This Privacy Policy explains how Northflow Technologies AS (“Northflow”, “we”, “us”) collects, uses, and protects personal data in connection with the CERES platform at ceres.northflow.no. We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and applicable Norwegian data protection law.
1. Data Controller
The data controller responsible for your personal data is:
Northflow Technologies AS
Org. no. 936 979 815
Jåttåveien 92
4020 Stavanger
Norway
+47 95 08 50 45
ceres@northflow.no
2. What Data We Collect
We collect only the data necessary to provide the CERES service:
- Email address and organisation name: collected when you contact us, and held for people who signed up to the CERES newsletter or an API plan earlier. Used to answer you and to keep those existing records.
- Payment data: earlier API plans were paid through Stripe. We have never stored card numbers or payment credentials. Stripe acts as an independent data processor under its own privacy policy.
- Usage data: anonymised analytics via Google Analytics 4 (if enabled). Includes pages visited, session duration, and device type. No personally identifiable information is transmitted to Google Analytics.
- API request logs: IP address and request timestamps for API calls. Retained for 30 days for security and abuse prevention.
3. Legal Basis for Processing
- Contract performance (Art. 6(1)(b) GDPR): processing the email and billing records of earlier newsletter and API sign-ups.
- Legitimate interests (Art. 6(1)(f) GDPR): security logging, fraud prevention, and platform analytics.
- Consent (Art. 6(1)(a) GDPR): where you have given explicit consent, such as accepting cookie tracking for analytics.
4. How We Use Your Data
- Responding to research and institutional enquiries
- Keeping the records of earlier subscriptions that accounting law requires
- Monitoring platform health and preventing abuse
- Improving the service through anonymised usage analytics
We do not sell, rent, or share your personal data with third parties for marketing purposes.
5. Data Processors and Third Parties
- Stripe Inc.: payment processing for earlier API plans. Stripe Privacy Policy
- Google LLC (Analytics): anonymised website analytics. Data processed under a Data Processing Addendum, with IP anonymisation enabled. Google Privacy Policy
- Railway Inc.: cloud infrastructure hosting the API backend. Data processed within the EU/EEA or under Standard Contractual Clauses.
- Vercel Inc.: frontend hosting. Data processed under Vercel’s Data Processing Addendum.
6. Data Retention
- Earlier newsletter sign-ups: retained until you ask us to remove them.
- Earlier API plans: retained for the duration of the plan plus 2 years for accounting purposes.
- Enquiries: retained for as long as the conversation is relevant.
- API request logs: 30 days.
- Analytics data: Google Analytics default retention (14 months).
7. Your Rights Under GDPR
You have the following rights regarding your personal data:
- Right of access: request a copy of the personal data we hold about you.
- Right to rectification: request correction of inaccurate data.
- Right to erasure: request deletion of your data (“right to be forgotten”), subject to legal retention obligations.
- Right to data portability: receive your data in a machine-readable format.
- Right to object: object to processing based on legitimate interests.
- Right to withdraw consent: where processing is based on consent, you may withdraw at any time.
To exercise any of these rights, contact us at ceres@northflow.no. We will respond within 30 days.
You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) at datatilsynet.no.
8. Cookies
CERES uses minimal cookies. See our Cookie Policy for full details. Essential cookies are required for the platform to function. Analytics cookies require your consent and can be declined.
9. International Data Transfers
Some of our processors (Stripe, Google, Vercel) may process data outside the EEA. Where this occurs, we ensure appropriate safeguards are in place, including EU Standard Contractual Clauses (SCCs) or adequacy decisions. Contact us for details.
10. Security
We implement appropriate technical and organisational measures to protect your personal data, including HTTPS encryption in transit, access controls, and regular security reviews. No system is completely secure: please contact us immediately if you suspect a data breach.
11. Changes to This Policy
We may update this Privacy Policy from time to time. The date at the top of this page reflects the most recent revision. Material changes are published on this page with a new date.
12. Contact
For any privacy-related questions or requests:
Northflow Technologies AS
Jåttåveien 92
4020 Stavanger
Norway
+47 95 08 50 45
ceres@northflow.no