Privacy Policy

AIKI AS, organisation number 935 213 657, is the controller for personal data processed on aikias.no, through the website's forms and when following up those submissions. This policy does not cover customer-specific deliveries where responsibility and processing are governed by a separate agreement.

The data we process depends on what you do:

• Contact and organisation: name, email address, optional phone number, company, organisation number and the content of your enquiry.
• Resources and analyses: answers about your organisation and work processes, a public website URL, analysis input and result.
• Optional analytics after consent: page URL, clicks, scrolling, pointer movements, browser and device data, performance data, technical request data and pseudonymous identifiers. Microsoft Clarity may create heatmaps and session recordings. Page content and text entered in form fields are masked for Clarity.
• Recruitment: position, location, LinkedIn profile, source, CV, application and other information you choose to submit.

Company details may be supplemented from the Brønnøysund Registers and publicly available websites. Do not submit special-category personal data, secrets or private URLs through the website's open forms.

We use the data for clearly defined purposes:

• Answering enquiries, delivering a requested resource or analysis and following up a specific request.
• Measuring use and performance to improve the website, but only after active analytics consent.
• Sending newsletters and marketing only when you have made a separate, optional choice.
• Processing job applications and conducting recruitment.
• Operating and securing the website, preventing abuse and meeting legal obligations.

The legal basis depends on the purpose:

• Contract or steps before a contract: when you request a resource, analysis, booking or specific service.
• Legitimate interests: necessary and expected follow-up of B2B enquiries and job applications, securing the website and preventing abuse. We limit data, access and follow-up and balance the interest against your rights.
• Consent: separate sign-up for newsletters or other direct marketing.
• Consent: optional analytics with PostHog, Vercel Analytics, Speed Insights, Microsoft Clarity and Google Analytics. Consent can be withdrawn at any time.

The maximum periods set by AIKI are 12 months after the last genuine contact for enquiries and prospective customers, 12 months for analysis data, 6 months after the recruitment process ends for job applications, 90 days for security logs, and until unsubscribe or 24 months without activity for newsletters. Consent evidence may be retained as long as needed to document the choice. Contract and accounting records are retained for the legally required period. Operational deletion in each provider account must be verified before these periods can be considered fully enforced.

Data is made available only to AIKI and providers needed for the selected flow:

• Vercel for hosting and private document storage, and Railway for hosting our Cal.com-based booking interface. PostHog, Vercel Analytics, Speed Insights, Microsoft Clarity and Google Analytics are activated only after analytics consent.
• Pipedrive for CRM, Slack for internal follow-up, Resend for email, the Cal.com software for booking, Google PageSpeed for analysing a public URL, Exa for discovering public company information, and the Brønnøysund Registers for company search.
• External AI processing may use OpenRouter with a selected model provider, OpenAI, Google Gemini or Vercel AI Gateway. These routes remain disabled until the provider, model, retention, training and transfer settings are approved in production configuration.
• Google Preferred Sources on public pages. When the button approaches the visible area, the browser connects directly to Google and sends the public page URL and technical request data.

Some providers or subprocessors may make data accessible outside the EU/EEA. The exact role, region, transfer mechanism, subprocessors and data processing agreement for the accounts actually used are being verified separately. We therefore make no general claim that every agreement, EU storage location or transfer mechanism has been confirmed.

Necessary first-party cookies store a versioned analytics choice for up to one year. After consent, pseudonymous analytics IDs may be created and coarse first-touch and session source may be stored locally in the browser for up to one year. PostHog, Vercel Analytics, Speed Insights, Microsoft Clarity and Google Analytics do not load until you actively accept cookies. Meta Pixel is not active.

You can decline without losing access. Open ‘Privacy settings’ in the footer to change or withdraw your choice as easily as you gave it. Withdrawal stops new optional analytics calls and deletes analytics cookies and locally stored source information that the website can control in the browser.

Depending on the processing, you may have the right to:

• Access and receive a copy of the data, and have inaccurate data corrected.
• Request erasure or restriction of processing.
• Receive data in a portable format and withdraw consent without affecting previous lawful processing.
• Object to processing based on legitimate interests and always to direct marketing.

Contact hei@aiki.as to exercise your rights. You also have the right to lodge a complaint with the Norwegian Data Protection Authority.

We use access controls, private documents, time-limited document links, validation, rate limits and data minimisation. Form content and raw provider errors must not be written to open logs. Hosting and security systems may still process IP addresses and technical request data for operations, troubleshooting and abuse prevention.

We update this policy when data flows, providers or purposes change. The date at the top shows the latest content update. A new purpose or changed consent basis requires new information and, where necessary, a new choice.

Do you have questions about how we process your data? Get in touch with us.

AIKI has not appointed a data protection officer. Privacy questions and rights requests should be sent to hei@aiki.as.

When an analysis uses external AI, you are clearly informed before submission and with the result. The result is advisory and must be assessed by a person.

AI input is limited to information about the organisation and work process, and content from a public website where relevant. Explicit contact fields such as name, email address and phone number are kept out of the prompt. Free text and public sources may still contain names; email and phone patterns are redacted before external processing.

Reduced data is described as minimised or pseudonymised, not anonymous. Do not enter personal data, special-category data, secrets or confidential customer information in free-text fields.

We do not use the website's AI results for solely automated decisions that produce legal or similarly significant effects for you.

We do not claim that an AI provider avoids model training, uses a specific EU region or deletes within a particular period until this has been verified for the account and model actually used.

If approved provider configuration is missing, the server stops before an external model call and displays a controlled error. Contact details must not be sent to the model.

Our Cal.com-based booking interface is hosted by Railway and processes the details you enter to show available times, create the booking and send confirmation. Booking is not marketing consent.

Job applications are made available to authorised AIKI staff through private Vercel Blob storage and Pipedrive. Slack is used for internal notification only when a dedicated application webhook is configured; the system does not fall back to the general webhook.

CV and application documents use time-limited, signed read links for up to seven days. The documents must not be publicly accessible or indexed.

We do not retain applicants in a candidate pool without separate, optional consent. Submitting an application is not such consent.

Google PageSpeed may receive a public URL for technical analysis. Do not submit internal, authenticated or private addresses.

The Brønnøysund Registers may receive a company search and return public organisation details when you use the company picker.

Using open forms is optional, but required contact fields must be completed so we can deliver what you request. An optional newsletter choice does not affect delivery.