Privacy Policy

1. What data we process

• Account information: email address and, if you sign in with Google, your name and Google account ID.
• Trench plans: the content you enter, e.g. project name, address, municipality, company name, names of responsible persons and workers in the trench, signatures and sketches. Plans are stored on your account so you can access them on all devices.
• Subscription and payment: subscription status, invoices, and consent to waiver of cancellation rights. Card details are processed by Stripe and are never stored with us.
• Feedback and enquiries: what you submit via the feedback button or contact form, together with your email address.
• Usage and technical data: which steps of the form are used, PDF downloads, anonymous page statistics and technical logs (e.g. IP address) for operating and securing the service.
• Location: if you choose to use your position to look up an address, your coordinates are sent to OpenStreetMap for the lookup. They are not stored with us.
• Teams: which team you belong to, your role (owner, admin or user) and when you were added. If a team owner invites you, we receive your email address from the team owner, and we store who invited you.
• Access code: if you open a link with an access code (beta offer), the code is stored in a cookie in your browser so that the offer is still shown when you return to the subscription page. The cookie contains only the access code, and is deleted when the code has been used, or after 30 days. The choices you make on the subscription page (number of users and consent) are stored temporarily in your browser for up to one hour, so that the purchase can continue after you log in.
• Text memory: values you have typed into fields in your plans – project names, company names, names of people and their roles – are stored on your account so they can be shown as suggestions the next time you fill in a plan. The suggestions are visible only to you, not to others in your team.
• Contact list: name, email address, phone number, role and company for the people you add to your contact list. If you are in a team, the contacts are shared with the team: everyone in the team can see and edit them.

2. Purposes and legal basis

• Providing the service, storing your plans and managing your subscription (contract, GDPR Art. 6(1)(b)).
• Retaining accounting records (legal obligation, Art. 6(1)(c)).
• Operating, securing, fixing and improving the service, including anonymous usage statistics (legitimate interests, Art. 6(1)(f)).

3. Information about other people in your plans

When you enter names or signatures for other people, e.g. workers or responsible persons, your organisation is the data controller for that information, and Grøfteplan.no processes it on your behalf. You must only enter information you are entitled to use. The same applies to names stored as suggestions in the text memory. The same applies to the people you add to the contact list.

4. Team subscriptions

• A team subscription is purchased by an organisation (the team owner). The team owner can invite users by email address. If you don't already have an account, it is created when the invitation is sent, and you receive an email with a link to sign in. If you already have an account, you are added to the team immediately and notified by email.
• Plans you create while you are a member of a team automatically become team plans. They belong to the team, not to you personally. Plans you created before joining the team remain personal.
• Everyone in the team can view and edit team plans, including plans created by others. The team owner and team admins can delete all team plans. You can delete team plans you created yourself for as long as you are a member of the team.
• The team owner can see the email address, role and date added for all users in the team. Other users cannot see this list, but they can see names and information contained in team plans.
• If you are removed from the team, you lose access to all team plans, including those you created yourself. The plans remain with the team. Local copies on your devices are removed the next time you open the app signed in and online. You keep your personal plans.
• If the team is deleted, each team plan becomes a personal plan for the person who created it.
• The organisation that owns the team is the data controller for the content of team plans and for administering the team (who is invited and removed). Moldskred Evo Technology processes this data as a data processor on behalf of the organisation, under the data processing terms in the Terms of Service. Moldskred Evo Technology remains the data controller for your account (email and sign-in), usage data and technical logs. Questions about team plans, or requests for access to or deletion of them, should be directed to the organisation that owns the team. If you contact us, we will forward your request.

5. Who we share data with

We never sell your data. We use the following service providers (data processors):

• Supabase – database and authentication. Data stored in the EU (Ireland).
• Vercel – hosting and anonymous page analytics.
• Stripe – payment processing.
• Vipps MobilePay – payment (where available).
• Resend – sending emails (sign-in links, team invitations, receipts and notices before plans are deleted).
• Google – sign-in, if you choose “Sign in with Google”.
• OpenStreetMap and Kartverket/Geonorge – address lookup.

Some providers are US-based companies. Transfers outside the EU/EEA are safeguarded through EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework.

6. How long we keep your data

• Your account is kept for as long as you have it. Plans are kept while your subscription is active, and after that as described below.
• When your subscription ends, your plans are kept for 12 months from the end date so you can continue where you left off. You will receive an email 30 days before they are deleted. If you renew your subscription, your plans are not deleted.
• Team plans follow the team's subscription: when it ends, team plans are kept for 12 months from the end date and then deleted. An email notice is sent to the team owner 30 days before. Users in the team lose access when the subscription ends.
• If the account has never had a subscription, plans are deleted 12 months after they were last changed, following an email notice 30 days before.
• Plans you delete yourself are permanently deleted after 30 days.
• If you request account deletion, we delete your account and your personal plans within 30 days. Team plans you created belong to the team and remain there: they are transferred to the team owner. If you own a team with other members, the account cannot be deleted until ownership has been transferred or the members have been removed. If you own a team without other members, the team and the team plans you own are deleted together with the account.
• We log each deletion with the date, user ID and number of plans – never the content of the plans. We also keep the IDs of deleted plans so they are not uploaded again from a device. The log and the IDs are kept for 24 months.
• If you have had a free trial, we keep an identifier (a one-way hash of your email address) even after your account is deleted. The identifier is only used to prevent the trial from being used more than once, and your email address cannot be read from it. The identifier is deleted after 24 months.
• Accounting records are kept for 5 years under Norwegian accounting law.
• Feedback is anonymised when your account is deleted.
• Images you attach to feedback are stored privately – only we have access to them – and are deleted automatically after 12 months.
• The text memory is kept for as long as you have the account. You can remove a single suggestion with the cross next to it, and the whole memory is deleted together with the account. A copy is kept in the browser on your device so the suggestions work offline; the copy is removed when you log out.
• Contacts are kept until you or your team delete them. Personal contacts are deleted together with your account; if the team is deleted, the team contacts become personal contacts of the team owner. The names, roles and companies of your contacts are also stored as a copy in the browser on your device, so that suggestions in the plan form work offline; the copy is removed when you sign out. Email addresses and phone numbers are not included in the copy.
• Plans are also stored locally in the browser on your device. If you lose your connection while a plan is open, you can keep working on it. Your changes are saved on the device and uploaded to the cloud the next time the plan is saved while you are online, or when you sign out while online. New pages cannot be opened without a connection. Others who sign in on the same device cannot see your plans. When you sign out, plans that are saved in the cloud are removed from the device. Plans that are not yet saved in the cloud remain hidden until you sign in again, unless you choose to remove them. When a plan is deleted from your account, the local copy is removed the next time you open the app signed in and online.

7. Your rights

You have the right to access, rectification, erasure, restriction and data portability, and to object to processing based on legitimate interests. You can lodge a complaint with the Norwegian Data Protection Authority (datatilsynet.no).

8. Language

This privacy policy is available in several languages. If the language versions differ, the Norwegian text (Nynorsk and Bokmål) prevails.