Terms for use of Sannor

The agreement is between you as the customer and AI Solutions AS, Norwegian organization no. NO 922 348 057 MVA, registered in the Norwegian Register of Business Enterprises and the VAT Register, Mauds vei 102, 4633 Kristiansand S. In these terms, we refer to ourselves as Sannor or we, and to you as the customer or you. You can contact us at support@sannor.no.

Sannor is sold only to business operators. When you order, you confirm that you act as a business operator, and you may provide your organization number (VAT number) in the payment.

If you are nevertheless a consumer, mandatory consumer protections take precedence over these terms. Nothing here waives those rights. We may then terminate the agreement on notice and refund the unused portion of the period you have paid for.

The Terms apply to all who use your workspace. You are responsible for what they do.

Sannor reads your website, builds a brand profile, suggests themes, creates drafts of posts, articles, and images, and publishes to the channels you connect to.

Nothing is published without approval: either you or someone in your workspace approve it, or the automation you have turned on approves it within the boundaries you have set. You are responsible for what goes out in both cases.

We develop the service continuously. Features may be added, changed, or removed. Section 18 applies to material changes that adversely affect you.

Early access is given after invitation and cannot be ordered. See Section 4 for what the discount is.

A workspace covers one brand. The person who creates the workspace is the owner. The owner invites members and assigns a role: owner, administrator, manager, editor, or reader. The role determines what they can do.

You are responsible for who you give access to, and for what they do in the workspace. Keep the login for yourself. If you suspect misuse, tell us at support@sannor.no immediately.

The email address must be confirmed before you can make changes to the workspace. Ownership of a workspace may be transferred to another person. The transfer takes effect only when the new owner has accepted it.

The subscription costs NOK 599 per month excluding VAT (NOK 748.75 incl. VAT), or NOK 5,988 per year excluding VAT, equivalent to NOK 499 per month (NOK 7,485 incl. VAT). VAT at 25 percent is added. Prices are shown excluding VAT because Sannor is sold to businesses.

You can pay by card, including Apple Pay and Google Pay. Vipps and EHF invoicing are not yet available. The sale and the payment are handled by Stripe, which is the seller (merchant of record) and calculates, collects and remits VAT. The purchase appears as "Sold through Link", and your card statement shows LINK.COM*. We do not store your card number.

The subscription renews automatically for a new period of the same length until you tell us to stop. Stripe sends an invoice with VAT automatically after each payment. Your organization number appears on the invoice when you provide it in the payment.

We may change the price. A price change applies earliest from the next renewal, and we notify by email with at least 30 days' notice before it applies. If you do not accept it, you may terminate before the renewal.

Early access costs NOK 499 per month excluding VAT and is available only with monthly billing. The discount is a fixed NOK 100 per month off the current monthly price. If the monthly price changes, the amount you pay changes accordingly.

All prices are listed at the pricing page.

Cancel whenever you like. You keep access through the period you have paid for.

You cancel through the payment portal in the app. Cancellation stops renewal. You do not lose access immediately.

We do not refund a period that has already started. There are three exceptions: we terminate the agreement without you being in breach, we increase the price during a paid period, or we materially change the terms to your disadvantage and you object. In those cases, we refund the unused prepaid portion on a pro rata basis.

After the subscription ends, we retain the data in the workspace for 12 months. During this period you can log in and download your content. Then it is deleted. Read more about deletion of data.

Free setup gives you a website analysis, a brand profile, one monthly content plan, and three example posts. You do not need a card, and you pay nothing.

You can approve and plan the three posts for free. More drafts, adjustments, publishing, scheduled sending, and downloading require a subscription. Posts you have approved and set a time for wait until you subscribe. They do not publish themselves.

Free setup has a limit on how much analysis and research we run per workspace. When the limit is reached, tasks that cost money stop running.

We may terminate free setup, wholly or for your workspace, with 14 days' notice by email. The notice states what happens to your data and how long you can retrieve it.

If the workspace has never had a subscription, we delete it 6 months after it was created. A workspace that has never had a subscription cannot download content. If you have had a subscription, you can, see Section 5.

Ownership. You own the material you upload, and you retain the rights to it. You give us a limited, non-exclusive license to store, process, change format of, and display the material, and to send it to our suppliers, only to deliver the service to you. The license lasts as long as we have the data, and gives us no other rights.

Rights to material. You warrant that you hold the rights to the text, images, logos, names, and trademarks you provide, and that you may allow us to use them as required by the service.

Websites we read. You guarantee that you can allow us to read the websites you specify, both your own and the public pages of competitors and inspiration sources you point to. We follow robots.txt when we read your own website. The pages you point to at others we fetch at a low pace, as a normal web browser would, and only those pages you have specified yourself.

Personal data. You are the controller for personal data that enters the workspace through channels you connect or files you upload, such as names in comments. You must have a lawful basis for the processing and provide the data subjects with the information required by GDPR Articles 13 and 14. We process the data as a processor under Annex A.

Marketing Control Act. You are responsible for ensuring that what you publish complies with the law. The key rules are:

• § 3: marketing must be clearly marked as marketing. This applies also to collaborations, sponsored posts, and content from profiles you pay.
• §§ 6–8: not misleading or unfair trading practices. Sannor checks assertions against documentation you have uploaded, and marks assertions that are not documented. The control is a help, not a substitute for your own assessment.
• § 26: rules for marketing between business operators.
• § 2 third paragraph: advertising where body shape, size or skin is retouched must be marked. This applies especially to beauty, fitness and health.
• Copyright Act § 104: you must have consent to use images where a person can be recognized.

Platform rules. You follow the terms of the channels you connect to, such as Meta, LinkedIn, X, Pinterest and Bluesky. If you breach them, the channel may close your account. This is outside our control.

Approval. Nothing is published without approval: either you or someone in your workspace approve it, or the automation you have turned on approves it within the boundaries you have set. If you turn on the automation, you are responsible for what it lets through.

Indemnity. You hold us harmless from claims by third parties arising from content you have approved or published, material you have given us rights to, or instructions you have given us. This does not apply to claims arising from errors in content Sannor generated that you could not reasonably discover through a reasonable review. The exception applies either if the content was approved by a person or by the automation you have turned on. We notify you of the claim without undue delay, give you the information we have, and let you control the defense. We do not enter a settlement without you saying yes.

Drafts are made by language models and image models. They may contain errors, outdated information, and assertions that do not hold. Read through before you publish.

We do not promise results. No reach, no sales, no placement in search, no visibility.

Sannor makes no claim to rights to content created for you, and transfers to you the rights we may have had to it.

We cannot guarantee that AI-generated content does not infringe others' rights. Models can create text or images that resemble something that already exists. Your review before publishing is the safeguard.

People in AI-generated images are not real people. Do not present them as customers, employees, or references.

The service, the software, the setup behind it, and the brand Sannor belong to us. You get a limited, non-exclusive and non-transferable right to use the service while the agreement runs.

We may use statistics about how the service is used — volumes, time spent, error rates, and which features are used — provided the statistics do not identify you or any other person. We do not use your content, your brand, or anything you generate for this purpose, and we do not train models on it.

Cross-customer sharing of learning is turned off by default. It is turned on only if you choose it, and you can turn it off again.

If you send us suggestions or feedback, we may use them to improve the service without paying for it.

You must not use Sannor to:

• publish illegal content, threats, harassment, hate speech, or content that exploits children;
• publish misleading marketing, fabricated reviews, or fabricated customer stories;
• impersonate another person or publish for a business you are not authorized to represent;
• send messages in bulk or otherwise breach the rules of the channels where you publish;
• provide health, legal, or financial advice requiring a license you do not have;
• bypass security measures, retrieve data you are not authorized to access, or place an abnormal load on the service, including automated use we have not agreed to;
• copy or decompile the service, or use it to build a competing product;
• share login credentials with anyone other than members of the workspace.

In case of breach we may remove content and close access. If the breach is less serious, we notify first and give you a deadline to correct it. See Section 15.

We do our best to make the service available. We promise no specific uptime, and no SLA follows the subscription.

Maintenance may cause interruptions. We provide notice of planned maintenance and major outages as best we can, and schedule maintenance outside normal working hours where possible. We promise no specific notice period or resolution time.

The service builds on suppliers we do not control, such as AI suppliers, social platforms, and Google Search Console. If they change rules or cease, functions may stop working. We cannot guarantee that a channel continues to allow publishing from Sannor.

Support is available by email at support@sannor.no. We respond as quickly as we can, but we guarantee no response time.

If a payment does not go through, we try again and notify you by email. If you do not correct it, the subscription is put on hold.

Then publishing, scheduled sending, and generation of new content stop. You can still log in, read what is there, and download content you have created.

Scheduled posts are pending. They are not published while the subscription is suspended. If you pay, they will be published again without new approval. Posts with a past scheduled time are moved to a later time, and the owner is notified.

We do not delete anything due to a missing payment. Retention periods in Sections 5 and 6 apply only after the subscription ends.

The Parties shall keep each other's confidential information secret and use it solely to fulfill the agreement. This obligation is mutual.

This obligation does not apply to information that is public without a breach of the agreement, which the Party had prior to receiving it, received from others without a confidentiality obligation, or must be disclosed by law or order from an authority. In case of order, we will notify you first if we have the legal authority to do so.

This obligation applies during the term of the agreement and for five years after its termination. For personal data, Annex A applies without time limitation.

We are not liable for indirect loss. Indirect loss means lost profits, lost revenue, loss of data that could have been backed up, third-party claims, and consequential loss.

Our total liability is limited to the amount you have paid us for the service in the twelve months preceding the claim.

The limitations do not apply:

• in cases of intent or gross negligence;
• for your obligation to pay for the service;
• for breach of the confidentiality obligation in Section 13;
• for liability under the GDPR which cannot be waived;
• for the indemnity in Section 7 for third-party claims concerning rights to content.

Both Parties may terminate the agreement upon material breach not remedied within thirty days after written notice.

We may block access immediately upon unlawful use, security risk, or serious breach of Section 10. We will notify and provide reasons.

We may also terminate the agreement without your breach, with thirty days' notice by email. In such cases, we will refund a pro-rata portion of the period you have paid for.

Upon termination of the agreement, scheduled posts are not published. They remain in the workspace during the retention period in Section 5, and you may download them there. What happens to the data otherwise is set forth in Section 5, Section 6, and in the privacy declaration..

Neither Party is liable for circumstances beyond reasonable control. This may include war, natural disasters, fire, strikes, power outages, prolonged interruptions by a service provider, or decisions by authorities.

The affected Party shall notify as soon as possible and take reasonable measures to limit consequences. Force majeure does not exempt payment for amounts already due.

If the situation lasts more than sixty days, both Parties may terminate the agreement in writing. In such cases, we will refund the unused portion of the period you have paid for.

You may not assign the agreement without our written consent. We will consent if your business is sold or merged, and the new owner assumes the obligations in the agreement.

We may assign the agreement upon merger, acquisition, or sale of the business. We will notify you. The terms and Annex A apply unchanged to the new owner.

Ownership transfer in a workspace is made in the app. The transfer takes effect only when the new owner has accepted it. Data, settings, and learning follow the workspace.

We may change the terms when the service, law, or our providers change. Changes that are not materially adverse to you may be made without your consent. We publish the new version here with a new date.

If a change is materially adverse to you, we will notify by email with at least thirty days' notice before it applies. If you protest in writing before that date, you may terminate the agreement effective from the date of the change. We will then refund a pro-rata portion of the period you have prepaid. If you continue to use the service after that date, the new terms apply.

Price changes follow Section 4 and apply at the earliest from the next renewal. Free setup may be terminated with fourteen days' notice after Section 6.

The agreement is governed by Norwegian law.

We will first attempt to resolve disputes amicably. If that fails, Agder District Court has jurisdiction.

If you are a consumer, the mandatory rules on consumer dispute resolution apply instead.

In case of conflict, the documents shall be in the following order: Annex A for questions regarding processing of personal data, then these terms, then other information on our website. Annex B is part of Annex A.

The agreement consists of these terms, Annex A, Annex B, the price you have ordered, and your order. It supersedes prior agreements on the same subject. Changes must be in writing, except Section 18. Email is considered written.

Sections 7, 8, 9, 13, 14, 19, and 20, and Annex A also apply after the agreement ends, so far as they are applicable. The same applies to Sections 5 and 6, so far as they apply to time after termination.

If a provision is invalid, the remainder of the agreement applies. The invalid provision is replaced by a valid one closest to what the Parties intended.

This annex is the data processing agreement between you and AI Solutions AS under Article 28 of the GDPR. It applies as long as we process personal data for you.

Roles. You are the controller for the personal data in your workspace. We are the processor for them. For your own account, payments, audit log, and our website, we are ourselves controllers. This is stated in the privacy declaration.

What the processing covers. The purpose is to provide Sannor to you. The processing consists of collecting, storing, structuring, analyzing, drafting from, publishing, and deleting information. The information includes: names and contact details for members in the workspace; materials you upload; names or usernames of persons who comment on or are mentioned in channels you connect to; content from websites you ask us to read, including competitor and inspiration sources; and encrypted access to your accounts. The data subjects are your employees and members, your customers and followers who comment, and persons mentioned in the material you provide us. The processing lasts as long as the agreement runs, and thereafter until the information is deleted or returned pursuant to paragraph (g).

Your obligations as controller. You must have a legal basis for the personal data entering the workspace, and you must provide the data subjects information pursuant to Articles 13 and 14. This applies also to persons who comment in channels you connect to. Your instructions must comply with the law.

(a) Documented instructions. We process personal data only according to your documented instructions. The terms, this annex, your settings, and actions you take in the service are the instructions. Transfer to countries outside the EEA occurs only on a basis under Chapter V of the GDPR, or when Norwegian law or EU law requires it. If the law requires it, we will notify you first if we have the legal authority. If we believe an instruction breaches the GDPR or other data protection legislation, we will notify you immediately, and we may withhold processing until the instruction is changed.

(b) Duty of confidentiality. All of us who process information have a confidentiality obligation under the agreement or by law. The confidentiality obligation also applies after the employment relationship ends. Access is granted only to those who need it to do their job.

(c) Security. We implement appropriate technical and organizational measures pursuant to Article 32. The measures are set forth in Annex B. We may update them but not so that the security level becomes lower. Customer support access is an authorized channel: an operator at our end may open your workspace to assist. Access lasts thirty minutes and can read all data in the workspace. That it was granted and ended is recorded in the audit log with who, when, and which workspace. There is no log over every single entry in the data. Access cannot publish, disconnect accounts, or delete anything permanently.

(d) Subprocessors. You grant us general authorization to use subprocessors. The subprocessors we use today are listed in a dated list in the privacy declaration. If we engage a new subprocessor or replace one, we notify you by email at least 30 days in advance. You may object in writing within that period. If we cannot agree, you may terminate the affected part of the service without cost and without this being considered a breach. If you have prepaid, we refund the unused portion. We impose the same obligations under this annex on our subprocessors and remain liable to you for their actions.

(e) Assistance with data subjects' rights. We assist you, as far as possible, in responding to requests for access, rectification, erasure, restriction, data portability, and objection. The service provides export and deletion functions you can use yourself. If we receive a request directly, we do not respond on your behalf. We forward it to you without undue delay.

(f) Assistance with security, personal data breaches, data protection impact assessments, and prior consultation. We assist you with the obligations in Articles 32 through 36. This covers security, personal data breach notification, data protection impact assessments (DPIAs), and prior consultation with the Norwegian Data Protection Authority. Our assistance is proportionate to the processing and the information we hold. As a data processor, we notify you without undue delay. As the controller for personal data for which we are responsible, we notify the Norwegian Data Protection Authority within 72 hours. Our notice to you describes what happened, the types of information involved and the number of affected people as far as we know, the likely consequences, and what we are doing about it.

(g) Erasure or return. When the agreement ends, we delete the personal data or return it if you ask us to. If you request its return, you receive a machine-readable export within 30 days of the request. If you request erasure, the information is removed from the active system within 30 days and from backups within a further 30 days. During the pilot phase, deleting it from the copies is a manual procedure. If you make no request, we follow the retention periods in Sections 5 and 6 and then delete the information. We retain only what the law requires, such as invoices for five years after the end of the financial year.

(h) Documentation and audit. We provide the information you need to demonstrate compliance with Article 28. The first step is documentation and a completed questionnaire from us. If that is insufficient, you or an independent auditor you appoint may audit us once per calendar year. You must give at least 30 days' written notice. You and the auditor must sign a confidentiality agreement. The audit takes place during working hours and must not disrupt operations. You cover the audit costs, including the time we spend on it.

Order of precedence. If this annex conflicts with the terms, this annex governs matters concerning the processing of personal data.

Contact. Requests regarding this annex are sent to support@sannor.no.

These are the measures we have taken pursuant to Article 32 of the General Data Protection Regulation. The list is dated at the top of this page. We may update it, but not in a manner that reduces the security level.

• Encryption during transmission. All traffic between you and the service is transmitted over TLS.
• Encryption of stored credentials. Access keys for social accounts and Google Search Console are stored encrypted using AES-256-GCM.
• Isolation per workspace. The database isolates workspaces from one another with row-level security. Isolation is enforced by the database, not solely by application code. The vector store filters by workspace on every query.
• Dedicated administrative connection. Operational tasks that must span workspaces utilize a dedicated database connection that is separate from the standard one. It is used only by a limited number of administrative functions.
• Access control. Roles within the workspace govern what a member can do: owner, administrator, manager, editor, and reader. The operator role is granted explicitly to us and can be revoked.
• Logged and auditable customer support access. An operator may open a workspace for thirty minutes to assist. Access can read all content in the workspace but can never publish, disconnect accounts, or permanently delete. Whether access was granted and terminated is recorded in the audit log.
• Audit log. The log records that customer support access was granted and terminated, and administrator actions such as creating, deleting, or moving a workspace, including who, what, when, which workspace, IP address, and browser. It is not a log of every individual data entry. The log is retained for twenty-four months.
• Backups. During the pilot phase, backups are taken manually and stored within the EEA. They are deleted no later than thirty days after the information is deleted from the active system. An automatic arrangement with a dedicated provider has not yet been established.
• Operations. The service is operated by Contabo GmbH in Germany. The crawler, vector store, and cache are operated by us there.
• Operations log. Logs are retained for ninety days.
• Incident handling. We have a procedure to detect, assess, and notify breaches of personal data security. The procedure is documented internally. See Section (f) in Annex A.

We do not have this: we are not certified under ISO 27001 or SOC 2, and we have not conducted external penetration testing. We state this here in case it changes.