Privacy policy for rhaugan.no

This policy covers the website rhaugan.no. Privacy for our apps is described on each app’s own page.

Data controller

Rhaugan AS, org. no. 930 871 540, Trøbakken 29E, 7540 Klæbu, Norway. Email: post@rhaugan.no.

No cookies and no tracking

The website sets no cookies and uses no analytics, and your browser loads no content from other services. The App Store figures on the DMX Dip Calculator page are fetched from Apple by our own server, and that request contains nothing about you.

Server logs

The website is hosted by Vercel Inc. When you visit, Vercel records technical details such as your IP address, browser type, time and the page you requested. These details are used only to deliver the site and protect it from abuse, and are deleted automatically within 24 hours, which is the runtime log retention on our Vercel plan. The legal basis is our legitimate interest in running a secure website (GDPR Art. 6(1)(f)). Vercel processes the data as our data processor. Transfers outside the EEA rely on the EU Standard Contractual Clauses.

Emailing us

If you email support@rhaugan.no or post@rhaugan.no, your message is stored in our email service, Microsoft 365. We use it only to reply and follow up, and delete it once the matter is closed and we no longer need it. The legal basis is our legitimate interest in answering enquiries (GDPR Art. 6(1)(f)).

When you shop with us

If you buy something in the shop, we process your name, email address, phone number, delivery address and what you bought. We need these to deliver the goods, send the order confirmation and handle withdrawals and complaints. The legal basis is our contract with you (GDPR Art. 6(1)(b)) and our bookkeeping obligation (Art. 6(1)(c)).

• Payment: Stripe (Stripe Payments Europe Ltd., Ireland) takes the payment on its own page. We never see your card number. Stripe is an independent controller for payment data and sets its own cookies on its payment page. Stripe receives your email address, and your name, address and phone number when goods are shipped, to assess the risk of the payment.
• Klarna: if you choose to pay with Klarna, Stripe passes your details on to Klarna Bank AB (Sweden), which is an independent controller for credit checks and invoicing.
• Storage: the order is stored in our database at Supabase, in the EU (Stockholm).
• Email: order confirmations and updates are sent through Resend, from the EU.
• Accounting: the receipt and any credit notes, with your name, address and what you bought, are booked in our accounting system Fiken (Fiken AS, Norway), which is our processor. The legal basis is our bookkeeping obligation (GDPR Art. 6(1)(c)). The records are kept as long as the Bookkeeping Act requires, even if you ask us to erase your data otherwise.
• Shipping: when we ship with Bring, Bring receives your name, address and phone number to deliver the parcel.
• How long: details that are part of our accounts are kept for five years after the end of the financial year, as the Norwegian Bookkeeping Act requires, and then deleted. Your contact details and address are stored with the order when you go to payment. Orders that are never paid are deleted, with those details, after 30 days.
• Discount codes and gift cards: gift cards are stored without a name; we keep only the amount, the balance and a cryptographic hash of the code, and which order it was bought or used in. To prevent guessing we count code lookups per IP address, and to stop anyone holding all the stock we also count how many payments are started; the address is stored only as a hash and deleted after a day.

If you ask for a 3D printing quote, we also store the files you upload and what you write to us, at Supabase in the EU. The files are used only for the quote and the print, and are deleted 90 days after the case is closed. Quotes that never become an order are deleted after twelve months. Uploads that never become a quote are deleted after a day. To prevent abuse we count uploads per IP address; the address is stored only as a cryptographic hash and deleted after a day.

The AI designer and your account

To use the AI designer you sign in with your email address and a one-time code. We store the email address, your designs and the conversation with the AI, so you can carry on where you left off and order a print. The legal basis is our contract with you (GDPR Art. 6(1)(b)).

• What you write to the AI designer, and the design so far, is sent through Vercel AI Gateway to Anthropic, which builds the model. Do not put personal data in your requests. Anthropic and Vercel are our processors, and the data is not used to train AI models. Transfers outside the EEA rely on the EU Standard Contractual Clauses.
• We keep a ledger of AI use per account (tokens and cost) to hold the budget of 100 kr per month.
• You can delete the account yourself under «My account». That deletes your designs, conversations and usage ledger. Accounts unused for 24 months are deleted automatically.
• Signing in sets cookies that keep you signed in. They are set only when you sign in, and are necessary for the service.

Your cart is stored only in your browser (localStorage), not by us, and is used only to remember what you added. Your order page opens with a secret link included in the order confirmation.

Your rights

You have the right to access the data we hold about you, and to ask us to correct or delete it. You can also object to the processing. Write to post@rhaugan.no. If you believe we are handling data unlawfully, you can complain to the Norwegian Data Protection Authority, Datatilsynet.

Changes

We update this policy when needed. The date at the top shows when it last changed.