Privacy Policy

1. Who is responsible

Haralt AS, org. no. 932 530 163, is the controller of the personal data described here. If you have questions or want to exercise your rights, write to hei@haralt.co or in the chat.

2. What data we process

• Account: name, email, phone number if you have given it, language, notification choices and whether you want our newsletter. If you sign in with Google or Apple, we get your name and email address from them. Your password is stored only as a cryptographic hash with Supabase.
• Requests and delivery orders: what you ask for, postcode, delivery day and time window, return day and whether we collect or you return the things yourself, name, email, mobile number, delivery address and notes to the driver. We turn the address into coordinates to plan the driving route.
• Payment: amounts, what they are for, payment references, refunds and charges for late returns. Your card is handled by Stripe – we only store the card brand and the last four digits, never the card number.
• Locker rentals: which item and which locker, when the rental started and ended, what it cost, campaigns and credits you used, and ratings and fault reports you send us.
• Photos: the driver may take photos of the things when we deliver and collect them, and of any damage. The photos show the things, but may include the surroundings, such as a door or a hallway.
• Chat: the messages you send and we reply with, and which page or order the chat was opened from. If you write without being signed in, we store the name and email address you give.
• Discount codes: the code, the email address it was used with and the order it applied to.
• Other forms: what you write in the contact form, in back-in-stock alerts, and in the forms for wishes and new locker locations (Typeform).
• Push notifications: the notification address (push token) of your phone, if you have turned on notifications in the app.
• Location: the app and the website may ask for your location to show the nearest locker. Your location is only used on your device and is not sent to us.
• Use of the website and the app: see sections 7 and 8.

3. What we use the data for, and our legal basis

• Providing the service – making offers, taking payment, delivering and collecting, unlocking lockers, sending confirmations, reminders, receipts and push notifications, and replying to you in the chat. The legal basis is our contract with you (GDPR Article 6(1)(b)).
• Documenting the condition of the things with photos, and charging for late returns, damage and loss. The legal basis is our legitimate interest in being able to show what happened and in having losses covered (Article 6(1)(f)).
• Accounting – receipts, payments and refunds must be kept under the Norwegian Bookkeeping Act. The legal basis is a legal obligation (Article 6(1)(c)).
• Operations and security – internal alerts about new requests and payments, limiting attempts to stop abuse, troubleshooting, and recording events from our own servers (for example that a rental started). The legal basis is our legitimate interest in a safe, working service (Article 6(1)(f)).
• Discount codes – checking that a code is used only once per email address. The legal basis is the contract (Article 6(1)(b)) and our legitimate interest in preventing abuse (Article 6(1)(f)).
• Analytics and marketing on the website – only if you have consented (Article 6(1)(a)), see section 7.
• Usage statistics in the app – to improve the app. The legal basis is our legitimate interest (Article 6(1)(f)).
• Newsletters and offers by email – only if you have said yes (Article 6(1)(a)). You can unsubscribe at any time.

4. Who we share the data with

We never sell personal data. We use these providers (data processors), who may only process the data on our behalf and on our instructions:

• Supabase – database, sign-in and photo storage. Hosted in the EU (Ireland).
• Vercel – hosting of the website and API, and anonymous measurement of page views and speed (Vercel Web Analytics and Speed Insights, without cookies).
• Stripe – card payments and saved cards.
• Resend – the emails we send you (confirmations, offers, reminders, receipts and chat replies).
• Slack – internal operational alerts to us, for example about a new request with email address and postcode.
• Expo – delivers push notifications to the app.
• PostHog – analytics on the website (with consent) and in the app. Hosted in the EU.
• Google – Google Tag Manager and Google Analytics (only with consent), and sign-in with Google.
• Meta – Meta Pixel (only with marketing consent).
• Apple – sign-in with Apple.
• Typeform – the forms for wishes and new locker locations.

The address search on the order page sends what you type to the Norwegian Mapping Authority's (Kartverket) open address API. The maps load map images from OpenFreeMap. Neither of them learns who you are.

Our drivers see your name, phone number, address and notes to the driver for the orders they deliver or collect. We may also disclose data when the law requires it.

5. Transfers outside the EU/EEA

Our database and our PostHog analytics are hosted in the EU. Several of the providers above (including Vercel, Stripe, Resend, Slack, Expo, Google, Meta and Apple) are American or may process data in the United States. Such transfers are based on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

6. How long we keep the data

• Your account: for as long as you have it. If you delete your account, we delete your profile, sign-in, saved cards, push address and chat straight away. How to delete your account.
• Orders, rentals and payments: for as long as the Bookkeeping Act requires (five years), and never longer than 60 months. If you delete your account, they are kept without your name and without a link to you.
• Name, phone number, address and notes on a delivery order: until the order is completed and for 12 months after, so we can answer questions and complaints. After that they are removed, and only the accounting records remain.
• Requests that don't become an order: 12 months.
• Photos at delivery, collection and of damage: 12 months after the order is completed – longer only if we need them in an unresolved case about damage or loss.
• Chat: conversations on your account are deleted with the account. Conversations started without an account are deleted automatically after 12 months without activity, or earlier if you ask.
• Internal operational alerts in Slack and email: 12 months.
• Analytics: as long as the provider's settings say, and at most 14 months.
• Your consent choice (the `haralt_consent` cookie): one year.
• Limiting attempts: a hash of your IP address, deleted after one day.

7. Cookies and analytics on the website

The first time you visit, we ask what you accept and store your choice in a cookie named `haralt_consent` for one year. Nothing in the Analytics or Marketing categories runs until you accept it. You can change or withdraw your choice at any time using Cookie settings in the footer – withdrawing is as easy as consenting, and takes effect immediately.

Strictly necessary cookies keep you signed in, remember your consent choice and keep you in a chat you started without an account. They can't be switched off, and we don't ask permission for them. Vercel Web Analytics and Speed Insights count page views and measure speed without cookies and without recognising you.

Analytics (Google Analytics, PostHog) tells us how the site is used so we can improve it: which pages are visited, where people click, and where they get stuck. With your consent, PostHog also records a replay of your visit – a reconstruction of the pages you saw and where you moved and clicked. Anything you type is masked and never recorded, card details are entered in a secure frame we can't see into, and we don't record staff pages where other customers' details are on screen. Decline, and nothing is recorded and no identifier is stored on your device.

Marketing (Meta Pixel) measures whether our ads led to a rental, and personalises the ads you are shown.

We also record events from our own servers – for example that a rental started or a locker opened – so that we can operate and support the service. These are records of the service doing its job rather than of your browsing, and we keep them regardless of the choice above.

8. Usage statistics in the app

The app sends usage data to PostHog (EU): which screens are shown, and when the app is opened and closed, together with a random identifier for the device – and your account when you are signed in. We don't record what you type or tap. If you don't want your use recorded, you can object by writing to us.

9. Your rights

You have the right to:

• know what data we hold about you, and get a copy
• have incorrect data corrected
• have your data deleted – you can delete your account yourself
• have processing restricted, and object to processing based on legitimate interest
• receive the data you have given us in a machine-readable format (data portability)
• withdraw consent at any time, without affecting processing before you withdrew it

Write to hei@haralt.co. We reply without undue delay and within one month at the latest. Data we have to keep under the Bookkeeping Act can't be deleted before the period ends.

If you believe we process your data in breach of the rules, you can complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no). We'd appreciate it if you told us first.

10. Children

The service is for people over 18. We don't knowingly collect data about children under 18. If we learn that we have, we delete it.

11. Security

We protect the data with access control, encrypted transfer and limited staff access: only those who need the data for their work can see it. Photos are kept in private storage and only shown through links that expire after a short time. No transfer over the internet is completely secure, but we do what we can.

If a personal data breach occurs, we report it to Datatilsynet when the law requires it, and tell you if the breach could have serious consequences for you.

12. Changes

We update this policy when the service changes. The date at the top shows when it was last changed. If we make significant changes, we let you know by email or in the app.

13. Contact

Haralt AS, org. no. 932 530 163. Email: hei@haralt.co. You can also write to us in the chat on the website and in the app.