Brevklart Privacy Policy
Version 1.1, 13 November 2026 (Beta). Written with an AI assistant, not a lawyer; a Norwegian lawyer has not yet reviewed it.
1. Who we are
Brevklart is run by [ENK NAME], org. nr [ORG NR], [ADDRESS], [EMAIL]. Sole proprietorship (enkeltpersonforetak), not VAT registered (MVA). We are the data controller for the processing described here.
2. What Brevklart does
You paste or photograph a letter. An AI model explains it in your language. For simple letters it can also suggest a short, neutral reply in Norwegian (confirm receipt, ask a question, ask for information). It does not write complaints, appeals or letters to debt collectors or authorities. There are no user accounts.
3. What data we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Content of your letter (text or image). May include names, addresses, case numbers and sensitive data such as health, ethnic origin, religion or criminal matters. | Explain the letter and, for simple letters, suggest a short reply | Art. 6(1)(b) (contract you asked for) and, for sensitive data, Art. 9(2)(a) your explicit consent (and your consent for criminal-offence data under the Personal Data Act) |
| Consent record (time, policy version, random ID, language; not the letter) | Prove that you consented | Art. 6(1)(c)/(f); Art. 7(1) |
| Payment and order data (email address, amount, pack, Stripe reference, credit balance token) | Deliver credits, send receipt, refunds, bookkeeping | Art. 6(1)(b) and 6(1)(c) (Bookkeeping Act) |
| Technical data: a random request ID, request path, status and duration in server logs; a one-way hash of your IP address, held in memory only, for rate limiting. We do not write your IP address, user agent or letter text to our own logs. Our host may log IP addresses at network level. | Security, rate limiting, preventing abuse, fixing faults | Art. 6(1)(f) legitimate interest |
| Anonymous usage statistics (see 3.1; no cookies, no IP, no user ID, no letter text) | Understand which pages and steps work, find errors, measure campaigns | Art. 6(1)(f) legitimate interest (see 3.1) |
We do not use your letter to train AI models, for advertising, or to profile you. We make no automated decisions with legal effect on you.
3.1 Usage statistics (cookieless, first party)
We count how the service is used with our own code on our own server. We use no third-party analytics, no cookies and no advertising or tracking pixels.
Events we record: a page view (landing, app, checkout, legal); which step you reach (paste, multiple letters, preview, checkout, result, practice); that checkout was started (pack size); the return from payment (ok, cancel, fail); that an analysis finished (letter type domain) or failed (an error code); a browser error (a shortened error message with digits and quoted text removed, and the script file name with line and column, never the web address or its query); your chosen interface language; and a few button clicks (copy a KID, account number or amount; download a calendar file; restore credits ok or not). A confirmed payment (pack) is also recorded by the server.
Fields stored with an event: event name and its values above; the time rounded to the minute; utm_source, utm_medium, utm_campaign if you arrived through a campaign link (letters, digits, dot, dash and underscore only, up to 40 characters); a device bucket, "mobile" or "desktop", from screen width only; and your interface language.
Never stored in these statistics: your IP address, user agent, cookies, any user or device identifier, tokens or credit balance, your letter or any text from it. Events cannot be linked to you or to each other.
Storage and deletion: a plain text file on our server (JSON lines), one file per day, kept for 90 days and then deleted automatically. Only we can read it; we do not share it.
Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in running and improving a small service and finding faults. Because the data is minimised as described and cannot be linked to a person, we assess it as anonymous or at most low-risk statistics. You can object at any time (Art. 21) by writing to [EMAIL]; because we cannot identify you in the statistics, we may not be able to find your events.
No consent banner: the Norwegian rule on cookies and similar technology is section 3-15 of the Electronic Communications Act (ekomloven), in force since 1 January 2025 (it replaced the former section 2-7b). It requires consent to store information on, or read information from, your device unless that is strictly necessary for a service you asked for. Our statistics set no cookies and write no identifiers to your device. We read only your screen width and your own language setting to fill the fields above. The campaign tag from a link (the utm values, no personal data) is kept only in the open page's memory and sent with that page's events; it is not stored on your device. We have concluded that no consent banner is needed.
3.2 Server logs
Our server log shows, for each request, a random request ID (generated on the server, or a valid one you send), the method, the path, the status code and the duration. It does not contain your IP address, your letter or any text from it.
4. What we do not store
We do not save your letter, the AI explanation or a suggested reply on our servers. They exist in memory while the request runs. We do not write letter text to logs.
What stays on your device (not on our servers). So that you do not have to add your letter again after paying, and so that Back, Forward and reload work, your own browser keeps some data on your device. We do not receive it and cannot see or recover it.
- While you pay on Stripe (you leave and come back in the same tab): the text you pasted, after we have tried to hide Norwegian ID numbers and account numbers, in this tab's sessionStorage. Photos and PDFs you added are kept in your browser's IndexedDB, as they are (nothing in them is hidden).
- The last preview and the last full result: in this tab's sessionStorage.
- Deleted when you press Clear, when you close the tab, as soon as the letter has been used after payment, or after 1 hour at most, whichever comes first. (The result and preview are deleted on Clear or when the tab closes.)
- Masking is not perfect, so the stored text can still contain personal details. Anyone who can use this browser tab while it is open could see it. On a shared device, press Clear when you are done. We never put this data in localStorage, cookies or a URL.
Add to calendar. The event has a generic title and the deadline date, no letter text. It goes to your own calendar app; your calendar app may sync it to your calendar provider, which is your own choice. On some devices (for example iPhone) only the date is sent to our server to build the calendar file; we do not store it. Check the date against your letter.
If you close the tab, the result is gone: copy what you need.
Masking applies to pasted text only: before pasted text is sent we try to hide Norwegian national ID numbers and account numbers on your device. This is not perfect. Photos and PDFs are sent to our AI provider unredacted (we cannot hide anything in them before sending) and are never stored on our servers. Please cover ID numbers, account numbers and other sensitive details yourself before you take the photo or upload the file.
5. Who receives your data (processors and others)
- Anthropic PBC (USA), AI provider (processor). Receives the letter content to generate the answer. Under its commercial API terms it does not train on our API data. It may keep inputs and outputs for up to 30 days (up to 2 years if flagged for misuse) for abuse prevention and safety. The AI is run by Anthropic in the United States, not in the EU or EEA.
- Gigahost, hosting of our server (processor). The servers are in Norway.
- Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc., payments and payment receipts. Stripe is an independent controller for payment and fraud-prevention data. We never see your card number. Payments are currently in test mode.
- Our accountant or bookkeeping system, payment records (processor).
- Authorities when the law requires.
We do not sell personal data.
| Recipient | Role | Location and transfer basis | Training |
|---|---|---|---|
| Anthropic PBC | AI provider (processor) | United States; safeguards required for transfers outside the EEA (section 6) | Not used to train models under its commercial API terms |
| Stripe Payments Europe, Ltd. and Stripe, Inc. | Payments (independent controller) | Ireland / United States; safeguards as in section 6 | Not applicable |
| Gigahost | Hosting (processor) | Our server at our hosting provider, in Norway | Not applicable (Norway) |
6. Transfers outside the EEA
Anthropic is in the United States. We transfer data there under the safeguards data protection law requires for transfers outside the EEA, such as the EU Standard Contractual Clauses in our data processing agreement or the EU-US Data Privacy Framework. Stripe and other vendors may transfer data under the same mechanisms. You can ask us for a copy of the safeguards.
7. How long we keep data
- Letter, result, suggested reply: not stored on our servers (AI provider period above). On your own device, in your tab: until Clear, tab close, first use after payment, or 1 hour at most (section 4).
- Consent record: 12 months.
- Order, payment, receipt data: 5 years after the end of the year of purchase (Bookkeeping Act).
- Usage statistics (3.1): 90 days, one file per day, then deleted automatically.
- Server logs (request ID, path, status, duration): only as long as needed for security and fault finding. Rate-limit counters: in memory only, one hash per IP, about 1 hour (24 hours for a credit-token counter), never written to disk.
- Support emails: 12 months after the case is closed.
8. Your rights
You can ask for access, correction, deletion, restriction, objection, and data portability (Arts. 15-21), and you can withdraw consent at any time (this does not affect earlier processing). Because we store little, we may need proof of purchase (receipt) to find your data. Write to [EMAIL]; we reply within one month. You can complain to the Norwegian Data Protection Authority, Datatilsynet: https://www.datatilsynet.no.
9. Sensitive information and your choice
Giving consent is voluntary. Without consent you cannot upload a letter; you can still read our general information. You can withdraw consent by stopping use and closing the page.
10. Children
Brevklart is for people aged 18 or older. We do not knowingly process children's data as users. If a letter concerns your child, you upload it as the parent/guardian.
11. Cookies and local storage
We set no cookies. We use only storage that is necessary to run the service: your credit balance token, chosen language and light or dark theme in your browser's local storage, and an unlocked result in sessionStorage for that tab only. The usage statistics store nothing on your device. We do not use advertising or tracking cookies. Stripe sets its own cookies on its payment page.
12. Security
HTTPS, access control, no letter logging, signed payment tokens, rate limiting. No system is perfectly secure. We report breaches to Datatilsynet and affected users as the law requires.
13. Changes
We will update this policy when something material changes and show the date. Material changes involving your sensitive data will need new consent.
14. Contact
[ENK NAME], org. nr [ORG NR], [ADDRESS], [EMAIL]. Not VAT registered.
*Legal references: Personal Data Act https://lovdata.no/dokument/NL/lov/2018-06-15-38 ; Electronic Communications Act (ekomloven) section 3-15 https://lovdata.no/lov/2024-12-13-76 ; Datatilsynet on cookies and tracking https://www.datatilsynet.no/personvern-pa-ulike-omrader/internett-og-apper/bruk-av-informasjonskapsler-og-andre-sporingsteknologier/ ; Nkom on cookies https://nkom.no/internett/informasjonskapsler-cookies ; Datatilsynet https://www.datatilsynet.no.*