Privacy Policy

Who is responsible

InvestorData AS, org. nr. 932 559 226 is the data controller for the processing described here. You can reach us at hei@investordata.no.

What we collect about you as a customer

If you have an account with us, we hold:

• Account: your name, email address and login credentials. Passwords are handled by our authentication provider and are never stored in readable form.
• Subscription: which plan you are on, its status, billing period and renewal date, and a customer identifier from our payment provider. Card details never reach our systems — they are handled by Chargebee.
• Use of the product: which stocks you have unlocked Sonar for and when, your watchlist, the alerts you have set up, and a log of alerts we have sent you so the same alert is not sent twice.
• Technical: a session cookie so you stay logged in, a cookie remembering your language choice, and ordinary server logs.

Why we process it, and on what basis

• To deliver the service you have subscribed to — performance of a contract.
• To invoice you and keep the accounts — legal obligation under the Norwegian Bookkeeping Act.
• To keep the service secure and working, and to understand which parts are used — our legitimate interest in running and improving a product you pay for.

Shareholder data — the part most privacy policies do not have

The product itself is built on ownership data from public and statutory registers. That data names identifiable people who never signed up for anything, and we think they are entitled to a plain explanation rather than a clause.

For private individuals who hold shares we may hold: name, year or date of birth, country of residence, the shares they hold in each company, and how those holdings change over time. For roles and company ownership we hold the links between a person and the companies they own or hold positions in.

The sources are Euronext Securities Oslo (the VPS shareholder register), Oslo Børs, the Brønnøysund Register Centre and the Norwegian Tax Administration’s shareholder register. We do not buy personal data from data brokers, and we do not enrich it with anything beyond these registers.

Our basis is legitimate interest: transparency about who owns listed companies is the point of these registers, and Norwegian law makes the shareholder register open precisely so ownership can be seen. We balance that against the privacy of the people named, which is why we publish holdings and changes rather than addresses, personal identity numbers or anything else that would identify someone beyond what the registers already make public.

If you are in this data and want to know what we hold, object to it, or ask for it to be corrected or removed, the GDPR page explains how — and we would rather hear from you than not.

Who else processes it

We use a small number of suppliers, all processing within the EU/EEA. We do not sell personal data, and we do not share it for advertising.

• Supabase — database, authentication and file storage.
• Vercel — application hosting.
• Chargebee — subscriptions, invoicing and card payments.
• Amazon Web Services (SES, Ireland) — sending alert and service emails.

How long we keep it

• Account and product data: for as long as you have an account, and deleted when you close it.
• Invoicing records: five years after the end of the financial year, as the Bookkeeping Act requires.
• Market and ownership data: for as long as it has analytical value — the history is the product, and a register that only showed today would answer none of the questions people come here to ask.

Cookies

We set two cookies: one that keeps you logged in, and one that remembers whether you want the site in Norwegian or English. Neither is used for advertising, and we run no analytics or tracking scripts. The only third-party script the site loads is Chargebee’s payment library, on pages where you can buy or change a subscription.

Your rights

You can ask for a copy of the data we hold about you, have it corrected, have it deleted, restrict or object to how we use it, and receive it in a portable format. Write to us and we will answer within 30 days.

If you think we are handling your data wrongly, you can complain to the Norwegian Data Protection Authority (Datatilsynet). We would appreciate the chance to put it right first.

Changes to this policy

If we change how we handle personal data, we update this page and the date at the top. Material changes are communicated to customers by email.