How we process personal data

The data controller is AI Solutions AS, Norwegian organization no. NO 922 348 057 MVA, registered in the Norwegian Register of Business Enterprises and the VAT Register, Mauds vei 102, 4633 Kristiansand S.

Send questions about privacy or general questions about the service to support@sannor.no.

We never sell your information. We do not use your content to train models.

We are the data controller for your account, payment, audit log, and our website. We act as the data processor for data in your workspace, including competitor and inspiration data you ask us to collect.

If you are a customer, you are yourself the data controller for personal data entering your workspace, for example name in comments from channels you connect to. We process them according to your instructions. The data processing agreement is Annex A to the terms.

Platform learning is an exception. We are the data controller for it only when you have turned on the switch yourself contributes_to_platform_learning. It is off by default.

Account. Name, email address, a hash of the password, IP address, and logs from the use of the service. The password is never stored in plain text.

Workspace. Data from websites you ask us to read, brand profiles, content and images we create for you, encrypted access to your social media accounts and Google Search Console, and incoming comments with the sender's name or username as provided by the platform.

Payment. Payment is handled by Stripe. We see name, organization number, address, card brand, and the last four digits. We do not store your card number.

Email address you must give us. Without it, we cannot create the account, log you in, or confirm that the address is yours.

Organization number we need for the invoice. If you do not provide it upon payment, you will receive the invoice without the number.

The rest is up to you: the website address we are to read, the material you upload, and the channels you connect to. If you give us less, you get less out of the service, but the account works.

We rely on legitimate interest only for security, abuse prevention, and logging, and only in our role as the data controller. You may object to this processing; see section 11.

We do not use your content for product improvement. We do not train models on it, and we do not sell it.

We make no automated decisions that have legal effect or a similarly significant impact on you. Therefore, Article 22 of the GDPR does not apply to us.

The profiling that occurs is limited to this: incoming comments in the channels you connect are classified for purchase intent and sentiment. This sorting helps you see what may be worth responding to. A person decides what happens next.

Your content is sent to the provider only to generate the response. We use paid API access where the provider does not train on data. They may store it briefly—typically up to 30 days—to detect abuse and delete it thereafter. We request OpenAI not to store responses at all.

The providers are listed in the table in section 8. Images from Google Gemini run on a paid level — Google's terms require it for services offered in the EEA, and on a paid level Google uses neither requests nor responses to improve its own products. Storage windows are the providers' own, checked against their terms as of September 4, 2026: Anthropic deletes content within 30 days. OpenAI may retain content for up to 30 days for abuse monitoring; we request that no response be stored as a conversation history, but zero retention requires separate approval from OpenAI which we do not yet have. Google stores requests "for a limited period" to detect abuse. Recraft does not store images or metadata beyond the delivery itself.

We send only what is needed to generate the response. Your card details are entered at Stripe on their own payment page. We do not store them; see section 3. For the payment itself, fraud control and anti-money laundering checks, Stripe determines purpose and means itself and acts as the data controller; for everything else, Stripe is our data processor.

List last updated: 2026-10-18.

The figures from Google Search Console also go to the AI providers in the table when we generate topic suggestions. What we send is described in section 15.

Services you connect yourself to. If you connect to a channel, we send content there upon your instruction and retrieve comments and metrics back. The channel has its own terms and is itself the data controller for what happens on the platform. We store access keys encrypted.

• Meta (Facebook and Instagram)
• LinkedIn
• X
• Pinterest
• Bluesky
• Google Search Console

Public profiles before connection. Where the platform API permits access, Sannor can read a limited sample of public posts from Facebook Pages and professional Instagram profiles linked from your website. We use our own read authorization before you connect an account, and prefer your connection when it provides access to the same profile.

Text and images are analyzed for writing and visual style. Profile identity, post links, short caption excerpts, image references and derived style observations may be retained in your brand analysis. Selected text and images may be sent to the AI providers in section 7 for this analysis. This grants neither publishing access nor permission to reuse images as content assets. We do not train models on this content.

Marketing data without personal data. We retrieve public data from met.no, Norges Bank, and Yahoo Finance. No personal data is sent to them.

If you wish to see the transfer basis for a provider, for example the EU's standard privacy clauses (SCC), write to support@sannor.no, and we will send what we have.

Changes to the list are published here. Significant changes we notify you by email. If we adopt a new subprocessor or replace one, we notify customers by email at least 30 days in advance, and you may object. This is described in Annex A section (d).

The measures in their entirety are described in Annex B of the terms. The most important are:

• All traffic between you and the service goes over TLS.
• Access keys to social media accounts and Google Search Console are stored encrypted with AES-256-GCM.
• The database separates workspaces from each other with row-level security. Isolation is enforced by the database, not by application code alone.
• Operational tasks across workspaces use a separate database connection, distinct from the usual one.
• Our customer support access can open your workspace for 30 minutes to help you. It can read everything in the workspace but can never publish, disconnect your accounts, or delete anything permanently.
• The audit log records that customer support access was granted and ended, and administrator actions such as creating, deleting, or moving a workspace. It is not a log of every single entry in your data.
• In the pilot phase we take backups manually and store them within the EEA. An automatic arrangement with our own provider has not yet been set up. When it is, we will update sections 8 and 10 with provider, region, and deletion deadline.

We have not done this: we are not certified under ISO 27001 or SOC 2, and we have not conducted external penetration testing. We write this here if it changes.

We retain information as long as we need it for the purpose, and no longer. If you request deletion, section 14 applies.

AI providers have their own, short windows. They are described in section 7.

These rights apply to information we are the data controller for: your account, payment, audit log, and our website. If the question concerns information within a workspace, the customer who owns the workspace is the data controller, and the request is decided by them. See Section 12.

You may demand this from us:

• Access to the information we have about you.
• Correction of what is incorrect.
• Deletion; see section 14.
• Restriction of processing.
• Data portability: upon request, you receive your data in a machine-readable format within 30 days.
• Objection to processing we carry out on the basis of legitimate interest.
• Withdrawal of consent you have given, at any time. It does not affect what we have already done on the basis of it.

Send the request to support@sannor.no. We respond within one month, as the law requires. If the request is extensive, we inform you and explain why it takes longer.

If you disagree with how we process your information, you may complain to the Norwegian Data Protection Authority: www.datatilsynet.no. We would like to hear from you first, but you do not need to go through us.

If you are not a customer with us but have commented on a page or post owned by one of our customers, your name or username and the comment may lie in Sannor. We retrieve them from the platform upon the customer's instruction.

In that case the customer is the data controller, and we are the data processor. Your request for access or deletion belongs to them. Contact the customer directly if you know who it is.

If you do not know who the customer is, write to support@sannor.no. We do not respond on the customer's behalf, but we forward the request without undue delay and help the customer respond.

Sannor uses four cookies. All are necessary for the service to function or remember a choice you have made yourself in the interface. We have no tracking, no third-party analysis, and no advertising cookies.

We therefore have no consent banner. The rules are set out in the Electronic Communications Act (LOV-2024-12-13-76), Section 3-15. You can delete the cookies in your browser whenever you wish, but doing so logs you out.

Request deletion by writing to support@sannor.no from the address registered to the account. State which workspace it concerns and whether you want to delete the entire workspace or only your account.

Information is deleted from the active system within 30 days, and from backups within an additional 30 days. In the pilot phase deletion from backups is a manual routine. We retain only what the law requires, for example invoices for five years after the end of the fiscal year.

Your account. If you request us to delete your account, we delete it, or we anonymize it so that it can no longer be linked to you: the email address is replaced, the name is removed, and the password is gone. What remains is an anonymized trace in the audit log, so that the overview of who has had customer support access remains complete.

Facebook and Instagram. If you disconnect the channel from Sannor, we delete everything we have retrieved from the platform at once: comments, posts, and metrics. You can also remove our access in the settings on Facebook or Instagram. If you wish us to delete the data without disconnecting, write to us, and we will do so.

Public profile observations. You may also request deletion of information retrieved before an account was connected. Write to support@sannor.no with the profile link and, where applicable, the workspace. You do not need to connect the profile to make this request.

If we delete the entire workspace, what we have stored in the vector store for search also disappears. Content you wish to keep must be downloaded first.

We also delete on our own side when the storage durations in section 10 expire.

If you connect to Google Search Console, we retrieve figures on how your pages perform in Google search: impressions, clicks, and average position. We use them only to show you the results and to suggest what you should write about.

When we suggest what you should write about, we send search terms from Search Console, average position, number of views, and number of clicks to the AI providers in Section 8. They are used only to generate the suggestion there and then. They are never used to train models.

Sannor's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

In plain language: Sannor's use and transfer of information we receive from Google APIs to other apps comply with the Google API Services User Data Policy, including the Limited Use requirements. You can find the policy here: https://developers.google.com/terms/api-services-user-data-policy.

Our customer support access can read Search Console data in your workspace when we help you. The access lasts 30 minutes and is logged, and it can never publish.

We do not use Google data for advertising; we do not sell it, and we do not train models on it. If you disconnect, we stop retrieving it, and the access key is deleted.

As a data processor, we notify you without undue delay. As the controller for personal data for which we are responsible, we notify the Norwegian Data Protection Authority within 72 hours.

The notification to you says what happened, which types of information and how many are affected as far as we know, likely consequences, and what we do about it.

If the question concerns information in your workspace, you are the data controller. In that case, it is you who assess whether notification under GDPR Article 34 is required, and who provides such notification. We do not notify them ourselves, but we provide what we know and assist you in doing so.

The 72-hour deadline for the Norwegian Data Protection Authority applies to information we are the data controller for: account, payment, audit log, and our website.

Sannor is a service for businesses. We do not target children, and we do not create accounts for them. Comments from minors may still appear in channels a customer connects to. The customer is the data controller for them, and we process them only as a data processor. See section 12 if you wish to have something removed.

This declaration is dated at the top of the page. Changes are published here.

If the change is significant, we notify you by email before it applies. The same applies to changes in the list of subprocessors in section 8.