Privacy Policy

Last updated: 9 October 2026 · Version: 2026-10-09

This notice explains how Backroad AS handles personal data as a controller in connection with Innflyt: on the websites innflyt.com and innflyt.no, for the people who use the Innflyt dashboard on behalf of our customers, for billing and support, and for feedback sent to us about Innflyt.

It does not cover the feedback our customers collect from their own visitors through the Innflyt widget. For that feedback the customer is the controller and Backroad AS is its processor; see the Processor Information page and the Data Processing Agreement. The customer also decides how long that feedback is kept: by default 365 days for feedback and 90 days for screenshots, any period from 30 to 3,650 days, or "keep", which means no automatic deletion until the customer deletes it.

1. Who we are

2. What we process, why, and on what legal basis

The legal bases are those of Article 6(1) of the General Data Protection Regulation (GDPR): (a) consent, (b) contract, (c) legal obligation, (f) legitimate interests.

2.1 Visiting the websites

• What: your IP address, the address of the page, browser and device information and the time of the request, which pass through Cloudflare's network and our servers; a technical error report to Sentry if our server fails while handling your request; your language and theme choice if you set them (see Cookies). We do not use analytics or tracking scripts on the websites.
• Why: to deliver and secure the websites and to fix errors.
• Legal basis: (f) our legitimate interest in running secure, working websites.

2.2 Dashboard accounts

• What: your email address, name if you give one, your organisation and your role in it, invitations you send or receive (if a colleague invites you, we receive your email address and your role from that colleague), the language you use, which version of the Terms of Use was accepted and when, and a recovery email address if you add one. For sign-in: the public part of your passkeys (your fingerprint or face never leaves your device) with a label, a counter and when each was last used; if you turn on two-step verification with an authenticator app, the factor held by Supabase Auth and your recovery codes in hashed form; a hash of a random device identifier and when that device was first and last seen, so we can warn you by email when a new device signs in; your sign-in sessions; and short-lived records of sign-in attempts, which hold only one-way hashes of the code, your email address and your IP address.
• Why: to give you access to your organisation's dashboard, to keep accounts secure, and to send you the emails the service needs (sign-in codes, security notices, invitations, welcome and usage notices).
• Legal basis: (b) where you are personally our customer; otherwise (f) our and your organisation's legitimate interest in giving the people it authorises secure access to the service it has chosen. Security measures rely on (f).

2.3 Bot protection

• What: the sign-in and sign-up pages use Cloudflare Turnstile. It reads technical signals from your browser, such as your IP address, TLS fingerprint and user-agent, and gives the page a one-time token that our server checks with Cloudflare, sending your IP address with it. We keep only a hash of the used token, for one day.
• Why: to stop automated abuse, such as accounts created by programs or sign-in emails sent to people who did not ask for them.
• Legal basis: (f) our legitimate interest in protecting the service and its users from abuse. Cloudflare processes these signals for us to run the check, and as a controller to improve its bot detection; see the Cloudflare Turnstile Privacy Addendum.

2.4 Plans, billing and payments

• What: your organisation's name, the email address of the person who starts Checkout, and our internal identifiers for the organisation, which we send to Stripe; the Stripe customer and subscription identifiers, your plan and its status and dates, which we keep. At Checkout, Stripe collects the billing name, billing address and your payment details. We never see or store card numbers.
• Who handles payment: payments for paid plans are handled through Stripe Managed Payments. Link (Sold through Link, LLC, a Stripe affiliate) is the merchant of record: it processes the payment, calculates and collects any indirect tax, and sends receipts and invoices. Stripe processes the data we send it on our behalf under Stripe's data processing agreement; in the European Economic Area the Stripe companies involved are Stripe Payments Europe, Limited and Stripe Technology Europe, Limited (Ireland). Stripe and Link handle the data you give at Checkout under their own terms and Stripe's privacy policy, including as controllers for the payment, for fraud prevention and for their legal obligations.
• Why: to run your organisation's subscription and to keep the accounting records Norwegian law requires.
• Legal basis: (b) where you are personally the customer, otherwise (f); and (c) for accounting records under the Norwegian Bookkeeping Act (bokføringsloven).

2.5 Support and email to us

• What: what you write to us at our @innflyt.com addresses and your contact details.
• Why: to answer you and keep a record of the conversation.
• Legal basis: (b) where it concerns your contract, otherwise (f) our legitimate interest in answering enquiries.

2.6 Feedback you send us about Innflyt

• What: we use our own Innflyt widget on our websites and in the dashboard (not on its sign-in and security pages). If you send us feedback through it, we receive the same kinds of data our customers receive (see the Processor Information page), and the feedback is copied to our issue tracker, Linear.
• Why: to understand and fix problems and improve Innflyt.
• Legal basis: (f) our legitimate interest in improving our product.

2.7 Internal sign-up notices

• What: when an organisation signs up, we post the name and domain of the site it registers and our internal identifier for the organisation, without anyone's email address, to our internal Slack workspace. If an account email fails to send, an alert with technical error details goes to the same workspace.
• Why: to follow up new customers and fix email problems quickly.
• Legal basis: (f) our legitimate interest in running the service.

2.8 Earlier beta-invitation requests

• What: before self-service sign-up opened, people could ask for a beta invitation on innflyt.com. We hold the email address, language and time of those requests, and delete each one automatically 12 months after it was made. The email address was also posted to our internal Slack workspace when the request was made. The form is no longer offered.
• Why: to contact you about Innflyt.
• Legal basis: (a) your consent, which you can withdraw at any time by writing to privacy@innflyt.com; we then delete the request.

2.9 Logs and error monitoring

• What: our servers, Supabase and Cloudflare record technical logs (IP address, request, browser, time) for security and troubleshooting. An application log line may contain an email address when an email to it fails to send. Sentry receives technical error reports from the server-side code of the websites and the dashboard and from our server-side functions, with sending of personal data switched off, IP-address scrubbing switched on and no session replay. No Sentry code runs in your browser.
• Why: to keep the service secure and to find and fix faults.
• Legal basis: (f) our legitimate interest in a secure and working service.

2.10 What you have to give us

Nothing is required to read the websites. To have a dashboard account you must give an email address: we need it to create the account and send sign-in codes, so without it we cannot give you an account. Creating an organisation requires its name. To buy a paid plan, the billing and payment details Checkout asks for are needed to enter into and pay for the contract; without them the plan cannot be bought. Keeping accounting records about payments is a legal requirement for us under the Bookkeeping Act, not an obligation on you. Everything else, such as your name, a recovery email address, passkeys, two-step verification, language and theme choices, feedback and emails to us, is optional, and leaving it out only means that the related function is not available.

We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not sell it or use it for advertising.

3. Who receives the data

We use the following providers. Where the same provider also processes customer feedback, it is the same company as in the Data Processing Agreement.

We also disclose data where the law requires it, for example to public authorities.

4. Transfers outside the EEA

Our database is in Sweden, our server-side functions run in Germany and our servers are in Norway. Some providers above are established, or have staff or systems, outside the European Economic Area (EEA). Those transfers rely on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), on the EU–US Data Privacy Framework for certified US companies, or on an adequacy decision (Switzerland), as shown in the table. You can ask for more information, and for a copy of the Standard Contractual Clauses that apply, at privacy@innflyt.com.

5. How long we keep it

6. Your rights

You have the right to access your personal data, to have it corrected, to have it erased, to restrict its processing, to data portability, and to object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time. You can delete your own dashboard account in the dashboard.

To use your rights, write to privacy@innflyt.com. We answer within one month, as Article 12(3) GDPR requires.

You can complain to the Norwegian Data Protection Authority (Datatilsynet), datatilsynet.no, or to the supervisory authority where you live or work.

If you sent feedback to one of our customers through the Innflyt widget, contact that customer first: it is the controller. If you contact us, we forward your request to it.

7. Children

Innflyt is a service for businesses and is not aimed at children. We do not knowingly process personal data about children under 16 as a controller.

8. Changes

We publish each version of this notice here with its date and version number. We tell the owners and administrators of customer organisations by email about material changes before they take effect.

9. Contact

Backroad AS · organisation number 934 341 929 · Måseskjæret 18, 5035 Bergen, Norway.