Privacy Policy

This policy explains how NorwegianSpark SA (“we”), Org. no. 834 984 172, processes personal data when you use BrainLoop. We are the data controller. For any privacy question, contact thomaslien@norwegianspark.com.

What we collect

• Account data — email and authentication identifiers when you sign up.
• Billing data — subscription status and a customer ID. Card details are handled by Stripe; we never see or store them.
• App content — the habits, notes, journal entries, goals, and scores you create. These are saved in your browser on this device only; we do not upload them to our servers, with or without an account.
• AI requests — when you use an AI feature (Oracle, Financial Advisor, Flashcards, Journal prompts, Tarot), the text you enter is sent to our AI provider to generate the answer. For each AI answer we also keep a usage record: the app, the AI model, token counts and cost, linked to your account ID — or, if you are not signed in, to your IP address. We use these records to enforce the daily limits and our spending cap. We do not store your questions or the AI’s answers.
• Analytics — only if you consent: the pages you view, clicks in the apps, and basic device and browser information, linked to a random PostHog identifier kept in a cookie and in your browser’s local storage. PostHog also receives your IP address with each request.

Why we use it (legal basis)

• Contract — to provide the apps and your subscription.
• Consent — for analytics and any marketing email (double opt-in, per Norwegian markedsføringsloven §15).
• Legal obligation — to keep billing records as required by Norwegian bookkeeping law.

Processors we rely on

We share data only with the providers needed to run the service:

• Supabase — authentication and database hosting (EU region).
• Stripe — payments and subscriptions.
• Cloudflare — hosting and content delivery.
• Anthropic (Anthropic PBC, United States) — the AI model that answers the AI features.
• PostHog (PostHog Inc., United States) and Resend — consent-gated analytics and transactional email, where enabled.
• Google (AdSense) — ads on the blog and public pages. Google uses cookies to serve and measure ads and asks for consent first in the EEA, UK and Switzerland. See how Google uses data from sites that use its services.

Where your data lives

We host in the EU/EEA wherever possible to keep data within European data-protection law. There are two exceptions. Analytics: if you consent, usage data is sent to PostHog Inc. and processed in the United States. PostHog states in its Data Processing Agreement that it participates in the EU-U.S. Data Privacy Framework, the UK Extension to it and the Swiss-U.S. Data Privacy Framework, and the agreement also incorporates the EU Standard Contractual Clauses. AI features: the text you enter in an AI feature is processed by Anthropic PBC in the United States. Anthropic states in its Data Processing Addendum, which forms part of its Commercial Terms, that the EU Standard Contractual Clauses, with the UK and Swiss addenda, apply to these transfers.

Retention

We keep account and content data while your account is active. Billing records are retained for 5 years (Norwegian bokføringsloven §13). Consent records are retained for up to 3 years after account closure, with personal identifiers hashed. AI usage records currently have no automatic deletion date; you can ask us to delete yours at any time through the data-rights page.

Your rights

Under the GDPR you can request access, correction, deletion, portability, or restriction of your data, and you can withdraw consent at any time. Use our data-rights page or email us. We respond within 30 days (GDPR Art. 12(3)). You may also complain to the Norwegian Data Protection Authority (Datatilsynet).

Changes

We’ll post any material changes here and update the date above.