Privacy notice

Toppkart is the controller for the data described here. The service is run privately, not through a registered company.

Questions about privacy, and requests for access or deletion, go to support@toppkart.no.

From the sign-in: the e-mail address on the Google account you sign in with, and the language you have chosen. The sign-in itself happens at Google, and we never receive your password.

From the subscription: its status, which plan you are on, when the current period ends, when the trial ends, and your customer and subscription identifiers at Stripe.

About the payment card we store the card type, the last four digits and the expiry month — enough for you to recognise the card on My account. We never see the full card number. The card is entered on Stripe's own pages and the details never pass through Toppkart.

Receipts: amount, currency, status and a link to the invoice at Stripe, mirrored on our side so My account can show the history.

If you write in the feedback box: the text you sent, the page you were on, and your address if you were signed in. Alongside it we keep a counter, so that nobody can send a thousand messages in a row. The counter is kept against a cryptographic rewriting of your IP address — a one-way value we cannot turn back into an address — and it is deleted after a day. The IP address itself is not stored.

We store nothing about which tours you look at, and no location data. The app never asks for your position.

We process the data to deliver the service you ordered, to keep track of the subscription, and to send you receipts and notice when the trial is coming to an end. The legal basis is the contract with you — GDPR article 6(1)(b).

Invoices and accounting material are processed because the Norwegian Bookkeeping Act requires it — article 6(1)(c).

We use a handful of providers who process data on our behalf. We do not sell data on to anyone.

Supabase provides the database and sign-in. Stripe handles payment and subscriptions. Resend sends receipts and notices by e-mail. Vercel hosts the site and gives us basic visitor statistics. Google provides the sign-in and the typefaces the site uses.

Some of these are US companies. Transfers outside the EEA rely on the European Commission's standard contractual clauses or on the EU–US Data Privacy Framework.

We use no cookies for tracking or advertising, and therefore have no consent banner.

Necessary cookies: a sign-in cookie from Supabase that keeps you signed in, and «tk_lang», which remembers your language choice for a year.

The visitor statistics from Vercel Analytics set no cookie and do not follow you between sites. They count page views on a pseudonymous basis.

Typefaces are loaded from Google Fonts, which means your IP address is visible to Google when a page loads.

Account and subscription data are kept for as long as you have an account with us. You delete the account yourself under «Konto» on My account: a running subscription is cancelled straight away, and your profile, subscription data and feedback go with it. It happens immediately and cannot be undone.

If you would rather we did it, that works too — write to support@toppkart.no.

Invoices and other accounting material are kept for five years after the end of the financial year, as the Bookkeeping Act requires. That applies after the account has been deleted too, and they then sit at Stripe rather than with us.

You have the right to see what we hold about you, to have errors corrected, to have data deleted, to receive it in a machine-readable format, and to object to the processing.

Ask by writing to support@toppkart.no. We reply within 30 days.

If you are unhappy with how we handle your data, you may complain to the Norwegian Data Protection Authority (Datatilsynet).

If we change this notice we update the date at the top of the page. For changes of significance we will tell you by e-mail.