Privacy in this preview
Understand where your information goes.
FALKASETE AS, organisation number 988195154, is responsible for personal data processed in operating Norshift. Our address is Skreddarstuva 141, 4160 FINNØY, Norway. For privacy questions or rights requests, contact support@salon.no. The public preparation tools do not create a customer account or upload company documents. Restricted operator sign-in is reserved for administering and securing the site.
Local drafts and display choices
Your preparation draft, checklist, saved searches, example alerts, example decisions, tasks and notes, and A+ display preference can be stored in this browser on your device. They support the features you choose to use and remain until removed through the available app controls or your browser storage settings. The app does not encrypt this local storage; other people using the same browser profile may be able to read it. Avoid sensitive personal information. There is no Norshift cloud copy of these drafts or demonstration notes.
Company lookups and the calculator
When you request a company lookup, the organisation number is sent by POST to Norshift through Cloudflare and used to request public company information from Brønnøysundregistrene. Only the organisation number is needed for that request. We rely on our legitimate interest in providing the public lookup you requested, with data minimisation, under GDPR Article 6(1)(f). Public company responses are cached to reduce repeated register requests. We check for updates when a cached record is requested after 24 hours. The value-scenario calculator runs in your browser: its financial inputs are not sent to Norshift. Other preparation entries also remain in your browser.
Your exports and email enquiries
A downloaded or printed report can contain the business information you entered. You choose where to save it and whom to share it with. An exported copy is separate from the local browser draft. If you email support@salon.no, the information in that email is sent to us separately so we can handle the enquiry or privacy request. Keep it limited to what is needed and do not attach confidential business files.
Website delivery, security and logs
Cloudflare delivers the website and processes network metadata such as IP addresses, requested URLs, browser information and request times. We rely on our legitimate interests in operating and securing the website under GDPR Article 6(1)(f). Application request and diagnostic logs are retained for up to seven days. This limit does not describe all technical data Cloudflare processes under its own published terms and privacy information. Cloudflare operates globally and may process data outside the EEA, including in the United States; its published Data Processing Addendum describes international-transfer safeguards. We do not claim that all processing takes place in Norway or the EEA.
Public assets, translation and services not enabled
Fonts and website images are served with the site; visiting the site does not send a Google Fonts request. English interface text is translated into Norwegian with Gemini during the build process. An authorised administrator can also request Norwegian translations of public website notices and sector labels before reviewing and publishing them. Only public interface copy is used for these translations, not visitor entries, financial inputs, private review notes, private documents or account records. Advertising analytics and tracking are not enabled. The current preview has no document uploads, payment collection, shared cloud preparation files or AI document extraction.
Restricted operator authentication
When operator sign-in is enabled, Supabase processes the authorised operator's email address, account ID, email-confirmation status, administration role, session credentials and technical security data. We rely on our legitimate interests in secure operator access and maintaining the site under GDPR Article 6(1)(f). The operator account is retained while that administrative authority is needed; access is revoked and the account is removed when it ends. Our Supabase project is configured in London, United Kingdom (eu-west-2). Once code delivery is enabled, Amazon SES in Frankfurt, Germany (eu-central-1), processes the recipient address and message content to deliver requested sign-in codes. Cloudflare delivers the site globally as described above. Selected regions do not mean that every provider operation stays in those regions or within the EEA; the suppliers' data-processing terms describe international-transfer arrangements. Provider security records, email-delivery records and backups have separate retention arrangements; the seven-day application-log limit above does not describe those records. Public customer accounts, private company-file services and payments remain closed.
Operator sign-in cookies and this browser
Operator sign-in uses necessary cookies containing session credentials. They are HttpOnly, sent over HTTPS in production and restricted to the host where sign-in took place. We set their browser lifetime to 30 days when created or refreshed. A successful session refresh can renew that period, so this is not an absolute 30-day automatic-logout deadline. Provider session expiry or revocation can end access earlier. Signing out ends the current host's session; another domain or device can have a separate session. The submitted email address is also remembered in this tab's sessionStorage to continue code entry. That continuation is accepted for 15 minutes; the stored address can remain until the flow clears it or the tab/browser storage is cleared. The code itself is not saved in browser storage. Signing in does not upload a local preparation draft, and signing out does not remove that draft.
Your rights and how to contact us
For personal data we process, you can ask FALKASETE AS at support@salon.no for access, rectification, erasure, restriction or data portability, where applicable, and object to processing based on legitimate interests. We may need proportionate information to verify a request. We cannot read or remove drafts held only in your browser; use the app or browser controls for those copies. You can complain to the Norwegian Data Protection Authority, Datatilsynet. Contacting us first is optional. Before new services process additional personal data, their purposes, legal bases, providers and retention arrangements will be explained.