NordicPulse ("we", "us", "our") is committed to protecting your privacy. This privacy policy explains how we collect, use, store, and protect your personal data when you use NordicPulse (the "Service").
We comply with the EU General Data Protection Regulation (GDPR) and Norwegian privacy law.
NordicPulse ("we", "us", "our") is committed to protecting your privacy. This privacy policy explains how we collect, use, store, and protect your personal data when you use NordicPulse (the "Service"). By using the Service, you consent to the processing of your personal data as described in this policy.
NordicPulse is the data controller for the personal data collected through the Service. KlarForEndring AS (dba NordicPulse) Company reg. no: 935 806 798. Reinhold Ziegler's Veg 21A. 6416 Molde, Norway. Øystein Kalseth (CEO)
Name and email address · Company name and role · Password (encrypted) · Registration date.
Which features you use · Keywords and analyses you generate · Time of use · IP address and device type.
Google Analytics data (if you connect it) · Google Search Console data (if you connect it) · Other third-party integrations you enable.
We use your personal data for the following purposes: Deliver the Service:, Authentication, personalization, and functionality · Improve the Service:, Analyze usage patterns to improve the product · Communication:, Send important updates and support · Security:, Protect against fraud and abuse · Legal obligations:, Comply with applicable laws.
We process your personal data based on the following legal grounds: Contract (Art. 6(1)(b)), Processing necessary to fulfill our agreement with you. · Consent (Art. 6(1)(a)), For marketing and non-essential cookies. · Legitimate interest (Art. 6(1)(f)), To improve the Service and protect against abuse.
We retain your personal data for as long as necessary for the purposes described in this policy, or as long as required by law. Account information:, For as long as the account is active, plus 30 days after deletion · Usage data:, 12 months (anonymized after 30 days for security and performance) · Billing information:, 7 years (required by law)
Under GDPR, you have the following rights:
The right to know what data we hold about you.
The right to correct inaccurate data.
The right to request deletion of your data.
The right to receive your data in a structured format. To exercise your rights, contact us at.
We take data security seriously and have implemented the following measures: Encryption of data in transit (TLS/SSL) · Encryption of sensitive data at rest · Access control and authentication · Regular security audits · Data processing agreements with subprocessors.
NordicPulse uses artificial intelligence (including Google Gemini, Azure OpenAI, OpenAI, and Anthropic Claude) to generate analyses, text, and recommendations within the Service. This is done in line with the EU's Artificial Intelligence Act (Regulation (EU) 2024/1689). Under Article 50(2), AI-generated content is labeled with a dedicated AI marker where it actually appears in the Service, not only in this privacy policy. This labeling is being rolled out progressively to more tools and is not yet universal across every tool in the Service. Under Article 50(4), we disclose that text, analyses, and images generated by the Service are synthetic content produced by artificial intelligence, and may contain errors or inaccuracies. Such content should not be treated as authentic human-created material without further verification. Content you submit for AI processing (text, URLs, keywords) is sent to the relevant AI provider for processing and is normally deleted after the response is delivered, unless stated otherwise for the specific tool. We do not use your data to train our providers' AI models.
We use the following subprocessors, which may process your personal data. For the complete list, see: We notify customers 30 days before adding new subprocessors.
Supabase, EU (Frankfurt), Database, authentication, and file storage · Vercel, EU region, Hosting and CDN · Azure, EU (West Europe), Backup, AI services, Key Vault.
Google Vertex AI (Gemini 3 Flash), EU (Netherlands), Primary AI model for all tools. Processed in the EU region (europe-west4, Netherlands) with a 2M token context window and 4-layer redundancy (99.9% uptime). · Azure OpenAI, EU Data Boundary, AI embeddings (EU-only processing) · OpenAI, SCCs + DTIA, AI text generation and embeddings · Anthropic (Claude), SCCs + DTIA, AI text generation (humanizer) · OpenRouter, SCCs, AI model routing (fallback) · Perplexity, SCCs, Live web research · Fal.ai, SCCs, Image generation.
Search data providers only have access to publicly available web data. They do not have access to your private project data or personal data. DataForSEO, EU (SCCs), Keyword, SERP, backlink, and domain data (live API) · Serper.dev, US, SERP data and search results · Google APIs, Global, Search Console, Analytics, PageSpeed (with your consent) · YouTube API, Global, Video metadata · Azure Text Analytics, EU (West Europe), Text analysis and sentiment analysis.
Stripe, EU / PCI-DSS, Payment processing · Brevo, EU (France), Email delivery · ElevenLabs, US / SCCs, Text-to-speech · Pexels, Public, Stock images and video.
Shotstack, Planned, Video processing and rendering · Nebius, Planned, Image generation (FLUX) SCCs = Standard Contractual Clauses (the EU's standard data transfer agreements). DTIA = Data Transfer Impact Assessment. We do not transfer data outside the EU/EEA without adequate safeguards under GDPR Chapter V.
We transfer certain personal data to US-based providers under Standard Contractual Clauses (SCCs) and the Schrems II framework.
We have entered into the EU's standard data transfer agreements with all US providers.
We have assessed all transfers on a case-by-case basis: Data types:, Primarily public SEO data · PII classification:, Minimal · US CLOUD Act risk:, Low · Supplementary measures:, TLS 1.3 + AES-256 encryption, 30-day data retention, access control and logging. Transfers are legally sound.
For critical AI processing, we use Azure OpenAI EU Data Zone Standard, which guarantees EU-only data processing.
You can: Object to transfers to specific providers · Request details of our DTIA assessments · Require EU-only processing.
We use cookies to: Keep you logged in (necessary) · Remember your preferences (necessary) · Analyze use of the Service (optional) You can manage your cookie preferences via the banner shown on your first visit.
If you have questions about this privacy policy or want to exercise your rights, contact us: You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet) if you believe we are processing your personal data in violation of privacy law.