's documented instructions. The customer is the controller and is responsible for establishing and documenting the legal basis.

3.7 Use of the advitics.no website

The website runs on Vercel. We use Vercel Analytics and Vercel Speed Insights for aggregated visitor statistics and performance measurement. These are configured without tracking cookies and without cross-site profiling.

Legal basis: GDPR Art. 6(1)(f) — legitimate interest in understanding and improving the website.

3.8 Technical logs and security logs

We log error messages, performance measurements, request traces and security events (sign-ins, failed attempts, suspicious traffic). The logs may contain IP addresses and user IDs.

Legal basis: GDPR Art. 6(1)(f) — legitimate interest in secure and stable operation.

3.9 When you sign in without an invitation

If you sign in with Google or Microsoft without having an account with us and without a valid invitation, we refuse the sign-in, and no account is created. If you did not come through an invitation link, we store a request for access, so that we can handle your enquiry and consider whether we can set up a workspace for you. If you came through an invitation link, we store nothing here. If we have already received 30 new requests in the last hour, we store no new one, and you are asked to try again later.

The request contains:

• your email address
• your account ID at Google or Microsoft
• the Google Workspace domain or the organisation ID from Microsoft, where the account has one
• which of the two you signed in with, how many times you have tried, and when you first and last tried
• how far we have got with the request, and who on our side handled it

Your name and profile picture from the sign-in are not stored in the request. Only Advitics' own operators see it. Before we set up a workspace, we may look up the business in Enhetsregisteret and call the telephone number listed there, to confirm that you belong to the business.

Legal basis: GDPR Art. 6(1)(f) — our legitimate interest in handling an enquiry about becoming a customer and considering whether we can offer a workspace. If you yourself become a party to the contract, for example as the owner of a sole proprietorship, the basis is in addition Art. 6(1)(b). Without the data we cannot handle the request.

Retention: We delete the request after 90 days without a new attempt, unless we are then in the process of creating a workspace from it. It then remains until the creation has finished or failed. Once the request has been handled, we delete it 30 days after handling, if that comes first. The deletion runs once an hour. Copies in the backups disappear when the backups are rotated out: from the main copy after about 90 days, and from the copy outside the production site at the latest within 12 months.

Objection: You can object to the processing by writing to personvern@advitics.no. We then delete the request. If you sign in without an invitation again later, a new one is stored.

3.10 When you accept an order confirmation

A customer starts using Advitics by accepting an order confirmation in Advitics. The person who accepts is the owner of the customer's workspace, and confirms that she or he has authority to enter into the agreement on behalf of the customer.

We store:

• your name, email address and role in the workspace
• the time of the acceptance, and that you confirmed your authority
• a receipt with the full order confirmation, the acceptance and a checksum (SHA-256) that allows the text to be verified

The receipt is sent to you by email, with a copy to our own archive address. The email goes through MailerSend, see §8.

Legal basis: GDPR Art. 6(1)(b) where you are yourself a party to the contract, for example as the owner of a sole proprietorship. Otherwise the basis is Art. 6(1)(f) — our legitimate interest in entering into the agreement with the customer and being able to document who accepted it. Our retention of the acceptance and the receipt is based on Art. 6(1)(c): agreements must be retained under the Norwegian Bookkeeping Act (bokføringsloven) § 13 first paragraph no. 5.

Without your name, email address and role we cannot register the acceptance, and the customer then cannot start using Advitics.

Retention: three years and six months after the end of the financial year, cf. the Bookkeeping Act § 13 second paragraph.

3.11 When Advitics is used for sales email

When a user sends sales email through Advitics, the service determines for each message whether it is unsolicited, based on consent or an existing customer relationship, or a reply to an enquiry initiated by the recipient. We store the outcome in the sending records and on the sent message. For every outcome except unsolicited, we also store an ID that points to the evidence.

When a user records consent to sales email, we store the purpose, the version of the wording the user confirmed, and a SHA-256 checksum of that wording. The customer can then document what the consent covered.

When an email template is used, we store which template and template version or starter template was used, the sent message it belongs to, where in Advitics the template was used, the user who used it, and the times of use and confirmed sending. Advitics measures the share of a user's email sent from Advitics during the past 30 days that used a template, and the reply rate per template and template version. The reply rate covers email sent at least 14 days ago. For one-to-one email, an incoming reply counts if it arrived within 14 days and before the next confirmed outgoing message in the same thread. For sequences, a recorded reply linked to the particular send counts if it arrived within 14 days; the next outgoing message does not limit this window. The measurement only reads metadata that is already stored. It does not read message content, and we do not track opens or clicks.

An unsolicited email is labelled “This is a sales enquiry from …”. One-to-one marketing email also includes a separate line about the right to object, except where the email is a reply to an enquiry initiated by the recipient. For a named recipient, Advitics includes the information required by GDPR Article 14, except when replying to a recipient who has already written in the same thread. When the notice must be included, sending is blocked if the customer has not registered a link to its privacy notice. The customer may use its own page or a public page that Advitics displays on the customer's behalf at e.advitics.com.

Our role: Advitics processes the data as a processor on the customer's documented instructions. The customer is the controller and is responsible for establishing and documenting the legal basis. When Covision uses the same features in its own workspace, Covision is the controller.

3.12 Usage counts

When enabled, we count how often suggestions in Next step are shown, selected or postponed, and which actions are taken in Prepare contact. The same counting system supports thumbs up, thumbs down and fixed reasons for feedback on call scripts and follow-up drafts when those features are enabled. Enabling Next step does not enable those AI text features or the Sigrid chat.

We store the workspace ID, UTC day, feature, event and count. No user ID, event time, message content or free text is stored in these counts. Counts for a workspace with one user, or a day when only one person used the feature, may nevertheless relate to that person. They are not anonymous data.

Covision is the controller. Our legitimate interest under Article 6(1)(f) is to improve the service by learning which suggestions are used. Product decisions use totals across at least five external workspaces. Counts for individual workspaces are used only for verification, troubleshooting and handling objections. They are not disclosed to your employer or included in customer exports, and are not combined with logs or conversations to identify who did what. Section 5 explains deletion.

Your right to object to usage counts. Write to personvern@advitics.no and identify your workspace. We stop counting for the entire workspace and delete its counts. The stop remains until the workspace is deprovisioned. You can continue to use the features. There is no switch in account settings; an operator handles the request. The evidence of handling is kept for three years (§5). Your rights and our response time are set out in §11.

4. Purposes and legal bases

5. How long we keep data

Sending records. For CRM sends, the sending classification, evidence ID and template references have no separate time-based deletion deadline. They are deleted with the associated task or when the mailbox is fully removed; the rest is deleted when the workspace is wound up. For sequence sends, a monthly job reviews the sending records. It marks records older than 24 months as pseudonymised and removes the pre-send assessment, but retains the classification and evidence ID. Records that have been through this step are deleted when they are older than 36 months. The periods run from the scheduled send time.

When the agreement ends, business data is deleted from production when the 30-day export window has expired and any handover has been completed (the terms § 9.3). Remaining copies in backups are isolated from ordinary processing and deleted when the full backups they reside in have been rotated out: from the main copy after about 90 days, and from the copy outside the production site at the latest within 12 months. If a backup is restored, the environment is kept barred from ordinary processing until documented deletions made after the point in time of the copy have been applied again. Accounting records are retained for as long as the Bookkeeping Act requires.

Email. A thread is CRM-bound when it is linked to the CRM, or when a message in it was sent from the CRM or from a campaign. That a sender is automatically recognised as a contact in the CRM does not make the thread CRM-bound. If a thread is CRM-bound only because messages in it were sent from the CRM or from a campaign, the metadata for those messages, but not the content, is kept for as long as the thread has at least one message younger than 24 months. Email a user logs manually on a record in the CRM is CRM-bound, and the 24-month period runs from when it was logged. This also applies to the text the user enters.

If the mailbox is disconnected, threads that are not CRM-bound are deleted. For CRM-bound threads only metadata is kept, for example sender, recipients, subject and time, not the content, and they follow the periods in the table. Text a user has entered when logging email manually follows the period for manually logged email. The same happens when we detect that access has been withdrawn at Google, and for the personal mailboxes of a user whose sign-in is deactivated. Moving mail to the trash or deleting it in Gmail does not delete the data we hold; it follows the periods in the table.

Deletion happens in the background. The periods are checked every hour, and deletion normally happens within an hour after the period has expired. A queue or an error can cause a longer delay, also on disconnection. Copies in the backups are deleted when the backups are rotated out: from the main copy after about 90 days, and from the copy outside the production site at the latest within 12 months.

6. Google user data and Limited Use

This section covers data Advitics receives through Google's APIs.

Advitics' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Concretely, this means we:

• use Google data only to provide the features you switched on — sign-in (including the request for access when you sign in without an invitation, see §3.9), sending mail from your mailbox, showing and managing the mailbox in Advitics, linking mail to the CRM, detecting failed delivery, and measuring template use and replies as described in §3.11
• do not transfer Google data to third parties, except as necessary to provide the feature, to comply with applicable law, or as part of a merger or acquisition where you are notified
• do not use Google data for advertising of any kind
• do not sell Google data
• do not use Google data to train generalised AI or language models
• do not allow humans to read your mail, except where you expressly request it for specific messages, where it is necessary for security purposes or to debug, where required by law, or on data that is aggregated and anonymised. A support session, where we help you inside Advitics, gives no access to read mail

You can withdraw access at any time — in Advitics under mailbox settings, or at myaccount.google.com/permissions. If you withdraw access, retrieval stops, and mail already retrieved is deleted under the rules for disconnection in §5.

7. Artificial intelligence

Advitics uses language models to find which website belongs to a business, to assess whether a business's website shows that it may be a relevant buyer for the customer, and to propose an ideal customer profile based on the customer's own website. The AI assistant Sigrid answers questions and proposes actions in the workspace (§3.6).

The service is classified as a limited-risk system under the EU AI Act (Regulation (EU) 2024/1689) and is subject to the transparency requirements in Article 50. The AI assistant Sigrid is marked as AI where you converse with it. Content the AI functions produce may contain errors, and the customer shall check it before it is relied on for critical decisions (the terms § 12.3).

We do not make automated decisions producing legal effects or similarly significant effects for individuals. The AI agents propose; humans at the customer decide. GDPR Article 22 therefore does not apply.

We do not train models on your data. Neither we nor our language model providers use the content of your conversations, mail or integrations to train foundation models. We may use aggregated, anonymised statistics to improve the service.

8. Who we share data with

We never sell personal data, and we do not rent it out for marketing purposes.

We share data with subcontractors who process personal data on our behalf, under a data processing agreement pursuant to GDPR Article 28. The list applies as of 6 October 2026.

Covision itself runs the application and the database, on its own equipment in Norway, without a subcontractor and without transfer. The exceptions are error and performance monitoring (Sentry) and the key that encrypts the access tokens for mailboxes the customer connects (Cloud KMS), see the table. The backups are encrypted before they leave the production environment and are held on equipment at Covision's disposal in Norway.

The Customer Data column shows whether the provider processes the customer's personal data under the data processing agreement. Only the rows marked "Yes" form part of Annex 3 to the data processing agreement.

The subcontractors are:

Subcontractors that have been decided on but are not yet in use for customer data: Hetzner Online GmbH (object storage for files the customer uploads, in Helsinki in Finland with Frankfurt as fallback, both within the EEA, and servers for running the service, which are to be located within the EEA), Backblaze, Inc. (storage of backups, which is to take place in the EU; the copies are encrypted before they leave the production environment), and Anthropic PBC (the Claude language model). Before any of them is put into use, active customers are notified at least 30 days in advance.

We also share data when you yourself ask us to connect an integration, and when the law requires us to. Where an authority orders disclosure, we notify you if we are permitted to.

Changes to the list are notified to active customers in writing to the registered contact address at least 30 days before a new subcontractor is put into use for customer data. Updating this page is in addition to that, and is not by itself such notice. You may object to a new subcontractor within 30 days on legitimate data protection grounds; if the objection is sent in time, the provider is not put into use before it has been resolved. Objections are sent to personvern@advitics.no.

The customer's own integrations, Tripletex and Fiken, are not our subcontractors. The customer chooses them itself and is the controller for them.

9. Transfers outside the EEA

Processing takes place primarily in Norway and the EEA. For Cloudflare, Google, Microsoft, Sentry, MailerSend and Vercel, personal data may be transferred to the USA. The basis is:

1. The EU-U.S. Data Privacy Framework (DPF) where the provider is certified.
2. Standard contractual clauses (SCC) under Commission Implementing Decision (EU) 2021/914, as a fallback.

If a transfer rests solely on standard contractual clauses, we first assess whether the law and practice in the recipient country prevent the recipient from complying with them. Today none of the transfers in §8 rests solely on standard contractual clauses: they rest on the DPF, with standard contractual clauses as a fallback. You can obtain a copy of the standard contractual clauses that apply to a particular provider by writing to personvern@advitics.no.

If a transfer basis ceases to apply without another valid basis already having been bindingly concluded, we suspend the affected transfer until a new basis is established. Active customers are notified without undue delay, and at the latest within 30 days.

10. Security

• All traffic is encrypted with TLS. Protocol versions older than TLS 1.2 are rejected.
• The production database is on Covision's own equipment in Norway, and the backups are on equipment at Covision's disposal in Norway. The database resides on an encrypted disk volume (LUKS). The backups are encrypted before they leave the production environment.
• Customer separation: each customer has a logically isolated area with its own roles and its own audit log. The data resides in customer-specific schemas, and the correct schema is selected on the server after sign-in and a check of active membership for each request. The user interface and the API reach the customer-specific schemas through a database role that is not a superuser and that cannot bypass the database's access rules. For technical reasons, some data resides in tables shared between the customers, in a separate platform database: user accounts and memberships, conversations and memory in the AI functions, the workspace's audit log and enquiries about the service. The enquiries go through dedicated database roles that are not superusers, and there the database enforces the boundary between customers. The API reads and writes conversations and memory through a restricted database role that also cannot bypass the database's customer boundary. For the user accounts, memberships and the audit log the service filters on the customer in every query, and the boundary there is enforced by the service, not by the database.
• Sign-in uses a Google account or a Microsoft account, and privileged actions additionally require fresh confirmation with a passkey (WebAuthn). The sign-in surface is protected by access control in Cloudflare.
• Backups are taken continuously and stored on separate hardware, with a copy away from the production site. Restoration is tested automatically every month from an empty disk, not merely assumed to work.
• Monitoring with tracing, metrics and error reporting.
• Security updates and secret rotation follow documented procedures.

In the event of a personal data breach

• Where we are the controller, the Norwegian Data Protection Authority (Datatilsynet) is notified without undue delay and, where feasible, within 72 hours, where the breach is likely to result in a risk to the rights and freedoms of natural persons, cf. GDPR Art. 33.
• Affected individuals are notified without undue delay where the breach is likely to result in a high risk, cf. GDPR Art. 34.
• Where we are the processor, we notify the customer without undue delay under § 10 of the data processing agreement, so that the customer can meet its own 72-hour deadline.

11. Your rights

Response time: within one month. If the request is complex, the deadline may be extended by up to two months — you will be told within the first month.

Cost: free. For manifestly unfounded or excessive requests we may charge a reasonable fee or refuse, cf. GDPR Art. 12(5).

Identification: we may ask for reasonable proof of who you are before disclosing data.

The right to object

You can object at any time to processing based on our legitimate interest, GDPR Art. 6(1)(f). This applies, among other things, to the mapping of businesses (§3.5), requests for access (§3.9) and technical logs and security logs (§3.8). State grounds relating to your particular situation. We will then stop the processing, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

If you object to data about you being used for marketing, you do not need to give reasons, and we will stop that use. The mapping of businesses is meant to help our customers find and contact new business customers, so an objection to it needs no reasons. If you are mentioned on a company's website, you can object yourself, without going through the company.

Write to personvern@advitics.no.

12. Complaint to the Norwegian Data Protection Authority

If you believe we process your personal data in breach of the rules, you may lodge a complaint with the Norwegian Data Protection Authority:

Datatilsynet

Postboks 458 Sentrum, 0105 Oslo

postkasse@datatilsynet.no

datatilsynet.no

We would appreciate it if you contacted us first at personvern@advitics.no, so we get the chance to put things right.

13. Cookies

We do not use Google Analytics, Meta pixels, session replay tools, or third-party advertising trackers.

14. Changes to this notice

Material changes are notified to active customers by email at least 30 days before they take effect. Minor changes — typos and clarifications without material content — may be published without notice. The date at the top shows when the notice was last changed.

15. Contact

Privacy enquiries: personvern@advitics.no

General contact: info@advitics.com

The crawler and opting websites out: bots@advitics.no

Covision Technology AS, company no. 991 248 560, Hamar, Norway.