Privacy Policy
About this notice
This Privacy Policy explains how Backroad AS handles personal data collected through the Innflyt marketing website at innflyt.com and innflyt.no. For information about how Innflyt processes feedback data on behalf of customers (the processor side), see the Processor Information Page.
This notice covers the public marketing website only. Use of the Innflyt platform itself (the embedded widget, the customer dashboard, and related services) is governed by a separate Data Processing Agreement entered into between Backroad AS and each customer.
Who we are
| Field | Detail |
|---|---|
| Controller | Backroad AS |
| Organisation number | 934 341 929 |
| Registered office | Bergen, Norway |
| Role for this website | Data controller for personal data collected through the marketing website |
| Supervisory authority | Norwegian Data Protection Authority (Datatilsynet), Oslo, Norway |
What data we collect
Beta-invite signup form
When you submit the signup form, we collect:
- Email address. Required. Used to send the beta invitation and to communicate with you about Innflyt.
- Locale. Captured automatically from the page you were on (English or Norwegian Bokmål). Used to send communication in your preferred language.
- Submission timestamp. Set server-side.
We do not collect name, company, role, country, or any other field at signup.
Cookies
We use one cookie:
innflyt-locale— a strictly-necessary cookie that remembers your language preference between visits. Lifetime is one year. Required for the language toggle to work; does not require consent under the ePrivacy Directive.
We do not use analytics cookies, marketing cookies, fingerprinting, or any third-party tracking on this website.
Server logs
Our hosting infrastructure records standard server logs (Internet Protocol address, request path, user-agent string, timestamp). These are kept for a short operational window for security and debugging.
Legal basis
| Data | Legal basis under the General Data Protection Regulation |
|---|---|
| Signup email and locale | Your consent, given by submitting the form (Article 6(1)(a)). You can withdraw your consent at any time by contacting [email protected]. |
| Locale cookie | Strictly-necessary purpose under the ePrivacy Directive. |
| Server logs | Legitimate interests in operating, securing, and debugging the website (Article 6(1)(f)). |
Where data is stored
Primary processing happens within the European Economic Area:
- Signup data is stored at Supabase Inc., region
eu-north-1(Stockholm, Sweden). - Website hosting runs on UpCloud Ltd, in Stavanger, Norway.
- Cloudflare Inc. serves as the Domain Name System provider, content delivery network, and outbound transactional email sender for confirmation and notification emails.
- Migadu Sàrl hosts the inbound mailboxes that receive signup notifications and any replies to the address you provide.
Sub-processors
| Sub-processor | Service | Location | Transfer mechanism |
|---|---|---|---|
| Supabase Inc. | Managed PostgreSQL database for the signup table | Stockholm, Sweden | Intra-European-Economic-Area; no cross-border mechanism required |
| UpCloud Ltd | Server hosting for the marketing website | Stavanger, Norway | Intra-European-Economic-Area; no cross-border mechanism required |
| Cloudflare Inc. | Domain Name System, content delivery network, Cloudflare Email Service (currently in beta) for outbound transactional email | Global network with European edge nodes | Standard Contractual Clauses under Article 46(2)(c) of the General Data Protection Regulation |
| Migadu Sàrl | Email mailbox hosting for inbound replies and notifications | Switzerland | Adequacy decision under Article 45 of the General Data Protection Regulation |
We will update this list when it changes.
How long we keep your data
| Data | Retention |
|---|---|
| Signup email and locale | Until you ask us to delete it, or until you unsubscribe from communications about Innflyt and request deletion. |
| Server logs | A short operational window of approximately 30 days, then automatically purged. |
| Locale cookie | One year from the most recent visit. You can clear it at any time in your browser. |
Your rights
Under the General Data Protection Regulation, you have the right to:
- Access your personal data and receive a copy of it.
- Rectify inaccurate or incomplete data.
- Erase your data ("right to be forgotten") where applicable.
- Restrict processing in certain circumstances.
- Data portability — receive your data in a structured, machine-readable format.
- Object to processing based on legitimate interests.
- Withdraw consent at any time, where processing is based on consent.
To exercise any of these rights, contact [email protected]. We respond within one month, as required by Article 12(3) of the General Data Protection Regulation.
You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet).
Children
The Innflyt marketing website is intended for business audiences. We do not knowingly collect personal data from children under 16.
Updates to this notice
We will update this notice as Innflyt evolves. Material changes will be flagged on the website before they take effect.
Contact
| Purpose | Address |
|---|---|
| Privacy and data protection | [email protected] |
| Legal and contracts | [email protected] |
| Security vulnerability reports | [email protected] |
| General enquiries | [email protected] |
Postal address. Backroad AS, Bergen, Norway.
Supervisory authority. Norwegian Data Protection Authority (Datatilsynet), Oslo, Norway.