Privacy policy

1. Data controller

Atropical AS (org. no. 926 176 390), Stenbråtveien 75b, 1283 Oslo, Norway, is the controller for personal data collected through Verkform, except for the data site owners collect about their own customers (see sections 9 and 10).

Contact us: hey-ho@atropical.no

2. What we collect

We collect the following personal data:

• Email address — used for signing in and for correspondence.
• Company details — name, address, registration number, phone, trade and the service descriptions you enter in the wizard.
• Calendar settings — working hours, days off, appointment types and any links to private calendars you connect. From such calendars we store only when you are busy (start and end time), never the title, location or attendees. The link is stored encrypted.
• My account — if you sign in as a homeowner, we store your verified email address and which tradespeople you have agreed to see appointments from.
• Payment information — handled by our payment provider. We do not store card details.
• Technical data — logs and technical information necessary for security and debugging.

3. Purpose and legal basis

• Performance of a contract — to deliver the service you ordered, including the website, enquiries, calendar and My account (GDPR art. 6(1)(b)).
• Legitimate interest — to operate, improve and secure the service and to prevent abuse (GDPR art. 6(1)(f)).
• Consent — for web analytics beyond what is strictly necessary. Consent can be withdrawn at any time (GDPR art. 6(1)(a)).
• Legal obligation — to comply with accounting and tax law (GDPR art. 6(1)(c)).

4. Third-party services

We use trusted third-party services for analytics and site functionality. Those providers are obliged to protect your data and to use it only for the purpose the service delivers.

Pirsch Analytics. We use Pirsch Analytics for web analytics — cookie-free analytics software built on privacy-by-design principles. To analyse visitor flows, Pirsch generates a 16-digit number as a visit ID when the page loads. The inputs are IP address, user agent, date and a salt value.

A visitor's IP address is never stored in whole or in part, and is fully and irreversibly anonymised by the hash. Because the date is included and a separate salt is used per site, a visitor cannot be recognised for more than 24 hours and cannot be tracked across sites. Coarse geolocation (country/city) uses a locally integrated database.

Cloudflare Turnstile. We use Cloudflare Turnstile to prevent spam and abuse. See Cloudflare's privacy policy for more.

Webhuset AS — domain registration. Domain registration is carried out by Webhuset AS (org. no. 986 276 858) on behalf of Atropical AS. Registering a .no domain transfers the necessary details (name, address and email) to Webhuset AS as a processor. The processing is necessary to perform the contract (GDPR art. 6(1)(b)) and is governed by a data processing agreement.

5. Retention and deletion

Account data is retained for as long as the account is active. After an account is deleted, accounting-relevant data is retained as required by Norwegian bookkeeping law. Other data is deleted within a reasonable time after the account closes.

• Enquiries and customers who never had an appointment are deleted automatically after 24 months.
• Busy times fetched from private calendars are kept only for the next 90 days and are refreshed continuously.
• Calendar links sent to customers stop working 30 days after the last appointment.
• You can delete My account yourself at any time. The tradespeople keep their own customer records about you.

6. Sub-processors and transfers outside the EEA

To deliver the service we use the following sub-processors. All are bound by data processing agreements and process data only on our behalf:

• Neon — database and file storage.
• Stripe — payments.
• Anthropic — AI that writes text for websites and sorts and summarises incoming enquiries.
• Lettermint — sending email (confirmations, reminders and calendar invitations).
• Unsplash — image search. Receives search terms only, no personal data.
• Cloudflare, Pirsch and Webhuset — see section 4.

Anthropic and Stripe may process data in the United States. These transfers rely on the European Commission's standard contractual clauses, which form part of the providers' standard data processing agreements (GDPR Chapter V). Lettermint and Neon process data in the EU.

We never sell personal data to third parties.

7. Your rights

You have the right to:

• Access the data we hold about you.
• Have inaccurate data corrected.
• Request erasure (the "right to be forgotten").
• Object to or restrict the processing.
• Receive your data in a machine-readable format (data portability).
• Withdraw consent at any time, without affecting processing carried out before the withdrawal.
• Complain to the Norwegian Data Protection Authority (datatilsynet.no).

Send requests to hey-ho@atropical.no. We reply within one month.

8. Cookies

We use only technically necessary cookies, for authentication and security. No tracking or advertising cookies are used without your consent. See our cookie policy for details.

9. For site owners: your customers' personal data

When you publish a website through Verkform, you are the controller for your visitors' and customers' personal data. Atropical AS acts as a processor on your behalf under GDPR article 28, and processes that data only on your instructions and to deliver the service.

On your behalf, Verkform stores enquiries from the contact form (name, email, phone and message), bookings (time, type of job, address and notes), a customer record for each customer and the history of each enquiry.

Incoming enquiries are sent to our AI provider, which produces a short summary and suggests a priority. This is an aid for you — the AI makes no decisions about the customer (GDPR art. 22). On your behalf, Verkform also sends automatic emails to the customer: acknowledgement of a received enquiry, calendar invitations, reminders and changes.

You are responsible for having a valid legal basis for that processing and for informing your visitors in a privacy policy. Verkform provides a standard privacy page at /personvern on your domain that covers the contact form and booking, and that you can build on.

If you additionally add tracking tools (for example Google Analytics or Meta Pixel), you are responsible for the lawfulness of that collection. Verkform automatically shows a consent banner on your site before those tools activate.

10. For visitors to sites hosted by Verkform

If you have sent an enquiry or booked an appointment on a site built with Verkform, your details (name, email, phone, message and any appointment) are stored in Verkform's database on behalf of the site owner. The site owner is the controller for that data — Atropical AS acts only as a technical processor.

You receive emails about your enquiry and appointment, with a personal link where you can cancel or ask for a new time. The link gives access only to your own appointments with this site owner.

To exercise your rights (access, rectification, erasure), contact the site owner directly. That site's privacy policy is usually available at /personvern on its domain.

11. My account

My account gathers your appointments across the tradespeople who use Verkform. For My account, Atropical AS is the controller.

When you sign in with a verified email address, we find tradespeople who have you registered as a customer under the same address. Nothing is shared until you accept each tradesperson yourself, and you can hide a tradesperson again at any time. The tradespeople are not told whether you have My account.

If you delete My account, the profile and all links are removed. The tradespeople keep their own customer records, for which they are the controllers.

12. Data processing agreement

The Verkform terms of use include a data processing agreement (DPA) between Atropical AS and the site owner, in accordance with GDPR article 28. It governs how Atropical AS processes visitors' and customers' personal data on the site owner's behalf, including the use of the sub-processors in section 6.