Privacy policy

Who is responsible

Airglow is operated as a personal project while the company is being set up. Until a registered entity exists, the data controller is the individual operating Airglow. Questions about your data, or any of the rights below, go to post@airglow.no.

Once Airglow is registered as a company, this section will be updated with the full business name, organisation number and address.

If you are a guest

Opening a guide does not create an account and we do not ask you for anything. We do not use advertising or analytics cookies on guide pages, and we do not track you across other sites. The guide itself contains information the host wrote, which can include their name and phone number.

If you are a host

We store:

• Your email address and password (the password is hashed — we never see it), so you can sign in.
• Your name and phone number if you add them, so guests can reach you.
• The content of your guides: address, wifi details, times, rules, FAQ, local tips, photos and logos you upload.
• Subscription status and payment records — plan, period, whether the last payment went through. Card numbers never touch our servers; they go straight to our payment provider.

Why we are allowed to store it

To deliver the service you signed up for (contract), to take payment and keep accounting records (legal obligation), and to keep the service running and secure (legitimate interest). We do not sell data and we do not use it for advertising.

Cookies

We only use what is strictly necessary: a login session so you stay signed in, and cookies our payment provider sets during checkout. No consent banner, because there is nothing optional to consent to.

Who else processes it

We use a small number of sub-processors to run the service: hosting and database, payment processing, and a machine-translation service used only when a host asks for a guide in another language. They act on our instructions under data processing agreements. Data is processed in the EU/EEA, or under transfer mechanisms approved under GDPR where a provider operates outside it.

How long we keep it

Your account and guides stay until you delete them. Delete your account and everything goes immediately — guides, places, photos and profile. Payment and invoice records are kept as long as accounting law requires (in Norway, five years), because we are not allowed to delete those on request.

Your rights

Under GDPR you can ask for a copy of your data, correct it, have it deleted, restrict or object to processing, and take it elsewhere in a machine-readable format. Two of those are buttons you can press yourself — in the dashboard under Account you can download everything as a JSON file and permanently delete your account. For anything else, email us; we answer within 30 days.

If you think we are handling your data wrongly you can complain to Datatilsynet, the Norwegian Data Protection Authority.

Changes

If we change this policy we update the date at the top, and tell hosts by email if the change matters.